Found your WordPress site hacked? The cause might not be the site itself. It could be an old, abandoned website sitting on the same hosting account that you forgot was even there. One stolen password or one outdated plugin on that forgotten site is sometimes all it takes for malware to spread to every other site sharing that hosting, often without you noticing until real damage is done.
Many small business owners accumulate old sites over the years: a previous business venture, a test site, a client project that never launched. If they’re sitting on the same hosting account as your active website, they’re an open door.
Why Old Plugins Are Such a Common Entry Point
Plugins are consistently the weak link in WordPress security. Patchstack reported 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42% jump from the year before, and found that around 91% of these were in plugins rather than WordPress itself.
That matters because an old site you haven’t touched in years almost certainly has plugins that haven’t been updated either, and each of those is a potential vulnerability that attackers actively scan for. Wordfence documented a case where a critical flaw in the Burst Statistics plugin let attackers impersonate site administrators, putting over 200,000 sites at risk before the vendor patched it. That’s the kind of vulnerability that can sit quietly on a dormant site for months.
It’s Not Just Clever Hackers, It’s Automation
It’s easy to picture hacking as a targeted attack on your business specifically, but most of it is automated and indiscriminate. Security network ReportedIP recorded almost 1.7 million attacks between May and July 2026, and password-guessing on the WordPress login page was the most common WordPress-specific attack.
An old site with a weak or reused password is exactly what these bots are looking for. Once they’re in, and if that site shares a hosting account with your active business website, the infection can spread to your other sites too. WordPress.org’s own guidance warns that on shared hosting, a hack can affect more than just your site.
How to Tell If Your WordPress Site Has Been Hacked
Signs of a hack aren’t always obvious. Look out for unexpected admin users you didn’t create, strange redirects when visitors land on your site, unfamiliar files appearing in your WordPress directory, or your host suddenly suspending your account for “suspicious activity.” Sometimes the first sign is Google flagging your site as unsafe in search results.
If you suspect a problem, WordPress.org’s guidance on hacked sites recommends documenting what you find, scanning the site thoroughly, and only updating WordPress core and plugins once any compromise has been fully removed. Rotating all your passwords and credentials after cleanup is a critical final step, not an optional one.
It’s also worth knowing that the infection isn’t always where you’d expect. Wordfence detailed a forensic investigation where a site kept getting reinfected because the actual backdoor was hiding outside the WordPress directory entirely, inside a webmail application’s log files. A proper clean-up sometimes needs to look at the whole server, not just the WordPress installation.
What To Do With Sites You No Longer Use
The simplest fix is also the most overlooked: if you’re not using a site, don’t leave it live. Either delete it properly, including its database, or take it fully offline rather than letting it sit there unmaintained and unmonitored.
For sites you are using, WordPress.org’s hardening guidance points to the basics that genuinely make a difference: keep core and plugins updated, use strong unique passwords, and set up two-factor authentication wherever you can. WordPress.org also issued a security announcement in July 2026 urging site owners to update immediately in response to critical vulnerabilities, a reminder that these updates aren’t just routine admin.
If you manage multiple sites on one hosting account, it’s worth auditing all of them, not just your main site. An old test site or a dormant project can undo all the good security practices on your active, income-generating website.
The Key Takeaway
A WordPress site hacked through an old, forgotten website isn’t a rare edge case, it’s a well-documented pattern. Every site on your hosting account, active or not, is a potential door for attackers, and outdated plugins remain the most common way they get through it. Regularly auditing what’s actually live on your hosting, keeping everything updated, and retiring what you no longer need are simple habits that prevent a much bigger headache later.
If you’d like help auditing your WordPress sites or cleaning up old, unused websites securely, feel free to get in touch.
