Your Website Isn’t the Target. It’s the Tool.

13 October 2026/,

WordPress security series · Part 4 of 5

“Why would anyone hack us? We’re a small business.” I hear it every week, usually from someone staring at a hacked WordPress site. It is the wrong question.

The August 2026 example

~2,000
hacked sites turned into criminal infrastructure
2021
how old some of the compromised installs were
months
how long a hidden compromise can sit unnoticed

In August 2026, Check Point Research exposed a criminal operation it called StopAndProtect. The operators had quietly taken over nearly 2,000 WordPress websites and turned them into infrastructure: hosting malware, controlling infected computers and storing data stolen from victims.

Those websites were not chosen because they were important. They were chosen because they were easy. Outdated WordPress installs, some dating back to 2021, and plugins nobody had updated.

Why criminals want your website

A small business website is useful to criminals for the same reasons it is useful to you. It has a clean reputation. Email filters and browsers trust it. It is always on. And nobody is watching it closely.

That makes it the perfect place to hide things that would be blocked if they came from a known bad address.

What it costs you

  • Google flags your site as dangerous and customers see a red warning page.
  • Your emails start landing in spam, or bouncing altogether.
  • Your hosting account gets suspended.
  • If customer data was on the site, you may have a notifiable data breach on your hands.

Because the attackers want to stay hidden, your site can look completely normal for months.

Signs worth checking today

  • Administrator accounts nobody recognises.
  • Files on the server that nobody on your team uploaded.
  • Search results for your business showing pages you did not create.
  • A sudden drop in customers receiving your emails.

Most of these trace back to the problems covered earlier in this series, especially abandoned plugins.

The question to ask this week

“What sits in front of our website, and what did it block last week?”

If nobody can answer, nobody is looking.

Next step

Incident response (from $700 inc GST) removes the infection and tells you how they got in. A Security Audit (from $1,000 inc GST) finds the open doors before someone else does.

Call 1300 856 393

Common questions

How do I know if my WordPress site has been hacked?
Look for unknown administrator accounts, unfamiliar files, strange pages in Google results, browser warnings or email problems. Many infections show no visible sign, so a professional check is worth it.
Will my host tell me if my site is hacked?
Sometimes, usually by suspending your account. Most budget hosts do not monitor individual WordPress sites.
Is a small business website really worth attacking?
Yes. Attackers scan the internet for known flaws and take over whatever they can. To them, your site’s value is its clean reputation, not your data.

The five-part series

  1. Five Hours: The Gap Between a WordPress Flaw and an Attack
  2. Abandoned Plugins: The WordPress Risk You Can’t See
  3. When Your Backup Plugin Becomes the Way In
  4. Your Website Isn’t the Target. It’s the Tool. — you are here
  5. A Hacked Website Is Now a Compliance Problem (27 October)

Based on the full article: Your WordPress Site Is Probably Already a Problem.