WordPress sites get hacked mostly through outdated plugins, weak passwords and neglected themes. Prevent it with regular updates, off-site backups, uptime monitoring and a tested restore. A WordPress care plan covering these starts from AED 295 per month with us, excluding 5% VAT, against the cost of a day offline.
Your website has been quiet for two years. Then a customer calls to say Google shows a warning, or your own page opens a casino advert. Nobody has logged in since the developer left. This post explains why that happens, and what to do so it does not.
Why WordPress sites get hacked
WordPress runs a very large share of the web, which makes it a popular target. Attackers do not pick your business. They run automated tools that scan thousands of sites for known weak spots, and yours is one of them. It is closer to someone trying every car door in a car park than a targeted theft.
The weak spots are usually the same few. According to the annual reports from Patchstack, a WordPress security firm, most reported WordPress vulnerabilities are found in plugins and themes rather than in WordPress itself. Check their latest report for current figures. Our summary of the usual causes:
| Cause | What it means | How to reduce it |
|---|---|---|
| Outdated plugins and themes | Known flaws that fix releases already close | Update on a schedule; remove what you do not use |
| Weak or reused passwords | Attackers guess or reuse leaked ones | Unique passwords and two-step login |
| Old admin accounts | Former staff or developers still have access | Review users every quarter |
| Cheap or poorly kept hosting | Shared servers with weak isolation | Choose reputable hosting; keep PHP current |
| Pirated or nulled themes | Free copies of paid themes often hide malware | Buy from the author; never use nulled files |
| No firewall or scanning | Attacks are not noticed or blocked | A security plugin or server firewall |
What a hack costs you
The damage is rarely a dramatic defacement. More often it is quiet: redirects to other sites, spam pages that Google indexes, a warning in search results, emails going to spam and customers losing trust. Clean-up takes time, and if there is no clean backup you may have to rebuild.
- Lost sales and enquiries while the site is down or flagged.
- Google warnings that scare visitors away. See our guide on a website not showing on Google for how search is affected.
- Clean-up or rebuild costs, often more than a year of maintenance.
- Data risk, if customer details are stored. Confirm PDPL duties with your lawyer or accountant.
What good maintenance includes
Maintenance is boring on purpose. A care plan is a set of small, repeated jobs. Our WordPress maintenance service in Dubai covers these:
Updates
WordPress core, plugins and themes get updated regularly. Updates should be tested before they go live, because an update can break a page. We update on a schedule, check the key pages after each round and roll back if something fails. Critical security fixes are applied faster.
Backups
A backup is a copy of your site you can restore from. It only counts if it is stored away from the same server, taken often enough, kept for several days or weeks, and tested. A backup that has never been restored is a hope, not a plan. Ask your provider how often copies are taken and where they are kept.
Uptime monitoring
A monitor checks your site every few minutes and alerts someone if it fails. Without it, you find out when a customer tells you. It also shows how often the site is slow. This does not prevent downtime, but it shortens it.
Security scanning and firewall
A scanner looks for changed files and known malware. A firewall blocks bad traffic before it reaches the site. Login protection limits repeated password guesses and can require a second step.
Speed and housekeeping
Old plugins, large images and a full database slow the site. Housekeeping includes removing unused plugins, clearing spam comments and keeping the database tidy. A faster site is also easier for Google and visitors.
What a care plan covers and costs
Our WordPress care starts from AED 295 per month, excluding 5% VAT. Our wider care plans for sites with more needs start from AED 395 per month. The right level depends on the size of the site, how often it changes and whether it sells.
| Item | Covered in a care plan? | Note |
|---|---|---|
| Core, plugin and theme updates | Yes | Tested; rolled back if a page breaks |
| Off-site backups and restore | Yes | Restore is tested |
| Uptime monitoring | Yes | Alerts to our team |
| Security scanning and firewall | Yes | Clean-up of minor issues |
| Small content edits | Depends on plan | Agree the monthly hours |
| Major new features or redesign | No | Quoted separately before work |
| Hosting fees | Usually separate | We can advise; you own the account |
| Full hack clean-up on an unmanaged site | Quoted | Depends on the damage |
Care plans are monthly with 30 days' notice. Change requests are priced before work. You own the accounts, code and domain. If you want to leave, you take everything.
Is it worth the money?
Do a quick sum. Industry advice often puts annual maintenance at around 10 to 15% of the build cost, a rule of thumb quoted by agency blogs and not a precise figure. For a site that cost AED 20,000, that suggests AED 2,000 to 3,000 a year, which is below our entry plan at AED 295 a month (AED 3,540 a year). Our plan includes monitoring, tested restores and people watching the site, so it costs more than that rule of thumb. If you only need occasional updates, a lighter arrangement may fit you better. Be honest about what you need.
Compare that with a day or a week offline. For a site that brings in enquiries or orders, the cost of losing them is usually higher than a year of care. For a brochure site that nobody visits, it may not be. See website cost in Dubai for how maintenance fits in the larger picture.
When you do not need a plan from us
- Your site is a simple page on a managed platform that updates itself.
- You have an in-house developer who already does these jobs on a schedule.
- The site is temporary and you can afford to lose it.
- You would be better off moving to Shopify, which handles updates and hosting for you. Our post on WordPress vs Shopify explains when that makes sense.
You can also do some of this yourself. Strong passwords, two-step login and removing old users cost nothing.
Hosting matters more than people think
Cheap shared hosting puts many sites on one server. If a neighbour gets infected, yours can be affected, and the host may be slow to react. Better hosting gives you your own isolated space, current PHP versions, daily backups and a support team that answers. The difference is often a few hundred dirhams a month and it removes a class of problems.
- Ask whether the host keeps PHP up to date and when it retires old versions.
- Ask where backups are stored and how long they are kept.
- Ask what happens if the site is infected: do they clean it, or just suspend it?
- Choose a host whose servers are fast for UAE visitors.
You should hold the hosting account and the domain in your own name. If an agency or freelancer holds them, you cannot act quickly when something breaks.
Plugins: fewer is safer
Every plugin is code written by someone else, and every one is another thing to update. A site with 40 plugins has far more to look after than one with 12. Before adding a plugin, ask whether the theme or WordPress already does the job. When you retire a plugin, delete it, rather than just switching it off, because deactivated code can still be attacked.
A simple do-it-yourself checklist
- Log in and check for pending updates for core, plugins and themes.
- Delete plugins and themes you do not use.
- Make sure every user is still someone who should have access.
- Turn on two-step login for admin accounts.
- Confirm your backups run and are stored away from your server. Try a restore.
- Set up uptime alerts to your phone.
- Write down who to call if the site goes down.
✓ WordPress versions, security guidance and tool features change regularly. Last checked October 2026. Confirm current advice on wordpress.org before relying on it.
If your site is already hacked
- Do not panic and do not delete files at random.
- Change your passwords for WordPress, hosting and email, from a clean device.
- Tell your hosting provider; many can help isolate the site.
- Restore from a clean backup if you have one.
- Update everything, then scan again and remove unknown users.
- If customer data may be involved, speak to your lawyer or accountant about your duties.
Our design study Northbridge Corporate shows the kind of corporate WordPress site this care is designed for.
Questions
Our WordPress care starts from AED 295 per month, excluding 5% VAT, covering updates, backups, uptime and security checks. Larger or busier sites cost more.
Mostly outdated plugins and themes, weak or reused passwords, old user accounts and poor hosting. Attacks are usually automated and not aimed at you personally.
On a regular schedule, such as weekly or monthly, with urgent security fixes applied faster. Updates should be tested before they go live.
Yes. Hosting backups can be short-lived or stored on the same server. Keep your own off-site copy and test a restore.
Yes, clean-up is quoted after we see the damage. If you have a clean backup, restoring is often faster. Tell us as soon as you notice a problem.
Only if you sell online. Shopify handles hosting and updates for stores, but a content site fits WordPress well. See our WordPress vs Shopify guide.