My website keeps getting hacked

You’ve paid to have your website cleaned up. Changed your passwords. Installed the updates. For a while, everything seems fine.

Then someone tells you your website is sending them to a strange page. Your hosting company sends another warning. Or your homepage disappears just when you’re trying to bring in new business.

If you’re searching for “my WordPress site keeps getting hacked”, you’re probably tired of paying for fixes that don’t seem to last.

You shouldn’t need to become a security expert to run your business. But understanding why the problem keeps returning can help you find a lasting solution.

 

Why does it keep happening?

Your website relies on several things working together. There’s WordPress itself, the theme that controls its appearance, the plugins that add features, and the software running behind the scenes.

Your hosting company provides the server - the computer where your website lives.

All these parts need looking after. Updating WordPress doesn’t necessarily update everything underneath it. And removing an infected file doesn’t fix the weakness that let someone put it there.

WordPress’s own advice covers this wider picture, including hosting, passwords and software updates. A well maintained WordPress website can be secure. The question is whether every part of your particular setup is getting the care it needs. When problems keep returning, the whole setup needs checking.

“My WordPress site keeps getting malware”

Malware is harmful software that someone has planted on your website. If it keeps coming back, the original break in may never have been fully dealt with.

Someone might remove the obvious infection but miss a hidden way back in. An attacker could still have access to an account. A restored backup might already be infected. Or the same security weakness could still be there.

A proper investigation needs to check the website’s files, stored information, user accounts and hosting. WordPress also recommends checking the computers used to manage the website and speaking to the hosting provider.

A useful question to ask whoever is fixing your website is:

“How did they get in, and what have you changed to stop it happening again?”

Seeing your homepage working again is a relief. Knowing what caused the problem helps you feel confident that it has actually been addressed.

What do the recent PHP vulnerabilities mean?

PHP is software that works behind the scenes to make WordPress run. A PHP vulnerability is a security weakness in that software.

That means a problem can exist underneath your website, even if you haven’t changed anything and your WordPress updates are complete.

On 21 October 2026, the PHP security team announced fixes for two critical weaknesses:

• CVE-2026-109618: a problem with how PHP behaves when it runs out of memory - the temporary working space it uses to carry out tasks. In certain circumstances, an attacker could use this flaw to make the server run their instructions.

• CVE-2026-109619: a problem where PHP can try to reuse information from memory it has already finished with. Under certain conditions, this could also let an attacker run their own instructions on the server.

The reference numbers simply identify each security issue. You don’t need to memorise them, but they’re useful to pass to your hosting company.

Both can lead to what specialists call “remote code execution”. In plain English, that means someone could make your website’s server do things it shouldn’t - potentially without needing a website login.

Who is affected?

The PHP team advised everyone using PHP to serve websites to update their software. Some hosting setups are more exposed than others, with a setup called Apache mod_php identified as the highest risk.

The initial fixes were released in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Your hosting company should confirm that the relevant fixes are installed and that it has checked any further security announcements.

You don’t need to work out the technical details yourself. Ask your host: “Is the PHP software running my website protected against these vulnerabilities?”

What could happen to a website?

Imagine someone being able to change or delete files on your laptop without your permission. A successful attack could give someone similar powers over parts of your website.

They could potentially access information, change files, install malware or stop the website working. How much they could do depends on what the affected software is allowed to access.

These are possible consequences. They don’t prove that either weakness caused your particular problem.

The practical point is that updating WordPress and its plugins may not be enough if the software running underneath them is still vulnerable.

How can PHP, WordPress and plugins leave an open door?

Plugins add useful features, such as contact forms, booking systems and online shops. Each plugin is another piece of software that needs to stay secure and work properly with everything else.

The combination isn’t automatically unsafe. But an outdated plugin, a coding mistake, a stolen password or missing server update can give an attacker a way in.

As more features are added, there are more updates to manage and more things to check. That can lead to a frustrating cycle:

An update breaks something. You become understandably nervous about installing the next one. Updates get postponed, including ones that fix security weaknesses.

Reducing unnecessary plugins and making someone responsible for the whole website helps break that cycle. WordPress recommends keeping plugins updated and deleting those you no longer use.

What is MySQL injection?

Your website keeps information in a database - an organised store of things such as page content and account details. MySQL is one type of database.

“MySQL injection” usually means SQL injection. This is an attack where someone tricks poorly written website code into sending instructions to the database.

Instead of treating something entered into a form as ordinary information, the website mistakenly treats part of it as a command. Depending on the weakness, an attacker might be able to read, change or delete stored information.

This can happen on different platforms, not just WordPress. Developers prevent it by making sure information entered by visitors stays separate from database instructions.

If this is how someone got into your website, the affected code or plugin needs fixing or replacing.

“My WordPress site keeps breaking” - is that a hack too?

Not necessarily.

Sometimes two plugins don’t work well together. An older theme might not work with a newer software version. Or your hosting might struggle to handle what the website is asking it to do.

Any of these can cause errors or blank pages without a hacker being involved. The same applies if you’re thinking, “My WordPress site is slow to load.”

Large images, demanding plugins, slow access to stored information and unsuitable hosting can all make visitors wait. The cause needs checking before anyone promises that another plugin or a more expensive hosting package will fix it.

A website can be slow without being hacked, and it can have a security problem while appearing to work normally.

What are your options?

1) Keep WordPress and improve its maintenance

If your website still does what your business needs, repairing it properly may be the most sensible choice.

That means finding the cause of any break in, removing unnecessary plugins and replacing software that no longer receives updates. You also need a clear agreement about who handles updates, backups and checks for problems.

Your developer and hosting company should each know what they’re responsible for.

2) Simplify the existing website

Sometimes the difficulty comes from years of additions.

You might have several plugins doing similar jobs, or features your business no longer uses. Reviewing these and simplifying the setup can make your website easier to look after.

3) Move to a different foundation

If you’re spending too much time and money on recurring repairs, rebuilding the website may be worth considering.

Look at the full cost of keeping things as they are: repair bills, time offline, ongoing support and the hours you spend chasing problems.

Moving also needs careful planning. Your content, important features and search visibility need protecting, and old page links should take visitors to the right place on the new site.

The right choice depends on your business and the condition of your current website.

Why we build mohunky websites with Umbraco

At mohunky, we build websites using Umbraco, which runs on Microsoft’s .NET technology. It gives us a foundation for websites designed to be secure, stable and straightforward to manage over the long term.

PHP and .NET handle website code differently. PHP websites commonly store the original source code on the server. .NET websites commonly use code that has been compiled into files humans can't read or edit ready for the software to run.

However, that difference alone doesn’t make a website secure. Visitors don’t normally see the original PHP code, and specialist tools can turn compiled .NET code back into something people can read. 

What matters is how the whole website is built and looked after. Umbraco’s security programme includes testing by its own team and outside specialists, who look for weaknesses an attacker could exploit. Like any platform, it still needs updates and ongoing care.

Our approach brings together:

• Fewer separate parts to manage. We build around the features your business needs, reducing reliance on collections of third party plugins.

• Hosting that’s looked after. Our websites run on fully managed Windows servers in UK datacentres, with regular updates and expert support.

• Room to grow. Our Cornerstone framework - the shared foundation we use to build our websites - lets us add and improve features as your business develops. 

For example, our MTB Strength Factory is built in Umbraco without relying on themes or plugins. That means fewer separate pieces of software to maintain.

We also have websites built more than seven years ago that are still in use. One training provider’s original ten page site grew to include course bookings, members only content and an online shop without needing a rebuild. That’s the kind of useful lifespan we aim for.