Here's something that changed this year. For the first time in the 19 years Verizon has published its famous breach report, holes in software overtook stolen passwords as the top way criminals get in.
That brings us to the side doors.
Every plugin, theme, app or add-on on your website is a small piece of software written by someone else. Each one is a door. Most are fine. But in 2025 alone, 11,334 new security holes were found in WordPress add-ons and themes, up 42% in a year. 91% of them were in plugins.
The pattern to spot
- Old doors. A plugin that hasn't been updated in a year, or was pulled from the WordPress directory, often has a hole nobody will fix.
- Fast robots. Once a hole is made public, robots start trying it within hours. Sometimes before a fix even exists.
- Poisoned doors. In April 2026 a buyer of 31 WordPress plugins slipped a backdoor into all of them. Owners who kept everything updated still got it, because the update was the attack.
- "Free" copies of paid plugins. These are a favourite way to plant a backdoor. Never use them.
On Wix, Squarespace or Shopify, the builder patches its own software for you, which is a real plus. Your side doors there are the apps, add-ons and pasted bits of code you've connected over the years.
Today's easy wins
- Count your doors. Make a list of every plugin or app on your site. Most owners are surprised.
- Delete anything you don't use. Delete it, don't just switch it off.
- Turn on automatic updates, and glance once a week to check they ran.
The fewer doors you have, the fewer there are to check. Remember that idea. It comes back in lesson 7.