The Plugin Habits Most Likely to Get You Hacked

When a small business site gets compromised, the story is boring. No one targeted you. A scanner found a known hole in software you installed and forgot about, and a script walked through it. Here are the habits that leave those holes open.

Installing a plugin to solve a five-minute problem

You needed a table on one page, so you installed a table builder. That plugin now runs on every page load, forever, and its security is your security. Before installing anything, ask whether the job can be done with content, a bit of CSS, or a feature the theme already has.

Deactivating instead of deleting

A deactivated plugin still has its files on the server, and some vulnerabilities are exploitable in files that are never loaded by the site itself. Deactivation is a testing step, not a removal. If you are done with it, delete it.

Trusting the plugin count over the plugin age

Twenty well-maintained plugins are safer than five abandoned ones. The number to watch is the date of the last update and whether the developer states compatibility with the current version of the platform. Anything untouched for two years should be treated as a candidate for replacement, no matter how well it works today.

Buying premium plugins and never renewing the license

This is the sneakiest one. Premium plugins usually stop delivering updates when the license lapses, and they do it quietly. The plugin keeps working, so nothing prompts you, and the site silently drifts onto an unpatched version. Track your renewals in the same place you track your domain.

Letting nulled or bundled software in

Nulled premium plugins from a download site are the single most reliable way to get a backdoor installed on purpose. The other risk is plugins bundled inside a purchased theme, which often ship outdated versions that only the theme author can update, on their own schedule.

What good practice looks like

• An inventory of what is installed and why, reviewed quarterly.
• Updates applied on a schedule, tested on staging when the plugin touches money or forms.
• Removal of anything the site would still work without.
• A backup you have restored at least once, so patching is not a scary act.

None of that is glamorous, and all of it is cheaper than a cleanup.