Why WordPress Sites on Cheap Hosting Get Hacked
WordPress sites get compromised regularly, and the majority of those incidents share a common factor: they run on shared hosting accounts that cost a few pounds per month. This is not a coincidence. There is a measurable connection between the hosting environment a WordPress site runs on and the likelihood that it will be exploited.
This article explains how cheap hosting creates conditions that make WordPress hacks more likely, what happens during a compromise, what you can do if your site is already on budget hosting, and what a hosting environment needs to support genuinely secure WordPress operation.
How WordPress Hacks Happen on Shared Hosting
The most common WordPress compromise is not a sophisticated targeted attack. It is automated exploitation of known vulnerabilities across thousands of sites simultaneously, running on shared infrastructure that makes exploitation easier than it needs to be.
The attack workflow follows a predictable pattern. Bots scan the internet continuously, looking for WordPress sites hosted on shared IP addresses. They identify sites, probe them for known vulnerabilities in WordPress core, popular plugins, and common themes. When a vulnerability is found, the bot attempts to exploit it. If successful, it injects a backdoor that gives the attacker ongoing access even if the initial vulnerability gets patched later.
The backdoor typically allows the attacker to upload files, execute PHP code, create new admin accounts, and use the compromised server for their own purposes: sending spam, hosting phishing pages, or mining cryptocurrency. On shared hosting, this attack is more likely to succeed and more likely to affect multiple sites simultaneously for several reasons.
The shared server environment may have PHP settings that allow dangerous functions like exec(), shell_exec(), and system() to run. These functions are routinely used to escalate from a compromised WordPress installation to full server compromise. The server may also lack proper process isolation between sites, which means a compromised WordPress site can sometimes read files from other sites on the same server, including database credentials.
Cheap hosting companies make their money by packing as many sites onto each server as possible. The incentive to invest in security hardening, proper isolation, modern PHP versions, and proactive monitoring is limited, because those improvements reduce the number of sites per server and therefore reduce revenue. The customer bears the cost of security compromises that result.
The Specific Vulnerabilities That Budget Hosting Enables
Outdated PHP versions are the most widespread problem. PHP 7.4 reached end of life in November 2022 and has not received security patches since. PHP 8.0 reached end of status in November 2023. Many shared hosting accounts still run PHP 7.4 or PHP 8.0 because the hosting company has not made newer versions available or has not updated the default.
Running an end-of-life PHP version means known vulnerabilities that have patches available are present in your hosting environment and will never be fixed, because the patch was never applied and never will be.
PHP functions that should be disabled are often enabled on cheap shared hosting. The functions exec(), passthru(), shell_exec(), system(), popen(), proc_open(), and curl_exec() allow PHP to execute shell commands on the server. If a WordPress plugin has a file inclusion vulnerability or an arbitrary file upload vulnerability, these functions provide the path from a compromised WordPress site to full command execution on the server. Properly configured WordPress hosting disables these functions or restricts them severely.
Missing or misconfigured server-level security tools are common on budget hosting. Suhosin is a PHP extension that hardens PHP against a range of common attack vectors. ModSecurity is a web application firewall that can block common attack patterns before they reach WordPress. These tools are not always installed or configured on shared hosting, and when they are, the configuration is often a generic default that does not account for WordPress-specific attack patterns.
If you are evaluating whether your current setup needs attention, a thorough WordPress security audit can help identify the specific vulnerabilities present in your hosting environment and WordPress installation.
What Happens When Your Site Is Compromised
Most WordPress compromises are not detected by the site owner immediately. The attacker wants the compromised server to keep running, because they are using it for their own purposes. A WordPress site that is injecting malware into visitor browsers, sending spam email, hosting phishing pages, or mining cryptocurrency can run for weeks or months before the owner notices anything wrong. During that time, the damage accumulates.
Google flags compromised sites in search results and displays a warning that the site may be compromised. This causes search traffic to drop to near zero. Visitors who see the warning are warned away from the site. If your WordPress site is a business tool, this loss of traffic translates directly to lost revenue or lost leads.
The hosting company will eventually notice the malicious activity and suspend the account. When that happens, your site goes offline entirely. You receive a deadline to clean the compromise and restore the site. If you do not meet that deadline, the hosting company deletes the files and the backups. Many budget hosting companies do not maintain separate backups outside of the compromised server, so there is no clean restore point available.
Cleaning a compromised WordPress site is not a trivial task. Backdoors are often hidden in legitimate files, disguised as WordPress core files, or placed in locations that are not obvious. A proper clean-up requires taking the site offline, examining every file against known clean versions, removing all backdoors, updating every component, changing every password, and then monitoring for re-infection. It is significantly more work than restoring from a backup, and it requires confidence that the backup you are restoring from is itself clean.
The Real Cost of a WordPress Hack
The visible cost is the immediate downtime and the effort of cleaning the site. The hidden costs are larger. Search engine penalties take months to recover from even after the site is clean. Customer trust is damaged when visitors see warnings about your site or have their browsers block it.
If the compromise involved customer data, there are regulatory notification obligations under UK GDPR that require you to report the breach to the Information Commissioner's Office within 72 hours of becoming aware of it, and to notify affected individuals. Failure to notify when required is a separate regulatory violation that carries its own potential consequences. This is not a theoretical risk. Any WordPress site that collects names, email addresses, or other personal information through forms, e-commerce, or user accounts needs to treat security seriously.
For a business website that is the primary point of contact with customers, the reputational damage from a hack can exceed the direct costs. Customers who have a bad experience with a compromised site, even if they were not directly harmed, tell other people. The story of your site being hacked becomes part of how your business is perceived online.
Compare this to the cost of proper WordPress hosting. Managed WordPress hosting from a specialist provider typically costs between £15 and £80 per month depending on the plan and provider. A year of proper hosting costs between £180 and £960. A single WordPress hack, including the staff time to clean it, the downtime, the search engine recovery, and the reputational damage, typically costs significantly more than several years of good hosting.
When evaluating WordPress website costs over time, hosting is not just a line item. It is a foundation for security, performance, and reliability. Securing WordPress properly involves multiple layers, and the hosting environment is the foundation that everything else depends on.
What Good WordPress Hosting Looks Like
Proper WordPress hosting isolates each site from others on the server. This is usually achieved through containerisation or dedicated resource allocation that prevents one compromised site from reading files or accessing the resources of another site. Containerised WordPress hosting, as provided by specialist managed hosts, gives each site its own isolated environment that is not affected by what happens on other sites on the same server.
Good WordPress hosting keeps PHP updated and gives you control over which PHP version you use. You need to be able to test your site against a new PHP version before upgrading, and the hosting company needs to support the current and at least one previous PHP version at any given time. Managed WordPress hosts handle this by testing your site against new PHP versions before automatically upgrading, and providing a staging environment where you can test yourself.
Managed WordPress hosts also include server-level security tools that are configured specifically for WordPress. Web application firewalls that understand WordPress attack patterns, automatic malware scanning, and login protection that blocks brute force attacks at the server level before they reach WordPress. These are managed by the hosting company as part of the service, not configured by you after the fact.
Daily automatic backups that are stored separately from the server, with one-click restore, are standard in managed WordPress hosting. If your site is compromised, you restore from yesterday's clean backup, change your passwords, and you are back online in minutes rather than hours of manual cleaning work. This single feature alone justifies much of the cost difference between budget and managed hosting.
What to Do if Your Site Is Already on Cheap Hosting
If you have a WordPress site on cheap shared hosting, audit your current exposure first. Check what PHP version your hosting account is running. Most hosts show this in the control panel or in a PHP info page. If it is below PHP 8.1, you are running a version that is approaching end of life or is already past it.
Check when your hosting company last updated the web server software. Ask them directly if you cannot find this information in their documentation. Check whether your hosting account has exec(), shell_exec(), and similar functions available in PHP. You can test this with a PHP info file or a plugin that reports PHP configuration. If these functions are enabled, your hosting environment is not hardened.
The upgrade path is migration to a managed WordPress host. Most managed hosts offer free migration services where their team moves your site for you. The process involves creating an account with the new host, requesting a migration, and then updating your DNS to point to the new server once the migration is confirmed working. During the migration, both sites can run simultaneously while you verify the new host is working correctly.
Before starting the migration, take a full backup of your current site including files and database. Download it to your local machine. If anything goes wrong during migration, you have a clean restore point. The migration itself typically takes a few hours to complete for a standard WordPress site, and DNS propagation takes up to 48 hours to complete fully, though most users see the new server within a few hours.
Strengthening Your WordPress Security Beyond Hosting
Moving to better hosting addresses the foundation of your WordPress security, but additional steps are worth taking regardless of which hosting you use. Keeping WordPress core, plugins, and themes updated is essential. Security vulnerabilities in outdated software are one of the most common attack vectors, and attackers actively scan for sites running known-vulnerable versions.
Login security is another critical layer. Enabling two-factor authentication for WordPress significantly reduces the risk from compromised passwords. Even if an attacker obtains a password through a phishing attack or a data breach from another service, two-factor authentication blocks access without the second factor. Most managed WordPress hosts include this as a built-in feature.
If your site uses custom PHP forms or contact pages, ensuring those forms have proper CSRF protection is important. Without CSRF token implementation, attackers can trick logged-in users into submitting unintended requests, potentially gaining access to administrative functions or sensitive data. This is particularly relevant for sites that have user accounts, membership areas, or administrative functions beyond the standard WordPress admin area.
For businesses that send email from their WordPress site, whether through contact forms, newsletters, or transactional emails, email authentication matters. Understanding SPF, DKIM, and DMARC helps protect your domain from being used in email spoofing attacks, which can damage your sender reputation and cause your legitimate emails to be flagged as spam.
What Matters Most
The connection between cheap hosting and WordPress security vulnerabilities is well documented and widely understood by those who study web security. Shared hosting environments that prioritise density over isolation, run outdated PHP versions, and lack proper security tooling create conditions where automated attacks succeed more often than they should.
Moving to a properly configured hosting environment is not a guarantee against compromise, but it removes many of the easiest attack paths and limits the blast radius when something does go wrong. The cost difference between cheap shared hosting and managed WordPress hosting is real, but the potential cost of a security incident on cheap hosting is typically much higher once you account for downtime, recovery effort, search engine penalties, and reputational damage.
If you want to review your current setup and understand what changes would make the most practical difference, you can get in touch with details of your current hosting, the platform you use, and any concerns you have about security or performance.