One morning I found malware on my website, delivered through a channel I trusted.
I told that story in full in My Own Site Got Hit: Anatomy of a WordPress Supply-Chain Attack, including the two days of forensics and the trail that ended at a plugin vendor’s catalog sold to an attacker.
The short version: my host’s scanner caught the payload the instant it landed, deleting it took a minute, and understanding how it arrived took two days. Total damage: zero. By the standards of website compromises, that’s the best possible outcome, and that’s why I can tell the story calmly.
The incident was over in two days. What it started took weeks, and it changed how I look at every piece of software on my sites.
The incident itself took minutes to stop and days to trace; the audit it started took weeks.
What was scary about finding a plugin nobody installed?
The malware itself wasn’t the frightening part. Malware is weather. If you run anything on the public internet, attacks arrive constantly, automatically, indifferently. My logs show thousands of probes a day, and yours do too, whether you look or not.
The frightening part came later, staring at that folder, when I asked the obvious question: how many ways could something like this get in?
I’ve spent 33 years in technology, a good chunk of it responsible for keeping large systems running, so I made a list. It was a long list. The theme I was running, built by people I’d never met, updated on their schedule. Dozens of plugins, each one a channel that pushes code onto my server whenever its author publishes an update. The page builder with its own crowd of addons.
The theme I was running, built by people I had never met, updated on their schedule.Share on X
Every one of these is a trusted delivery pipeline into my website, and I didn’t choose most of the people I was trusting.
That’s what the security industry calls the supply chain, and once you see it, you can’t unsee it. I’d locked my front door carefully. Meanwhile, forty vendors held keys to the back.
Every one of these is a trusted delivery pipeline into my website, and I didn’t choose most of the people I was trusting.
Run the same inventory on your own site and the list gets uncomfortable fast. Your theme updates when its author says so. Every plugin updates when its author says so. Your page builder. Your forms tool. Your SEO plugin. Your gallery. Each one is a standing arrangement in which code you’ve never read arrives on your server and runs with full permissions.
Any one of those authors could get compromised. Or sell the plugin to someone with worse intentions. Or abandon it to whoever claims the name later. Each of those converts a trusted channel into a delivery vehicle. None of that requires anyone to attack you. You’re just downstream.
That arrangement is worse than any attacker. Plugins change hands, and the thousands of sites running them usually hear nothing about it. The site owner carries all the risk of a sale they never agreed to and never heard about, and the marketplaces act as though that’s the owner’s problem.
Why does a hidden plugin matter more than lost traffic?
This is what made it personal for me. I’m a service provider. My website has a different job from a store shoveling widgets, where traffic volume is everything.
It’s my beacon on the internet. It’s where I live professionally. The people who matter don’t arrive by the thousands. They arrive a few at a time, having heard my name somewhere, deciding whether to trust me with a significant project.
For a business like that, the website has to be excellent for the person standing in front of it: fast, credible, professional, and above all trustworthy. I’ve written elsewhere about why the website matters more in the AI era, and about what building on WordPress involves once the brochure promises wear off. Now imagine that person arrives the week my site is serving spam pharmacy links from a hidden injection, or redirecting to a scam, or simply gone while I rebuild it.
Everyone understands ordinary downtime. A major cloud provider hiccups and half the internet disappears for an afternoon; visitors shrug and come back tomorrow. Outages are weather too, and people forgive weather. A compromise is different in kind, because a compromised site doesn’t just go dark. It impersonates you. It uses your name and your reputation to serve someone else’s garbage to the exact people you most needed to impress. People forgive downtime. They remember impersonation.
How do you audit WordPress plugins after a scare?
So I went down the rabbit hole, and I went down it properly.
Over the following weeks I opened up everything running on my sites and asked each piece the same questions. What do you do? Who maintains you? What happens on my server when your author publishes an update? What would it cost me to remove you?
The answers were educational, and some of them were ugly.
I found a commercial theme that turned out to be an assembly of mismatched parts, shipping code to every visitor for features no page on my site ever used. I found a page builder whose assumptions had wrapped themselves around dozens of my pages, so deeply that leaving it meant rebuilding every page that touched it. I found plugins that did the one thing I wanted plus fifteen things I didn’t, all of it loading on every request.
I found excellent software maintained by exactly one person, and thought hard about what happens to my business the day that one person stops.
The process itself was mundane, so anyone can do a version of it. For each piece of software I asked who publishes it, when it was last updated, how its support threads read, and what its changelog says about momentum.
Ten minutes per plugin, no code reading required. The pattern that emerged surprised me: the risk wasn’t concentrated in obscure plugins from unknown authors.
Some of the heaviest, most tangled, most difficult-to-remove software on my sites came from the biggest names in WordPress, installed years ago because everyone else used them too. Popularity had stood in for evaluation, and popularity only measures marketing. None of those discoveries were the breach. The breach was an event, handled in an afternoon. The audit revealed conditions, and conditions are what determine whether the next event is an afternoon or a catastrophe.
| Question | What the answer can reveal |
|---|---|
| What do you do? | One wanted feature plus fifteen unwanted ones, loading on every request |
| Who maintains you? | Excellent software resting on exactly one person |
| What happens when your author publishes an update? | Code you’ve never read arrives and runs with full permissions |
| When were you last updated, and what does the changelog say? | Whether the project still has momentum |
| How do your support threads read? | Whether questions get answered, and by whom |
| What would it cost to remove you? | Software so embedded that leaving means rebuilding pages |
What this series covers
That audit became this series of articles. Each one takes a piece of what I found and turns it into something you can act on without being a developer:
Why so many commercial themes are Frankenstein monsters of repackaged parts, and how to evaluate a theme by what it does instead of what it includes.
Why page builders are the hardest relationship to leave, and what it took to get out of two of them. How to put your plugin stack on a diet without losing capability. Why the number of people maintaining your software matters as much as the software itself.
How the supply chain delivers attacks through the very update mechanisms you depend on, in hardware as well as software, since these days even a cable can carry a hostile computer inside it. And finally, why security is a posture you hold every day.
My take
Popularity stood in for evaluation on my sites for years. That habit was the bigger problem. The malware died in a minute. The conditions that let it in took weeks to find. Audit every plugin and theme you run. Ask who maintains it, when it last updated, how its support threads read and what it would cost to remove. Ten minutes per plugin, no code required. Do it before your next event turns into a catastrophe.
The takeaway before the series
Take one thing away: your website’s biggest risks arrive through channels you invited. The updates, themes, plugins, and tools you trusted enough to install are how most of this gets in, and an attacker forcing the front door is the rarer case. A modern website is built entirely of other people’s work, mine included, so you can’t stop trusting. Trust deliberately. Skipping ten minutes of checking per plugin is a gamble with a reputation that took years to build, and I won’t take that bet on my own sites.
Know what’s running, know who maintains it, know what it would cost to remove, and keep something watching for the day one of those trusted channels betrays you. And keep real backups, because every other defense can fail and that one still saves you. If you’d rather have someone who has been through this handle it, that is work I do.
I got the easy version of the lesson. The folder appeared, the scanners caught it, and the worst consequence was a series of articles. The next site owner may not get the easy version. The rest of this series is about making sure that when your turn comes, and on a long enough timeline it comes for everyone, your story is as boring as mine.
One trusted update was all it took. Family Cybersecurity is my book on protecting the people who live in your house, and it starts with a ransomware call in the middle of the night.
Frequently Asked Questions
