When a client calls me in a panic because "the site got hacked", it was almost never an evil genius. It was a plugin nobody updated, a password that was 123456, or a form that trusted the visitor too much. The good news: the doors attackers use are almost always the same — and you can lock most of them in a weekend. This is the guide I wish every site owner read.
What threats compromise sites most often?
Today's attacks are overwhelmingly automated: bots scanning the internet for known flaws. Your business size doesn't matter — whether the door is open does. The most common ones:
- Outdated plugin, theme or CMS — door #1. Exactly what happened in the recent Everest Forms WordPress case, where a form field became a door to run code on the server.
- Code that trusts the user — form input flowing straight into
eval()or concatenated into SQL. The "original sin" I break down in that same post. - Weak password, no 2FA, or a forgotten admin user — the dullest (and most common) way to lose a site.
- No HTTPS — insecure, plus Google penalizes it and browsers flag it as "not secure".
- Exposed personal data / no LGPD basis — collecting name, e-mail and phone with no policy and no care is a legal risk on top of a technical one. There's a whole guide on it (with a free generator).
- Badly wired AI — chatbots and agents that obey hidden instructions (prompt injection). I built a fake agent for you to hack so you feel why it's structural.
How do I set up a layered protection plan?
Security isn't a silver bullet — it's layers. If one fails, the next holds. This is the plan I apply (and it fits in a weekend):
- Update everything and turn on auto-updates. Remove plugins, themes and accounts you don't use — each is one fewer door.
- Strong passwords + 2FA on every panel. Review admins and delete any you don't recognize.
- HTTPS + a WAF (app firewall, like Wordfence) + automatic backups stored off-server.
- (In code) never trust the user: validate input, use prepared statements, no
eval()on outside data and no secrets hardcoded. - LGPD/privacy: have a privacy policy and a legal basis for the data. Generate yours in minutes with PolicyForge.
- Monitor: alerts for new users, file changes and odd logins. The sooner you know, the smaller the damage.
When should I hire a security professional?
You can do a lot yourself with the plan above. But it's worth calling someone when: you've already been breached (and need a trustworthy cleanup), the site is a store / handles payments or sensitive data, or you simply don't have time and would rather sleep well.
I do hardening, vulnerability fixes and LGPD compliance — without becoming bad news. If any sign above is your case, let's talk.
Where can I go deeper on each threat?
This guide is the map. Each door has its deep dive:
- A plugin with
eval()is hijacking WordPress sites — the Everest Forms case, hands-on. - How to create your website's Privacy Policy (LGPD), for free — with a generator.
- "Ignore all previous instructions" — the prompt-injection attack AI can't defend against.
- How to know if your password is strong — and why "Senha123!" cracks in seconds.
- HTTP security headers — close clickjacking, XSS and sniffing with a ready-made generator.
- How to prevent form spam without CAPTCHA — Honeypot and Time-trap with copy-paste ready code.