How do site compromises happen?

Question

How do site compromises happen?

Answer

The most common way websites get hacked or defaced is through insecure plugins, themes, or components in various CMS software (such as WordPress, Joomla, Drupal, etc.). While the actual CMS is very secure, and any security issues are usually patched very quickly, its plugins and themes are usually not updated or sometimes even checked to see if they have one or more security implications.

The second most common method is malicious software installed on the customer's computer that steals passwords, such as a keylogger or a Trojan. When that user logs onto their cPanel page or uploads changes via FTP, the password is sent to hackers, who then start using it.

Additional resources

How to address a WordPress compromise

Hardening WordPress