An agency or freelancer built your website and you are not quite sure what is in it. In 2026 AI finds a flaw in hours, and attackers do not look for big companies but for vulnerable plugins. What that means for you, and which questions to ask your agency.
Pentesting HackIndex 6 min read
Short answer
Yes, a small website is interesting too. Attackers do not pick a company, they automatically look for sites with a known flaw, often in a plugin. In 2026 there are sometimes only a few hours between a flaw becoming known and the first attacks. You do not need to know how your site works to keep it safe, but you do need to know who maintains it and whether anyone has ever tested it.
You had a website or web shop built. It works, customers find you and it needs little attention. How it actually works, you don't really know. Which plugins it uses, who updates them and whether anyone has ever checked if it is secure, you don't know either.
That is completely normal. You don't need to know how your site works. But an attacker does, often within minutes. And in 2026 that goes faster than ever.
Many business owners think: who would want to hack my site? The answer is: nobody in particular. Attackers are not looking for your business, they are looking for sites with a known flaw. Software searches the whole internet for them. A hair salon, a plumber or a web shop with ten products ends up in that net just as easily as a large organisation.
This year's Verizon report on data breaches puts it this way: the attacks are opportunistic, it is not about the industry or the revenue of the victim. In 2026 a flaw in software is for the first time the main way attackers get in, more often than stolen passwords.
In July 2026 a researcher found a serious flaw in WordPress itself, the system a large share of all websites runs on. He used an AI model and found the flaw in about ten hours. It worked on a standard WordPress install, without plugins and without logging in.
WordPress released an update. Within a few hours of that update, the attacks had already started. Other researchers recreated the flaw with the help of AI within minutes. Their traps logged tens of thousands of attempts and more than a hundred administrator accounts that attackers had quietly created.
The pattern is wider than this one flaw. Patchstack, which tracks WordPress security, found that for the most attacked flaws there are 5 hours on average between a flaw becoming known and the first attacks. If your site is updated once a month, you are weeks behind.
A WordPress site or web shop is the base plus a stack of plugins: for forms, the shop, statistics, email or a map on the contact page. According to Patchstack, more than 11,000 new flaws were found in the WordPress ecosystem in 2025. 91 percent of them were in plugins, not in WordPress itself. And for almost half of them, the maker had no fix yet when the flaw became known.
Two examples from 2026:
Gravity SMTP, a plugin for sending email, on about 100,000 sites. Without logging in, an attacker could request the keys of the email services connected to it. Wordfence blocked more than 17 million attempts.
WP Maps Pro, a plugin for maps. Without logging in, an attacker could create their own administrator account and take over the site. Wordfence saw almost 3,000 attacks within 24 hours.
In both cases there was an update. Whoever installed it in time was safe. Whoever did not know that plugin was on their site had no idea anything needed to happen.
What can go wrong
Take customer data
Names, addresses and orders from your web shop or contact form. You are then required to report a data breach.
Show a fake payment page
Customers pay the attacker instead of you, and only notice when their order never arrives.
Send email in your name
With the keys of your email service, phishing emails go out that look exactly like yours.
Use your site for something else
A hidden administrator, spam or malware on your site. You often only notice when Google marks your site as unsafe.
You don't need to become technical yourself. Ask these questions to whoever built or maintains your site. The answers say a lot.
Who updates my site and plugins, and how often? The right answer is: automatically, or within a day of a security update. Not: when you ask for it.
Which plugins does it use, and are they all still needed? A plugin that is not there cannot have a flaw.
Will I hear about it when something my site uses has a flaw? You want to know someone is keeping an eye on it.
Is there a backup stored outside the site itself, and has it ever been restored? A backup that was never tested is a gamble.
Has anyone ever tested the site for security? Not a scan, but someone who checks by hand what can go wrong.
In a pentest a tester tries, with your permission, to get into your site the way an attacker would. The difference with a scan: a scan looks for known flaws, a tester also looks at what a scanner misses, such as who can see which data.
You don't need to know how your site works for that. For common sites, such as WordPress and WooCommerce, HackIndex sets up a safe copy of your site at no extra cost. That way your real site runs no risk. You get a report in plain language, with a fix for each finding that your agency or developer can apply straight away. A web and API pentest starts at €1,950 excl. VAT, with a fixed price once the scope is set.
Yes. Attackers automatically look for sites with a known flaw, not for a particular business. A small site with an outdated plugin is just as useful to them as a large one.
That helps a lot, if they apply updates quickly. A test goes further: it looks at flaws in how your site was built, which no update fixes. The report is also written for your agency, so they can fix it.
No. Access to your hosting or a backup is enough. HackIndex sets up a safe copy from it and tests that, so your live site runs no risk.
You don't need to know how your site works. Describe what you have, and you get a proposal with a fixed price.
Briefly describe what you have. You receive a proposal with a fixed price.
