The Most Common Website Vulnerabilities

Most websites are not compromised by clever, targeted hacking. They fall to a short list of well-known weaknesses that automated tools probe across the whole internet, day and night. Understanding these common vulnerabilities — in plain language — tells you exactly what to defend against first.

1. Cross-site scripting (XSS)

XSS happens when a site displays user-supplied content without cleaning it, letting an attacker inject a script that runs in other visitors’ browsers. That script can steal session cookies, deface pages or redirect users. The defence is to validate and escape everything users submit, and to add a Content Security Policy so injected scripts simply won’t run.

2. SQL injection

When a site builds a database query by gluing user input directly into it, an attacker can smuggle in commands that read, change or delete your data — sometimes dumping an entire user table. The fix is well established: use parameterised queries (prepared statements) so input is always treated as data, never as code. Modern frameworks do this by default; problems usually come from hand-rolled queries.

3. Outdated software

An out-of-date CMS, plugin, theme or library with a publicly known flaw is a standing invitation. Attackers scan for specific versions and exploit them automatically — no skill required. This is the most common cause of small-site compromise, and the fix is the most boring: keep everything updated, as covered in website security basics.

Vulnerability	What an attacker gains	Main defence
Cross-site scripting	Runs scripts in users’ browsers	Escape input, add CSP
SQL injection	Reads or alters your database	Parameterised queries
Outdated software	Exploits known bugs	Patch promptly
Weak passwords	Account takeover	Strong passwords + 2FA
Misconfiguration	Access to files or settings	Harden defaults
Exposed admin	A door to brute-force	Restrict and monitor

4. Weak and reused passwords

Automated bots try common and leaked passwords against login pages constantly. A weak or reused password on an admin account is often all it takes. Require long, unique passwords, enable two-factor authentication, and lock accounts after repeated failed attempts so brute-forcing simply doesn’t pay off.

5. Security misconfiguration

Default credentials left unchanged, directory listing switched on, verbose error messages leaking stack traces, backup files left in the web root, or over-permissive file permissions — misconfiguration is a broad category and a very common one. Review your defaults, hide internal error detail from visitors, and don’t leave sensitive files where the public can reach them. Missing security headers are a mild form of this too.

6. Exposed admin and login areas

A publicly reachable admin panel is a magnet for automated attacks. You can’t always hide it, but you can restrict access by IP where practical, add 2FA, rate-limit login attempts, and watch the logs for suspicious activity. On WordPress specifically, see the hardening checklist.

Putting defences in place

You don’t have to tackle these alone or all at once. Start with the ordered roadmap in website security basics, run a free scan to see which weaknesses are visible from outside, and learn to read the results so you fix the right things first.

Frequently asked questions

Related guides