Blog
When the Tool That Protects Your WordPress Site Gets Hacked
Your backup plugin was meant to be the safety net. Here's what the UpdraftPlus breach means, how to tell if your site is affected, and what to check today.
You installed a backup plugin for one reason: so that if anything ever went wrong, you could roll the site back and sleep at night.
So this week's news is a nasty one. The company behind UpdraftPlus, one of the most popular WordPress backup plugins, was itself hacked. And the attackers used that access to slip hidden backdoors into some of the websites connected to it.
If you use UpdraftPlus, or aren't sure whether your developer does, here's what to check today. Longer term there are two ways out: keep WordPress and keep up with it, or move to a platform where there's nothing to patch and no backup plugin holding keys to your site, which is why we built Mondovo.
What happened?
UpdraftPlus is a WordPress plugin that backs up websites. It's widely trusted, with more than four million active installations. The company that makes it, TeamUpdraft, also offers UpdraftCentral, an optional service that lets you (or your web agency) manage lots of WordPress sites from one dashboard: run backups, update plugins and so on, without logging in to each site.
To make that remote control work, each connected website holds a digital "connection key". Think of it as a spare key you give a trusted building manager.
Over the weekend of 17 and 18 October 2026, TeamUpdraft found that someone had broken into its own systems. The company says it believes its customer database was accessed, including those connection keys, along with customers' names, email addresses, billing addresses and order history. Passwords were stored in scrambled (hashed) form. Card details weren't stored at all, because payments go through separate payment companies.
Then the spare keys got used. Security firm Patchstack reported that over roughly 18 hours on 18 and 19 October, an attacker holding valid UpdraftCentral keys sent commands that made connected websites install hidden "backdoor" plugins. Patchstack counted 99 different names for these fake plugins, most of them bland labels designed to blend in. The security company Nethemba spotted the attack on its own websites and published the first detailed analysis.
Keep the numbers in proportion. Four million is how many websites use UpdraftPlus. It is not how many were broken into. Only sites connected to the cloud version of UpdraftCentral were directly exposed, and nobody has published a count of how many actually received a backdoor.
Should I be worried?
It comes down to one question: does your website use UpdraftPlus, and was it ever connected to UpdraftCentral?
- If you don't use UpdraftPlus at all, this incident doesn't affect your site.
- If you use the free UpdraftPlus plugin and never created an account with TeamUpdraft, the company says you don't need to do anything beyond keeping the plugin up to date.
- If your site was connected to UpdraftCentral, or you pay for UpdraftPlus Premium, treat it as possibly affected and check it today. TeamUpdraft has asked Premium users to check their sites even if they never knowingly used UpdraftCentral, and Patchstack notes that a connection key can be created automatically when a site is linked to a TeamUpdraft account.
Not sure? Agencies often use these dashboards for clients' sites, so ask whoever manages yours.
There's one detail that makes this more than an "update and move on" story. Nethemba found that some versions of the backdoor create a new user account that shows up as an ordinary Editor but quietly has extra powers, including the ability to install plugins. That account stays on the site even after the fake plugin is deleted, and the attacker knows its password. An Editor is easy to scroll past.
What to look for: an account you don't recognise, often with a harmless-sounding name and the Editor role.
What to do today
Work through this list, or forward it to your developer or agency:
- Ask whoever manages your site whether it uses UpdraftPlus, and whether it was ever connected to UpdraftCentral.
- Follow TeamUpdraft's own advice from its security incident page: log in to the site directly (not through the remote dashboard), update UpdraftPlus to the latest version, and delete the UpdraftCentral connection key in the plugin's settings. Security researchers stress that removing the site from the dashboard isn't enough. The key on the site itself has to go.
- Check the list of users. Look for any administrator or editor you don't recognise, especially accounts created since 17 October. Remove them, or ask your developer to.
- Check the list of plugins. Anything nobody remembers installing deserves a closer look.
- Change your passwords: every administrator password on the website, and your TeamUpdraft account password if you have one. If you used that password anywhere else, change it there too.
- Ask for a malware scan. If anything suspicious turns up, TeamUpdraft suggests considering a restore from a backup taken before 17 October.
- Be wary of emails claiming to be from the company. TeamUpdraft says it will never ask for your password or keys.
Backdoor plugins tend to have dull, helpful-sounding names that are easy to scroll past.
If you think your site may already have been broken into, my step-by-step guide on what to do if your WordPress site is hacked walks you through it.
The bigger lesson: every plugin is another key
It's easy to read this as "UpdraftPlus is bad". That wouldn't be fair. UpdraftPlus is a respected plugin that has protected millions of sites, and TeamUpdraft has been open about what happened, published clear steps and shipped an update that cuts off the old connections.
The real lesson is about how WordPress sites are built: add-ons from many companies, each trusted to run inside your website. Some, like remote management services, also hold a key that lets someone outside make changes. Every one of those is another door. When any one of those companies has a bad day, your site can too, even if you did everything right.
That's the part that stings. You didn't miss an update. You installed a well-reviewed backup plugin, exactly as everyone tells you to.
The same week brought a separate scare about serious flaws in PHP, which WordPress runs on (see what the PHP security scare means for your site). For the wider picture, read Is WordPress secure?
Or skip the job entirely. On Mondovo there's no backup plugin to choose, no remote-management keys sitting on your site and no core, theme, plugin or PHP updates to run. Pages are published as static files from a global network, and keeping the platform secure is our job. To see your own business there first, try Mondovo free: paste your current address and it builds three designs from your own pages.
What are the alternatives?
If you'd rather not keep track of all those keys yourself, there are three sensible routes:
- Managed WordPress hosting. You keep WordPress and the host takes on updates, monitoring and malware clean-up, but you still pick your own plugins, so the add-on risk stays.
- An all-in-one website builder. One company runs the platform, so far fewer third-party add-ons.
- A platform that publishes finished pages. Your site goes out as ready-made pages rather than software running on a server, which leaves much less to tamper with. This is the route Mondovo takes.
Why a Mondovo site has no spare keys lying around
Mondovo sites are published as finished pages and served from a global network. There are no plugins to install, no PHP and no remote-control keys sitting on your site. And there's no backup plugin to worry about, because there are no backups for you to manage in the first place. Keeping the platform secure is our job, not yours.
Forms with an enquiry inbox, bookings, an online store, contacts and email come built into Mondovo. One company, not twenty. Mondovo is younger than WordPress and has no plugin directory, so check that anything niche you rely on is built in.
That doesn't make any website "unhackable". Nothing online is, and you should still use a strong password on your account. But it does remove the whole category of risk this incident is about.
Moving is simpler than most people expect. Paste your address and Mondovo brings your public pages, blog posts and images across: your words and site structure, not plugin files. You see the plan before any design is made, then pick from three fresh designs built around your own content. Every old page address, including WordPress-style links, is redirected (301) to the closest new page, and anything that didn't match exactly is flagged for you to check.
Forms, bookings and payments are set up fresh on Mondovo rather than copied from old plugins, and a shop's order history doesn't come across. The WordPress migration page explains exactly what moves. Building is free, and going live is $20 a month on Pro, with hosting and SSL included.
Move my WordPress site to Mondovo → or start building free.
Details from TeamUpdraft, Patchstack and Nethemba as reported on 22 October 2026. Check TeamUpdraft's security incident page for updates.
Frequently asked questions
Is UpdraftPlus safe to use now?
TeamUpdraft has shipped an update that cuts off the old connections. If you use it, update to the latest version and delete the UpdraftCentral connection key from the plugin's settings, logging in to the site directly.
I only use the free UpdraftPlus plugin. Am I affected?
If you never created an account with TeamUpdraft, the company says you only need to keep the plugin up to date. If you pay for Premium or your site was connected to UpdraftCentral, check your site today.
How do I spot the backdoor on my site?
Look for plugins nobody remembers installing, often with dull, helpful-sounding names, and for user accounts you don't recognise. Check Editors as well as administrators, because some versions create an Editor account with hidden extra powers.
Were four million sites hacked?
No. Four million is how many sites use UpdraftPlus. Only sites connected to the cloud version of UpdraftCentral were directly exposed, and no one has published how many actually received a backdoor.
Would this have affected a Mondovo site?
No. Mondovo sites have no plugins and no remote-management keys stored on them, which is what this attack relied on.
Is there a website platform that doesn't need security updates?
No website is risk-free, but on some platforms the updates aren't your job. On Mondovo there's no core, theme, plugin or PHP to update and no backups to manage. Pages are static files from a global network, and platform security is ours to handle.
