2026 is breaking records
If it feels like you hear about another big hack every few days, it's not just a feeling. The year isn't over, and on several key measures it's already the worst ever recorded:
2026 in numbers, as of early November
Sources: NVD vulnerability database (count through Nov 5, 2026); ransomware.live (Nov 6, 2026); FBI IC3, 2025 Internet Crime Report, via Help Net Security (Apr 7, 2026); Check Point Research (Oct 8, 2026).
WordPress isn't sitting this out either. Since the start of 2026, about 6,200 flaws that mention WordPress have been published, compared with about 3,500 in the same period of 2025.
And it doesn't only hit giant companies:
- In May 2026, hackers broke into Canvas, the learning platform schools and universities use. It went down in the middle of exam season, and its login pages were defaced.
- In June 2026, one login that a software vendor called Klue issued in 2022 for a short pilot, and then forgot, gave attackers a way into close to 200 of its customers.
Why your website
Nobody sits at a computer and decides to hack the website of a dental office in Ohio or a roofing company in Leeds. Small business websites get hacked almost always by software that scans the entire internet, nonstop, looking for one thing: a plugin, theme or piece of code with a known flaw. When it finds one, it gets in. Your business name doesn't matter to it.
In 2025, about 40% of all internet traffic came from bad bots, exactly this kind of software. And on WordPress, which runs the websites of a huge number of businesses, the numbers look like this:
WordPress in 2025, at a glance
Sources: Patchstack, State of WordPress Security in 2026; Thales Imperva, 2026 Bad Bot Report.
What this means in practice: updates matter, but they aren't enough. A plugin its developer stopped maintaining, code someone wrote for you five years ago, or a form that accepts files without checking what they are, won't show up on any updates screen.
What happens the day a site gets hacked
What happened to me
Years ago I ran a big blog with millions of views. A hacker broke in and replaced it with a malicious site. The blog was gone, and with it all the work I'd put into it and into its Google rankings.
One hack can wipe out years of work. And a hacked site doesn't always get back to where it was, even after it's cleaned up.
Most of the time, the business owner doesn't find out on their own. A customer sends a screenshot, or the inquiries from the website just stop. These are the things that happen most:
- Visitors get sent to another site. In the GoDaddy and Sucuri report on 2024, malware was found on 74.7% of infected sites, usually code that redirects visitors somewhere else.
- Pages you didn't write appear on your site. Spam pages, often in foreign languages, made for Google, not for you. This happened on 38.4% of infected sites.
- Google warns people away from your site. Search results show "This site may be hacked," and Chrome shows a red warning screen before the site even loads. After the cleanup you have to ask Google for a review, which takes anywhere from a few days to a few weeks.
- Your Google rankings take a hit. People who see a "hacked" warning in the results don't click, and the spam pages the attacker added compete with your real ones. Rankings you built over years can disappear within days, and they don't always come back.
- Customer details leak. Every form on your site stores a name, a phone number and sometimes more. In the US, every state has a law that requires notifying people when their personal information is exposed in a breach. In the UK, a breach that puts people at risk has to be reported to the ICO within 72 hours of finding out, where feasible.
What's happening in the US and UK
The FBI's latest report counted a record $20.9 billion in reported cybercrime losses in the US in 2025. In the UK, the government's 2026 survey found that 43% of businesses had a breach or attack in the past 12 months, and among small businesses with 10 to 49 employees it was 46%. Phishing was the most common type, at 38% of businesses.
Websites get hit in waves. Three from this year:
Three 2026 attack waves on business websites
- Online stores hit within daysA flaw in Magento and Adobe Commerce, the store software, let attackers upload files that run code. By mid-April, the security firm Sansec saw malicious uploads attempted on most of the stores it monitors
- More than 17 million attempts against one pluginA flaw in Gravity SMTP, a WordPress email plugin on about 100,000 sites, leaked passwords and keys for the site's email services with no login needed. Attacks peaked in June, months after the fix came out
- Around 200,000 sites open to takeoverA flaw in Kirki, a WordPress plugin on more than 500,000 sites, let anyone with just a username take over any account, including the admin. When the attacks started, about 40% of those sites still hadn't updated
Sources: Sansec (2026); TNW (Jun 20, 2026); Daily Security Review, citing Wordfence (Jun 3, 2026).
Two takeaways. First: none of these attacks targeted a specific business. They came in through one piece of software that thousands of sites share. Second: in the two WordPress waves, a fix already existed. The sites that got hit hadn't installed it, or didn't know they had that plugin at all.
AI changed the pace
Until recently, finding a new flaw took an expert and time. That's no longer true:
- In May 2026, Google reported for the first time that attackers used a flaw nobody knew about, one it believes was built with the help of AI. It got past the code sent to your phone at login in a popular website admin tool, and criminal groups were planning to use it on a large scale.
- According to Verizon's 2026 report, exploiting software flaws became the most common way breaches start, at 31%, ahead of stolen passwords.
The same technology works in the other direction. If attackers can run AI that hunts for holes in code, you can run AI that finds them first. That's what I do.
What I do
I get access to your website's code, and Platin Digital's agent system goes through it. An AI agent is software that understands code and reads it like a developer would, just without getting tired. Instead of one agent reading everything, there's a whole team, and each agent has a job:
How the agents work on your website
- MappingThe first agents build a map of the site: where visitors come in, where they send information, who can manage what, and which plugins and code libraries the site uses
- HuntingEach agent gets one area of the map and follows everything that comes into it through the code, to the place where it's saved or run. They work in parallel
- Second checkEvery finding goes to a different agent, one that didn't find it, whose job is to try to disprove it. Only what survives goes into the report as a confirmed finding
- ReportI go over the results and send you a clear report, with a suggested fix for every issue
What the agents look at:
- Logins and permissions. Who can get into the admin area, and whether there's a way to get around the password or get more access than someone should have.
- Everything visitors send. Forms, file uploads, site search, comments. This is where most hacks that start from the outside get in.
- Other people's plugins and code libraries. Every plugin is code someone else wrote, and it runs on your site with the same permissions.
- Separation between customers' data. Whether one customer can see another customer's order, file or details.
- A chatbot or AI tool on your site, if you have one. Whether it can be tricked into revealing information or doing something it was never supposed to do.
Two things worth knowing. The agents read the code, they don't attack the site. Your live site keeps working as usual, and nobody sends it hacking attempts. And because the check works on the code itself, it finds things an outside scan can't see: a form that checks the file type only in the browser and not on the server, or an admin page that checks that you're logged in but not that you're allowed.
What the report looks like
The report doesn't bury you in 200 alerts. It's built like this:
- Where things stand. A few sentences: how the site is doing, and what's most urgent.
- Confirmed findings. Issues that passed the second check. For each one: exactly where it is in the code, what an attacker could do with it, and the smallest fix that closes it.
- Findings to verify. Things that look suspicious but can't be proven from the code alone. Each one says what needs checking to close it.
- Hardening recommendations. Not holes, but things worth improving so the next problem is harder.
- What's done well. Yes, that gets written too.
- What was checked and what wasn't. So you know exactly what the report covers.
Here's what one finding in the report looks like. This is an illustration, not a client's site:
The "Send us your résumé" form accepts any type of file
- What we found
- The form checks the file type only in the browser. The server saves any file it receives, in a folder that can be reached from the outside.
- What it means for you
- Someone who knows how to send a file straight to the server can upload a file that runs code on your site. That's usually how malicious redirects and spam pages start.
- What to do
- Check the file type on the server too, and save uploads in a folder that doesn't run code. The suggested fix is written in the report.
How we work together
Most business owners worry about the technical part. In practice, your part is short:
What you do, and what I do
- Send me your website addressOn WhatsApp. You don't need to know what it's built on. I get back to you with a price
- Give access to the codeA separate SFTP or FTP login, just for me. Your hosting company or whoever built the site can set it up in a few minutes, and I send them exact instructions. Don't know where the site is hosted, or the person who built it is long gone? That happens a lot. We'll figure it out together
- The agents work, and you get a reportYou don't have to do anything, and the site keeps running as usual. Within 3 business days from when I have access, I send the report and answer every question, yours or your developer's
- Decide who fixes itMe, with a separate quote, or your developer, following the report. And at the end, you delete the login you created for me
Was your site custom-coded, without WordPress? Instead of FTP, you give me read access to the code repository, for example on GitHub.
What it costs
A full check and a report within 3 business days: from ₪1,000 (Israeli shekels, about $310 or £230 at November 2026 rates). The price depends on the size of the site, because a site with a store, customer accounts and dozens of plugins takes the agents a lot more work than a five-page business site. You get the exact price before we start. Fixes, if you want them, are priced separately after the report, based on what was found.
Frequently asked questions
Can the check take my site down or slow it?
No. The agents read the code, they don't send hacking attempts to the site. As far as your site and your visitors are concerned, nothing happens.
Why do you need access to the code? Isn't the website address enough?
From the outside you only see what the site shows. Most issues are in the code: how a form saves files, who's allowed to see what, what a plugin does with the information it receives. Without reading the code, all you can do is guess.
Is it safe to give you access?
You create a separate login just for the check, and you don't give me your own password. If your hosting company allows it, that login gets read-only access. Nobody outside the check sees your code, and at the end you delete the login.
Can I give you a WordPress application password instead?
An application password gives access to content through the WordPress interface: posts, pages, users. It doesn't give access to the files or to the code of your plugins and theme, and that's where most of the issues are. That's why I need SFTP or FTP access.
My site is on Wix or Shopify. Is this relevant?
Less so. On those platforms, the company itself runs the server and most of the code, and there's no access to them. If someone built custom code on top of the platform, that can be checked. Tell me what you have, and I'll tell you whether there's anything to check before you pay.
Is this a penetration test?
No. A penetration test is a controlled attack on the live site, done by a specialist over several days, and sometimes a big client or a regulation requires one. Here, the agents read the code in depth and don't attack the site. If you need a formal penetration test, I'll tell you before we start.
How soon do I get the report?
Within 3 business days from when I have access to the code.
What if nothing is found?
You get a report that shows what was checked, what's done well, and that no issue was found. That's not a promise your site will never be hacked: a new flaw can be published tomorrow in a plugin you have installed.
Who sees the report?
Only you, and whoever you decide to send it to.
Sources
- Patchstack, State of WordPress Security in 2026
- Thales Imperva, 2026 Bad Bot Report
- GoDaddy, Annual Cybersecurity Report 2024
- Google Search Central, Hacked sites and search warnings
- Help Net Security, FBI 2025 Internet Crime Report: losses break $20 billion
- UK government, Cyber Security Breaches Survey 2025/2026
- FTC, Data Breach Response: A Guide for Business
- Sprintlaw, How long you have to report a data breach in the UK
- Sansec, PolyShell: Magento and Adobe Commerce file upload flaw
- TNW, Mass exploitation of the Gravity SMTP plugin
- Daily Security Review, Kirki plugin exploited
- Google Threat Intelligence, a flaw developed with AI
- watchTowr, Verizon DBIR 2026: exploitation is now the top way breaches start
- NVD, US National Vulnerability Database
- ransomware.live, 2026 statistics
- Check Point Research, September 2026
- TechCrunch, The worst hacks and breaches of 2026 so far
