In the early 2000s the SANS Internet Storm Center tracked a grim little metric called survival time: how long a fresh, unpatched Windows machine lasted on the open internet before something claimed it. By the summer of 2004 the answer was about twenty minutes — less time than it took to download the patches that would have saved it. You could not fix the machine faster than the internet could break it.
Twenty years later nobody puts a bare Windows box on the public internet, so the metric faded. But the concept didn't die. It just moved up the stack. Ask the question about WordPress — which runs somewhere around forty percent of the web, and is therefore the single most-probed piece of software on it — and survival time turns out to be alive, well, and shorter than you think.
01 You will be found in minutes
Most people's mental model of discovery is a decade out of date. The comforting story is that your new site is a needle in a haystack — some scanner might stumble across it eventually, but you have time. You don't. The moment your site gets its TLS certificate, the hostname is published to certificate transparency logs — public, append-only, and watched by fleets of bots that treat them as a feed of fresh targets. A brand-new subdomain that no human has ever visited will take its first wp-login.php probe within minutes of the cert being issued. I've watched it happen on hosts whose names were never published anywhere else.
And the thing probing you is not a person. It's an industry. Discovery, exploitation, and monetization are separate businesses now: scanners find the doors, access brokers sell them, and buyers install what pays — SEO spam, phishing kits, malware staging, a botnet node. Nobody is targeting you. That's the part people get backwards when they say "why would anyone hack my little site?" Nobody would. Everybody will.
02 The two numbers
Survival time for a website is really two numbers, and the second one is what kills you. Time to compromise is measured in minutes or days, depending on what you left open. Time to detection is measured in months — because the modern compromise is quiet. Defacement is for amateurs. A professional wants your site working flawlessly, ranking normally, serving your customers — while it also serves search-engine poison from URLs you'll never browse to, or holds a webshell for a rainy day. The site keeps doing its job. That's the camouflage. Nobody audits a thing that works.
The worst window is one almost nobody thinks about: the installer. A WordPress that has been deployed but not yet set up will hand the keys to whoever reaches the install wizard first — and "whoever" includes every bot that found the hostname in the cert logs ten minutes ago. An attacker can complete your installation, on your domain, pointed at a database they control, and the resulting site looks exactly like someone finished setting it up. I've seen the aftermath of this up close, and the discovery came a very long time after the takeover. The most dangerous state a system can be in is half-deployed — real enough to be reachable, unfinished enough to be ownable, and on nobody's list to check.
Nothing on the internet is finished. A site is either attended or abandoned, and abandoned sites belong to whoever wants them.
Compromises rarely come from where the folklore points. WordPress core, patched, is a hard target — the security team is good and the update mechanism works. The doors are almost always elsewhere: the plugin you installed in 2021 and forgot, the theme bundling a vulnerable library, the admin password reused from a breached service, the core update that shipped Tuesday and that you were going to get to. Every plugin is a vendor you now depend on, running code inside your site with your site's privileges. Most people wouldn't hire a contractor without a reference, then install fourteen of them.
03 What survival takes
Here's what I actually do for every WordPress site I run. None of it is exotic. All of it exists because some part of the internet checked whether I'd done it.
- No installer, ever.
Provisioning and setup are one atomic step, scripted, before the hostname serves its first request. If a wizard is reachable, the site is already lost — you just don't know the timeline yet. - Update automatically or don't bother.
The gap between a disclosed WordPress vulnerability and mass exploitation is hours. A human update schedule loses that race every time. Auto-update core; review plugins on a short leash. - Count plugins like open ports.
Each one is third-party code with full privileges and its own patch cadence. If you can't say what a plugin is for, it's for attackers. - Uploads never execute.
The uploads directory is for images, and the web server should refuse to run code from it. This one rule strands half of all webshells at the door. - Close what nobody uses.
xmlrpc.php, author enumeration, the user listing in the REST API — brute-force reconnaissance runs on these. If no workflow needs them, they return 403. - Rate-limit the front door.
wp-login.php gets a tight per-IP budget. Credential stuffing is a volume business; make the volume uneconomic. - Admins are doors — issue few.
One administrator, humans get the least role that does their job, and every account in the admin list is one you can name. An admin you don't recognize is the loudest alarm WordPress will ever give you. - Watch the files and the admin table.
A nightly integrity check against a known baseline — core checksums, new admins, new code in uploads or mu-plugins — that emails a human. Prevention fails; detection is what turns months of dwell time into a day. - Backups you have restored.
An untested backup is a hope, not a control. You learn whether backups work at restore time — choose to learn it on a calm afternoon. - Ask if it needs to be WordPress at all.
A brochure site that changes four times a year doesn't need a database, an admin panel, and a plugin ecosystem — static HTML has no login to brute-force. The most secure moving part is the one that isn't there.
04 Operations, not software
Notice what's missing from that list: anything clever. No appliances, no machine-learning firewall, nothing with a booth at a conference. Survival time isn't a property of the software — WordPress patched, pruned, and watched will outlive most hand-rolled alternatives. It's a property of operations: whether the site has an owner, whether the owner has a routine, and whether anything tells them when reality drifts from the baseline.
I wrote last time that the annoying web is a choice. The compromised web is mostly a choice too — the choice to treat a live site as finished, to launch and walk away. The internet ran that experiment for us in 2004 and posted the number: twenty minutes. It has not gotten longer.