What Is a Supply Chain Attack? How It Works and How to Protect Your Site

A supply chain attack is when attackers don’t break into your website directly, but into something your website trusts. That could be a plugin developer’s account, the server that delivers updates, or a script your site loads from somewhere else. The malicious code then reaches you through a channel you already rely on, often as a normal looking update from the official source.

That makes these attacks hard to spot. You did everything right: you used a well known plugin, installed updates promptly and downloaded from the vendor’s own site. The problem was further up the chain, where you had no control at all.

How a Supply Chain Attack Works

Every website depends on a chain of other people’s work. Your WordPress site runs plugins and themes made by developers. Those developers use code repositories, build systems, update servers and content delivery networks. Your host runs software from other vendors too. Each link in that chain is a place where an attacker can slip something in.

Attacking one link is often more efficient than attacking thousands of websites one by one. Compromise a popular plugin’s update server, and every site that updates in that window receives the attacker’s code and installs it.

Most supply chain attacks follow the same pattern:

1. The attacker gets into a trusted source, such as a developer’s account, a build server or a set of stolen keys
2. They add malicious code to something that gets delivered automatically, such as an update, a download or a script
3. Websites receive it through the normal route, with nothing to warn them
4. The code does its job, usually creating hidden admin accounts, stealing passwords and keys, or installing a backdoor that survives cleanup

The Weak Links: Five Common Types

Supply chain attacks come in different shapes depending on which link the attacker targets. These are the ones that matter most for website owners, with real examples:

The vendor’s own systems

In October 2026, some copies of Rank Math PRO 3.0.123 downloaded from Rank Math’s own site carried malware for about 11 hours. Sites that installed and activated it got a backdoor that could rebuild itself when someone visited a page. Our article on the Rank Math PRO malware covers how to check and clean a site.

A change of ownership

Plugins change hands all the time, often quietly. In 2026, someone bought more than 30 WordPress plugins through a marketplace, then hid a backdoor in an update that stayed dormant for months. The full story is in our post on how 30 WordPress plugins were bought and backdoored.

The build process and external scripts

Sometimes the plugin code on the developer’s computer is fine, but the update gets changed while it’s being packaged, so automatic updates deliver the malware. In other cases, a script the plugin loads from another server gets replaced, and your site is affected without installing any update at all. We cover several of these cases in Your Trusted WordPress Plugins Are Now a Target.

Stolen keys

In October 2026, attackers used stolen UpdraftCentral keys from the company behind UpdraftPlus to install backdoor plugins on WordPress sites. The commands were signed with real keys, so the sites accepted them as real instructions from the vendor.

It’s Not Only a WordPress Problem

Some of the best known supply chain attacks hit software far beyond websites:

• SolarWinds, 2020: attackers added a backdoor to updates for SolarWinds’ Orion network monitoring software. Thousands of organisations installed it, including government agencies, before it was discovered in December 2020
• xz utils, 2024: a contributor spent about two years gaining the trust of an open source project, then hid a backdoor in a compression library used by many Linux systems. A Microsoft engineer found it by chance because SSH logins had become slightly slower, before it reached most stable Linux releases
• OVHcloud command line tool, October 2026: attackers used a developer’s GitHub account to replace releases of OVHcloud’s command line tool with versions that tried to steal secrets from users’ computers. They were caught within about 94 minutes

The pattern is the same every time: the attacker goes after the source, and the victims receive the code through a channel they trust.

Supply Chain Attack or Vulnerability?

The two are easy to confuse, but they’re different problems.

A vulnerability is a mistake in the software itself, a flaw that attackers can exploit. The PHP2Shell flaws in PHP are an example. The fix is an update.

A supply chain attack means the software was deliberately tampered with. Here, the update can be the problem rather than the fix. That’s why updating alone often doesn’t clean a site after a supply chain attack: the malicious code has usually left backdoors, accounts and scheduled tasks behind.

Why Supply Chain Attacks Are So Hard to Stop

Most website security relies on trust. Security plugins trust updates from the official vendor. Firewalls let through traffic that looks normal. Automatic updates install whatever the vendor releases. A supply chain attack turns that trust against you.

Premium plugins add another gap. WordPress.org publishes checksums for free plugins, so security tools can check whether the files match the original. Paid plugins are updated directly from the vendor’s own servers, without that check. During the Rank Math incident, security company Patchstack said it couldn’t offer a firewall rule against it, because the attack happened on the vendor’s own systems.

How to Protect Your Website

You can’t stop a vendor from being hacked. You can make sure an attack does less damage and is easier to recover from:

• Keep daily backups for at least 14 days, stored away from your hosting account. Supply chain attacks often surface days after the fact, so short backup windows can leave you without a clean copy. Our guide to backing up a WordPress site explains how
• Wait 24 to 48 hours before installing premium plugin updates, unless the update fixes a known security flaw. Most supply chain incidents are discovered quickly
• Use a staging site to test updates before they reach your live site, if your host offers one
• Remove plugins you don’t use, and replace abandoned ones. Every plugin is another link in your chain
• Turn on two factor login for every admin account, and check your user list regularly for accounts you don’t recognise
• Disconnect remote management tools you don’t use. The UpdraftCentral attack only worked on sites that had a connection key, often without the owner knowing

A web application firewall still helps against many other attacks, but don’t rely on it to catch malicious code that arrives through an official update.

Common Questions About Supply Chain Attacks

What is a supply chain attack in simple terms?

It’s an attack on something your website trusts rather than on your website itself, such as a plugin developer, an update server or an external script. The malicious code reaches you through a channel you already rely on.

Are free WordPress plugins safer than premium ones?

Not automatically. WordPress.org publishes checksums for free plugins, which makes tampered files easier to detect, but free plugins have been backdoored too, for example after a change of owner. What matters more is how well the developer protects its systems.

Will a security plugin detect a supply chain attack?

Sometimes, but often too late. Security plugins usually trust official updates, and scanners need to know what to look for. Once an attack is public, scanners add signatures quickly, so running a scan after news of an incident is worth doing.

Should I turn off automatic updates?

Not for WordPress core or free plugins with security fixes. For premium plugins, a short delay of a day or two is a reasonable balance between catching security fixes and avoiding a poisoned update.

What should I do if a plugin I use was hit?

Follow the vendor’s instructions, but assume updating alone isn’t enough. Restore a backup from before the incident if you can, change all passwords and keys, and check for unknown admin accounts and files.