GoDaddy has disclosed to the US Securities and Exchange Commission that intruders were inside its network for roughly ten weeks before being discovered in November 2021. The filing affects roughly 1.2 million managed WordPress clients—not GoDaddy's broader customer base.
The exposure spans contact data, credentials, and, for some users, cryptographic keys. Beyond email addresses and customer numbers, the company confirmed that sFTP credentials, WordPress admin passwords, and SSL/TLS private keys were all within reach.
What was actually exposed
Three buckets matter, with different risk weights.
Contact data**—emails and customer numbers—is enough for targeted phishing but is the least damaging element alone.
SFTP credentials** carry higher risk. Researchers at Wordfence found they could read their own sFTP password back through GoDaddy's official user interface. That suggests these passwords were stored in a reversible format, not a one-way hash. A properly hashed password would be unreadable. If sFTP passwords were truly retrievable, anyone with a copy of that database can authenticate today.
SSL/TLS private keys** affect a subset of users. With a stolen private key, an attacker can run a look-alike server that browsers trust, turning any "is this site legitimate" check into theatre.
Our analysis
The headline number—1.2 million—obscures what actually matters: the ten-week dwell time. Detection lag is typically the biggest driver of breach damage because it gives attackers room to plant footholds, not just harvest credentials.
Two patterns worth flagging. First, managed hosting creates a false boundary. Users often treat "the host's infrastructure" and "my WordPress site" as separate risk domains. They are not. Shared infrastructure means one crack spreads wide. Second, host-issued defaults persist. That GoDaddy's filing included default WordPress admin passwords—set at account creation and apparently never touched—tells you how many sites still run on credentials nobody has changed.
Who wins and loses here:
- Attackers with a copy of exposed sFTP databases get persistent access to active sites, even after password resets, if backdoors were planted in plugins.
- Scammers using stolen SSL keys gain credibility for phishing and investment fraud.
- Affected users face cleanup costs, potential site compromise from dormant backdoors, and a wave of convincing phishing pretending to be GoDaddy's response.
- Smaller managed WordPress vendors have a marketing opening—though any platform large enough to matter is a large enough target.
What to watch:** Certificate reissue timelines. If GoDaddy has not contacted you directly, open a support ticket and request written confirmation of your exposure status. Then watch for phishing pretending to be exactly that email.
Decision checklist
Use this to triage your response:
| Priority | Action |
|---|---|
| Immediate | Reset sFTP passwords from a trusted password manager, not GoDaddy's tools |
| Immediate | Enable two-factor authentication on every WordPress login you control |
| High | Ask GoDaddy, in writing, whether your SSL certificate was reissued |
| High | Audit plugins and themes against a known-clean baseline; remove anything unrecognisable |
| Medium | Check filesystem for recently modified PHP files you did not write |
| Medium | Review site user list for unfamiliar accounts added during the breach window |
| Ongoing | Assume your sFTP password was reused elsewhere; change it everywhere |
Key takeaways
- Change sFTP and WordPress admin passwords from outside GoDaddy's tools, using a password manager.
- Request written confirmation of your SSL key exposure status.
- Audit and remove any WordPress plugins you cannot account for.
- Enable two-factor authentication on every WordPress login.
- Treat breach-response emails as phishing bait—verify sender addresses carefully.
Frequently asked questions
When did the GoDaddy breach happen?
GoDaddy says unauthorised activity began in early September 2021 and was detected in November 2021.
How many customers were affected?
Roughly 1.2 million managed WordPress clients had email addresses and customer numbers exposed.
Were SSL/TLS keys really taken?
GoDaddy said private keys for a subset of active users were exposed. With a stolen private key, an attacker can run a site browsers treat as legitimate.
I already received a password reset from GoDaddy. Am I done?
Not necessarily. Reset your password again from a tool you control. The bigger concern is any backdoors attackers may have planted during the dwell window—those survive password resets.
What is the biggest practical risk after disclosure?
Follow-on phishing pretending to be GoDaddy's breach response, plus dormant backdoors inside WordPress plugins planted during the ten-week window. Both can outlast any official remediation.