How secure is WordPress, really?

WordPress itself is secure. It powers a very large share of the web, has a dedicated security team, and patches vulnerabilities quickly. Nearly every hacked WordPress site we are asked to look at was compromised through something bolted on to it: an outdated plugin, a reused password, or hosting nobody had patched in two years.

The platform is not the risk. Neglect is.

That answer is unsatisfying if you are trying to decide whether to build on WordPress, so it is worth understanding why the reputation and the reality have drifted so far apart.

Why WordPress has the reputation it has.

Two things drive it, and neither is really about the software.

The first is scale.

WordPress runs a substantial proportion of all websites, which makes it worth an attacker’s time to automate attacks against it. A vulnerability in an obscure platform affects a few thousand sites. A vulnerability in a popular WordPress plugin affects hundreds of thousands. That produces a lot of incidents, and the incidents get attributed to WordPress.

The second is that WordPress is genuinely easy to start with, which is its great strength and its security problem.

Anyone can install it in ten minutes without knowing anything about maintaining it. Compare that with a platform that requires a developer to launch: fewer sites, but every one has somebody technical attached to it.

Where compromises actually come from.

Security researchers publishing annual vulnerability data consistently find the same ranking, and it matches what we see.

Plugins and themes, by a wide margin.

The overwhelming majority of WordPress vulnerabilities are found in plugins and themes rather than in WordPress core. That makes sense: core is maintained by a dedicated team with a formal security process, while plugins range from professionally maintained products to something a developer built in 2019 and abandoned.

Credentials

Weak passwords, passwords reused from a service that was itself breached, and administrator accounts belonging to people who left the company two years ago. No software vulnerability required.

Hosting

Outdated PHP versions, unpatched server software, and shared hosting where a compromise on somebody else’s site reaches yours. This one is invisible to most site owners because it is not visible from the WordPress dashboard.

WordPress core

Last, and rarely. Core vulnerabilities do occur; they are taken seriously, and they are patched fast. If your site is compromised, core is the least likely culprit.

Are WordPress plugins safe?

Individually, most are. Collectively, they are your largest source of risk, because every plugin is code written by someone else running on your website with access to your database.

The questions worth asking before installing anything: when was it last updated, how many active installations does it have, does the developer respond to support requests, and is it doing something you genuinely need. A plugin last updated three years ago is not stable, it is abandoned.

How many plugins is too many?

There is no magic number, and the number matters less than the quality. Twelve well-maintained plugins from established developers are safer than four abandoned ones.

That said, plugin count is a reasonable proxy for attack surface, and in practice sites carrying thirty or forty plugins usually got there by accumulation rather than decision. If you cannot say what each plugin does and why it is there, you have too many. The most useful audit anyone can run on their own site is a list of installed plugins with a one-line justification for each, and then deleting rather than deactivating whatever fails that test. Deactivated plugins still sit on the server and can still be exploited.

So, is WordPress the right choice?

For most businesses, yes, provided somebody owns the maintenance.

WordPress gives you flexibility and ownership that closed platforms do not, and the trade-off is that responsibility for keeping it secure sits with you rather than with a vendor.

If nobody in your business is going to own that, be honest about it at the point of choosing, because that is the moment the decision is cheap. A hosted platform where the vendor handles patching may genuinely suit you better. We build on WordPress, HubSpot CMS, Webflow and Framer, and part of that conversation is which one matches how you will actually look after the thing once we hand it over.

Common questions

Is WordPress easy to hack?

A well-maintained WordPress site is not easy to hack. A neglected one is very easy, because automated tools scan continuously for known plugin vulnerabilities and simply try them against every site they find. The difficulty is determined almost entirely by whether the site is kept current, not by WordPress itself.

Why do WordPress sites get hacked so often?

Because there are so many of them, and because a large proportion have no one maintaining them. Attacks are automated and indiscriminate, so scale makes WordPress worth targeting, and the ease of setting a site up without technical knowledge means a great many sites are running outdated code that nobody is watching.

Do I need a WordPress security plugin?

A security plugin is useful, and it is not a substitute for maintenance. Firewalls and scanners catch a lot, but they cannot fix an outdated plugin with a known vulnerability, and a site running six overlapping security plugins is usually slower and no safer. Get updates, backups and access control right first, then add tooling.

Is a hosted platform safer than WordPress?

Usually, in the narrow sense that the vendor handles patching so neglect is less likely. The trade-off is less control, less flexibility and a dependency on somebody else’s roadmap. Neither answer is right for everyone, and the honest deciding factor is whether your business will realistically maintain a self-hosted site.

Security handled during the build, not patched on afterwards.

We build WordPress sites for businesses across the UK from our base in Manchester, with security addressed at code level and maintenance handled properly. Senior developers only, no juniors and no outsourcing. If you are choosing a platform, or you have inherited a site nobody understands, we should talk.