The Truth About WordPress Security
Here's the uncomfortable truth: WordPress is the most hacked CMS in the world.
But that doesn't mean WordPress is fundamentally insecure. Let me explain the distinction, because it matters for how you think about your own site.
Why WordPress Gets Hacked
1. It's a Numbers Game
WordPress powers 43.5% of all websites per W3Techs. If you're a hacker building an automated attack tool, you target the platform with the most potential victims. Efficiency math — one exploit, millions of targets.
It's not that WordPress is weak. It's that WordPress is popular.
2. Outdated Plugins Are the #1 Problem
Most WordPress hacks don't exploit WordPress itself. They exploit outdated plugins.
Patchstack's 2026 State of WordPress Security Report documented 11,334 new vulnerabilities in 2025 — a 42% year-over-year increase — with 91% of those vulnerabilities originating from plugins, not WordPress core. The median exploitation window after public disclosure is 5 hours.
Plugin developers find vulnerabilities and release updates. Site owners don't update. Attackers exploit the known vulnerabilities within hours.
The fix: Update plugins weekly. Delete plugins you don't use. Replace plugins that haven't been updated in 6+ months.
3. Weak Passwords
You'd be surprised how many WordPress sites still get hacked through:
- Password: "admin123" or variations
- Username: "admin" (the default)
- No brute force protection
The fix: Use strong passwords (16+ characters, mixed types), change default usernames, add two-factor authentication on every account.
4. Bad Hosting
Cheap shared hosting packs hundreds of sites on one server. If one site gets compromised, the infection can spread laterally through misconfigurations or shared resources.
The fix: Use quality managed WordPress hosting with proper isolation — Kinsta, WP Engine, or Flywheel all provide this.
How Secure Is WordPress Core?
WordPress core is actually well-maintained and reasonably secure. The WordPress security team monitors vulnerabilities and releases patches quickly — usually within hours or days of disclosure.
When you hear about "WordPress vulnerabilities," it's almost always:
- A plugin vulnerability (91% of all WordPress vulnerabilities per Patchstack)
- A theme vulnerability
- User error (weak passwords, skipped updates, nulled plugins)
Keeping WordPress core updated is essential. But most hacks happen because of the ecosystem around it, not WordPress itself. The security challenge is scale — you have to keep core, plus your theme, plus every plugin, plus PHP, plus your hosting stack updated consistently.
WordPress Security Best Practices
1. Keep Everything Updated
- WordPress core: Update within days of release
- Plugins: Update weekly at minimum
- Themes: Update when available
- PHP: Use version 8.1 or higher
2. Use Strong Authentication
- Unique username (never "admin")
- Strong password (16+ characters, mixed types)
- Two-factor authentication (Google Authenticator, Authy, or a passkey)
- Limit login attempts (Limit Login Attempts plugin or via security plugin)
3. Choose Plugins Carefully
Before installing any plugin, check:
- Last updated (within 6 months is the minimum acceptable)
- Active installations (10,000+ is a reasonable floor for trust)
- Reviews and ratings over time
- Developer reputation — are they a known entity or an anonymous one-off?
Delete plugins you're not using. Deactivation is not enough — deactivated plugin files still sit on the server and can still be exploited. Every plugin is an attack surface.
4. Use a Security Plugin
Install one of these (only one — stacking causes conflicts):
- Wordfence: Firewall plus malware scanner
- Sucuri: Cloud-based firewall
- iThemes Security: WordPress hardening features
5. Backup Regularly
Backups won't prevent hacks, but they let you recover quickly when one happens.
- Daily backups for active or e-commerce sites
- Store backups off-server (cloud storage like Amazon S3, Google Cloud, or Dropbox)
- Test restores periodically — an untested backup is not a backup
Recommended plugins: UpdraftPlus, BlogVault, or your managed host's built-in backup system.
6. Use HTTPS Everywhere
- Most hosts include free SSL via Let's Encrypt
- Force HTTPS in WordPress settings
- Update all internal links to HTTPS
- Enable HSTS headers
7. Harden WordPress Configuration
Small changes that compound:
- Disable file editing via wp-config.php
- Change database prefix from the default "wp_"
- Hide WordPress version number
- Disable XML-RPC if you're not using it
- Add an extra password on wp-admin at the server level
Signs Your Site May Be Hacked
Watch for:
- Unexpected admin users in WordPress or your hosting account
- Strange redirects to other domains
- Spam content appearing in posts or pages you didn't create
- Google Search Console warnings about malware
- Hosting suspension notices
- Site loading malicious ads, popups, or cryptocurrency miners
- Unexplained traffic spikes from specific geographies
- Emails from your domain you didn't send
If you suspect a compromise, act immediately. Change passwords, scan for malware, take the site offline, and consider professional cleanup.
WordPress vs Next.js: Security Comparison
WordPress:
- Attack surface: Large (plugins, themes, PHP, database, admin login, XML-RPC)
- Maintenance: Ongoing, requires vigilance
- Risk: Higher without consistent maintenance
Next.js on Vercel:
- Attack surface: Minimal (static files, optional serverless functions)
- Maintenance: Minimal — updates optional, framework handles security
- Risk: Lower by architecture
Next.js sites have fewer moving parts. No database to attack. No plugins to exploit. No PHP vulnerabilities. No admin login to brute force. The architecture itself reduces the attack surface to near zero.
This doesn't mean Next.js is unhackable — but the structural security baseline is fundamentally different.
The Bottom Line
WordPress can be secure — if you maintain it consistently and correctly.
That means:
- Weekly plugin and core updates
- Strong passwords with 2FA
- Limited plugin footprint
- Quality managed hosting
- Regular off-site backups
- Active security monitoring
If security is a top priority, you don't want ongoing maintenance anxiety, and your business can't afford the downtime of a compromise — consider Next.js instead. The architecture is inherently more secure, and the total cost of ownership over three years often ends up lower.
Need a security audit for your WordPress site, or want to evaluate migration options? Book a strategy call.