Is WordPress Secure? What the Data Actually Shows

“Is WordPress secure?” is one of the first questions any business owner asks before committing to the platform, and it’s a fair one. WordPress powers a huge share of the web, which makes it a constant target. But the honest answer isn’t a simple yes or no. It’s a question of where the risk actually lives, and the data points somewhere most people don’t expect.

The Numbers Behind the Question

According to Patchstack’s 2026 State of WordPress Security report, researchers tracked 11,334 new vulnerabilities disclosed across the WordPress ecosystem in 2025. Of those, only six were found in WordPress core itself. That means core, the software that runs the platform for tens of millions of sites, accounted for a fraction of a percent of all reported issues.

The remaining 91% came from plugins. The other portion came from themes. In other words, the software Automattic and the WordPress core team maintain is remarkably stable. The risk sits almost entirely in the layer that individual site owners add on top.

Where Vulnerabilities Actually Come From

This distinction matters because it changes what “securing your WordPress site” actually means in practice. It isn’t about avoiding WordPress. It’s about managing what gets installed on it.

Every plugin is a piece of third-party code running with access to your site. WordPress plugins can significantly extend what a website can do, but every additional plugin also introduces another component that needs to be maintained and kept secure. Some are maintained rigorously, with fast security patches and active development. Others are abandoned, updated once a year if at all, or built by small teams without a dedicated security process. A site running twenty plugins is running twenty separate trust relationships, and the security of the whole site depends on the weakest one.

This is also why a security conversation about WordPress can’t stop at “how many plugins do you have.” It has to include which plugins, how often they’re updated, and whether anything installed is still receiving support at all. An abandoned plugin with a known vulnerability is a far bigger risk than ten actively maintained ones.

The Real Attack Vector Isn’t What You Think

Vulnerabilities in code are only part of the picture. According to data from Sucuri and Wordfence, two of the most widely used WordPress security firms, 81% of hacked WordPress sites were compromised through weak or stolen credentials, not through a software exploit at all.

That means the most common way into a WordPress site isn’t a clever technical attack. It’s a login page with a weak password, no two-factor authentication, and no limit on failed login attempts. Attackers don’t need to find a zero-day vulnerability when they can simply guess or buy their way in.

This reframes the whole security question. A site can run the most current version of WordPress, with every plugin fully updated, and still be compromised because of how its admin account is protected.

What This Means for Your Site

Put together, these numbers tell a clear story. WordPress core is not the risk. An unmanaged plugin ecosystem and weak access controls are.

That’s a genuinely useful distinction for a business owner to have, because it turns an abstract fear (“is this platform safe?”) into a concrete, manageable checklist. Security on WordPress isn’t a property of the platform. It’s a property of how the site is maintained.

A Practical Security Checklist

• Audit plugins regularly. Remove anything inactive. For everything active, confirm it has been updated within the last several months.
• Enforce strong passwords and two-factor authentication for every account with admin or editor access.
• Limit login attempts to block brute-force attacks before they succeed.
• Keep core, themes, and plugins updated on a defined schedule, not only when something breaks.
• Use a reputable security plugin or service that monitors for known vulnerabilities in your specific installed plugins, not just generic scanning.
• Maintain regular backups stored separately from the live site, so a compromise is recoverable rather than catastrophic.

None of this requires exotic tooling. It requires discipline, and in most cases, a team that treats maintenance as an ongoing responsibility rather than a one-time setup task.

WordPress itself isn’t the vulnerability. What gets installed on it, and how carefully it’s maintained afterward, decides whether a site stays secure or becomes a statistic.