Yes, WordPress is secure enough for a business website, as long as someone looks after it. The WordPress core software is well maintained and rarely the problem. The real risks are out-of-date plugins and themes, weak logins and sites nobody has touched in months.
Key takeaways
- Of 11,334 new WordPress vulnerabilities found in 2025, 91% were in plugins and only 6 were in WordPress core.
- WordPress is a big target because it’s popular, not because the core is weak.
- Most hacks we see come from neglect: old plugins, reused passwords and no backups.
- Fewer plugins, prompt updates, strong logins, good hosting and off-site backups remove most of the risk.
Why do people say WordPress isn’t secure?
Mostly because it’s everywhere. WordPress runs 39.2% of all websites (W3Techs), so attackers write automated tools aimed squarely at it. One flaw in a popular plugin can expose thousands of sites at once.
The numbers sound alarming out of context. Wordfence says it blocked more than 55 billion password attacks on WordPress sites in 2024, and found just under a million infected sites over the year (Wordfence). Those figures show how much attention WordPress gets. They don’t show that the software itself is unsafe.
A useful comparison is a car. A popular model gets stolen more often, but whether yours goes missing depends mostly on whether you lock it.
Where do WordPress vulnerabilities actually come from?
Patchstack, a security company that tracks WordPress flaws, recorded 11,334 new vulnerabilities in 2025. Of those, 91% were in plugins and 9% in themes. WordPress core had just six, and Patchstack rated them low priority (Patchstack).
Two other findings matter for owners. Nearly half (46%) of those flaws had no fix available when they were made public. And the most heavily attacked flaws were being exploited within a median of five hours. A site that waits a month for its next update gives attackers a long head start.
How does WordPress core stay secure?
WordPress has a dedicated security team of more than 50 experts, including lead developers and security researchers (WordPress.org). The team also backports fixes to older versions so those sites still receive critical patches.
Since version 3.7, WordPress has updated itself in the background. Minor releases, which carry most security fixes, install automatically on most sites by default (WordPress Developer Resources). For serious plugin flaws, WordPress.org can also push an update out automatically in special cases.
So the core looks after itself fairly well. Plugins and themes are written by thousands of different developers, with very different standards, and that’s where things go wrong.
What actually gets WordPress sites hacked?
In our experience, the cause is almost always one of these:
- Out-of-date software. Sucuri found that 39.1% of content management systems were out of date when they were infected (Sucuri).
- Abandoned or unnecessary plugins. Every plugin is more code that can break or be attacked. A plugin installed for a one-off job three years ago is still running today.
- Pirated themes and plugins. “Free” copies of paid products often come with malware built in. Our guide to nulled plugins explains why.
- Weak or reused passwords. Bots try leaked passwords against login pages all day, every day.
- Shared logins and old accounts. A former staff member or contractor with admin access is an open door.
None of these is a flaw in WordPress. They’re all gaps in how a site is looked after. When a plugin flaw makes the news, our guide to plugin vulnerability alerts covers what to do that day.
Is WordPress less safe than Wix or Squarespace?
Not inherently, but the responsibility sits in a different place. With a hosted builder like Wix or Squarespace, the company runs the software and the updates for you. You get less freedom: fewer add-ons, less control over the code and no choice of host.
WordPress gives you that freedom, and with it the job of keeping things current. A well-run WordPress site is as safe as any other platform. A neglected one isn’t. The question to ask is “who keeps this updated?” rather than “which platform is safest?”
How do you make a WordPress site safe for business?
- Keep plugins lean. Remove anything you don’t use, and avoid plugins that haven’t been updated in a year. Fewer plugins means fewer doors.
- Update promptly. Apply security updates within days, not months. Take a backup first and check key pages afterwards.
- Lock down logins. Give every person their own account, use strong unique passwords and turn on two-factor login for administrators.
- Choose hosting built for WordPress. Good WordPress hosting in Australia adds a server firewall, malware scanning, current PHP versions and isolation between accounts.
- Keep off-site backups. Store copies away from the server, keep them for weeks and test that a restore actually works.
- Watch for trouble. Malware scans, uptime checks and blacklist monitoring tell you about a problem before your customers do.
Our WordPress maintenance checklist breaks these into weekly, monthly and yearly tasks if you want to do it yourself.
Who should look after your WordPress site?
Most business owners would rather run their business than check plugin changelogs. That’s fine, but someone has to own the job. Your host usually looks after the server only, not the plugins inside your site.
If you’re weighing up options, our comparison of WordPress maintenance plans sets out monthly, ad-hoc and retainer approaches. It also helps to know what good maintenance should include before you sign up with anyone.
Our own WordPress maintenance services run under Maintain & Protect. Malware scans run daily, high-risk security updates go on weekly and everything else monthly, with off-site backups kept for 30 days. If a site on one of our website maintenance plans gets hacked, we fix it free.
Frequently asked questions
Is WordPress secure enough for an online shop?
Yes. Many Australian businesses run WooCommerce stores on WordPress safely. Shops need more care, though: prompt updates, strong logins, a firewall and checks that the checkout still works after each update. Card details should be handled by your payment provider, not stored on your site.
Does a security plugin make WordPress secure?
It helps, but it’s not enough on its own. A security plugin can’t fix an outdated plugin, a reused password or a missing backup. Protection works best in layers, with some at the server level and some inside WordPress, plus regular updates and monitoring.
How often should WordPress be updated?
Check for updates at least weekly, and apply security fixes as soon as you can safely test them. Heavily targeted flaws can be exploited within hours of being made public, so waiting for a quarterly tidy-up leaves your site exposed for weeks.
Are premium plugins safer than free ones?
Not automatically. Patchstack found that premium and freemium components made up 29% of vulnerability reports in 2025, and more of them were rated high severity. What matters is whether the developer fixes problems quickly and whether you install the fixes.
How can I tell if my WordPress site is already hacked?
Common signs include spam pages in Google results, visitors being redirected elsewhere, admin users you don’t recognise and browser warnings. Some hacks show no signs at all, which is why regular malware scans matter. A free security audit is a quick way to check.
Sources
- Usage statistics of WordPress, W3Techs, November 2026
- 2024 Annual WordPress Security Report, Wordfence, April 2025
- State of WordPress Security in 2026, Patchstack
- Security, WordPress.org, updated November 2026
- Upgrading WordPress, WordPress Developer Resources
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024