WordPress core is maintained by a large team and patched fast. Almost every real-world WordPress hack traces back to something else entirely – usually a plugin.
Key takeaways
- The large majority of documented WordPress vulnerabilities live in plugins and themes, not WordPress core, which is patched quickly by a dedicated security team.
- Automated bots scan the entire web around the clock for known, unpatched plugin exploits – they target the vulnerability, not your business specifically.
- One abandoned or outdated plugin is often all it takes, no matter how careful you are with everything else on the site.
WordPress core has a dedicated security team, a public disclosure process, and a track record of patching confirmed vulnerabilities within days. If you read a headline about “a WordPress site hacked,” the instinct is to blame the platform – but in the overwhelming majority of real incidents, WordPress itself was never the weak point.
The plugin ecosystem is the real attack surface
WordPress's biggest strength – an ecosystem of tens of thousands of plugins covering almost any feature you can imagine – is also where nearly every documented vulnerability actually lives. Plugin quality varies enormously: some are maintained by full-time security-conscious teams, and a large share are maintained by one person, part-time, or not maintained at all anymore. A plugin that was safe when you installed it in 2023 can be sitting on a disclosed, unpatched vulnerability today, and nothing in your WordPress admin will flag that for you.
Automated attacks don't care how big your site is
Nobody is manually targeting a small business site. Attackers run automated scanners that fingerprint which CMS a site runs, which plugins are active and at what version, then check that list against a database of known exploits. Running on the same platform as a large share of the web means your site is on that scan list by default, whether you have ten visitors a month or ten thousand. The attack isn't personal – it's a numbers game, and WordPress's popularity is exactly what makes the numbers worth playing.
Outdated is worse than people assume
An unpatched plugin doesn't just sit there quietly – once a vulnerability is publicly disclosed (often so legitimate users know to update), it becomes a known, documented entry point that every scanner is now checking for. The gap between “a fix exists” and “every site has applied it” is exactly the window most compromises happen in. A site with one abandoned plugin can undo every other precaution you've taken.
What “secure WordPress” actually requires
Keeping a WordPress site genuinely secure is an ongoing job, not a one-time setup: core, theme and every plugin updated promptly; a security plugin or WAF watching for known attack patterns; regular malware scans; off-site backups you've actually tested restoring from; and a plan for when something does get through. That's a real, recurring workload – either yours, or a maintenance retainer's.
None of this makes WordPress a bad choice for every business. It means the businesses that would rather not carry that ongoing job have an alternative worth knowing about. See how a WordPress-to-Astro migration removes most of this attack surface entirely, or tell us about your site and we'll walk you through what that would actually involve.