“WordPress isn’t secure” is one of the most repeated claims in web development, and it’s also one of the most misleading, because it treats WordPress as a single thing when it’s really two very different things: a well-maintained, actively patched core codebase, and a vast, uneven ecosystem of third-party plugins and themes built by thousands of unrelated developers. The data draws a sharp line between them.
What the numbers actually show
Across the WordPress vulnerability research tracked through 2026, plugins account for roughly 91–95% of disclosed vulnerabilities and breach entry points — WordPress core itself makes up a small single-digit share. Wordfence’s own Q1 2026 Threat Intelligence Report backs this up directly: of 2,738 new vulnerabilities logged in the quarter, the report explicitly identifies plugins, not core, as the primary source. That’s not a marginal difference — it’s the difference between “the software is the problem” and “what gets installed on top of the software is the problem.”
Scale matters here too. WordPress runs 40.7% of every website on the internet, a 59% share of the entire content-management-system market according to W3Techs. No platform at that scale is going to have zero reported vulnerabilities — the more relevant question is whether the platform itself is well-maintained, and WordPress core’s track record of rapid, forced security patching (the wp2shell chain earlier this year shipped three emergency updates inside one month) says yes.
Why the “WordPress is insecure” narrative persists anyway
Most compromised WordPress sites share the same profile: outdated plugins, weak or reused passwords, no monitoring, and admin accounts with no two-factor authentication. When one of those sites gets hacked, the headline is almost always “WordPress site hacked” rather than “unpatched three-year-old plugin exploited” — even though the second description is what actually happened in the vast majority of cases. Roughly 43% of disclosed WordPress plugin vulnerabilities can be exploited without any authentication at all, which means the bar for a poorly maintained plugin to become a real problem is lower than most site owners assume.
What “secure” actually depends on
A properly maintained WordPress installation — current core version, actively updated plugins limited to what’s actually needed, strong unique credentials, two-factor authentication on every admin account, and real monitoring — is a genuinely solid security posture, not a compromise you’re settling for. The platform’s open-source nature means vulnerabilities get found and disclosed constantly, which sounds alarming until you compare it to the alternative: closed-source software where nobody outside the vendor is looking for the same flaws, and disclosure happens on the vendor’s timeline, not the public’s.
The uncomfortable part of this is that “not insecure by design” only helps you if the maintenance side is actually happening. With more than 250 new plugin vulnerabilities disclosed weekly across the ecosystem in 2026, a “set it up once and leave it” WordPress site is genuinely exposed — not because of what WordPress is, but because of what’s been left unpatched on top of it. That’s the distinction this whole debate usually misses.
The bottom line
WordPress is neither the security liability nor the bulletproof platform either side of this argument tends to claim. It’s a well-built, actively defended core wrapped in an ecosystem that requires real, ongoing attention — and the sites that get hacked are overwhelmingly the ones where that attention stopped happening, not the ones running WordPress itself. If your current setup is closer to “installed a few years ago and mostly left alone” than “actively maintained,” that gap — not the platform — is your actual exposure. Our ongoing website maintenance service exists specifically to close it.
FAQ
Is WordPress less secure than a custom-built website? Not inherently. A custom-built site has no public vulnerability database to defend against, but it also doesn’t benefit from thousands of developers and researchers actively finding and disclosing issues in its dependencies. Security in both cases comes down to how well the site is maintained, not which approach was used to build it.
Are WordPress plugins really the main risk, or is that outdated advice? It’s current — Wordfence’s own Q1 2026 data and independent 2026 vulnerability research both point to plugins as the dominant source of WordPress security issues, well ahead of core. Limiting installed plugins to what you actually use, and keeping every one of them updated, addresses the majority of realistic risk.
Does using popular, well-known plugins make me safe? It helps, but it isn’t a guarantee — some of the most disruptive 2026 incidents involved plugins with hundreds of thousands of active installs. Popularity affects how many sites are exposed when something goes wrong, not whether it can go wrong at all.