Is WordPress secure? What actually gets WordPress sites hacked

A client we have worked with for years said it on a call this week: they were tired of WordPress and its security holes. We hear some version of that sentence every few months, usually with “slow” and “old” attached, and lately with a new ending: “I can just ask ChatGPT or Claude to build me a website.”

The frustration is real. The diagnosis is usually wrong, and a wrong diagnosis leads to an expensive move that carries the same problem to a new platform.

In short

WordPress itself is rarely what gets a site hacked. Of the 11,334 new vulnerabilities Patchstack recorded in the WordPress ecosystem in 2025, 91% were in plugins, 9% were in themes and six were in WordPress core. A site built with a handful of plugins and kept updated is a secure site. A bought theme carrying 20 to 30 plugins that nobody updates is not, and that would be true on any platform.

Where the holes actually are

Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities across the WordPress ecosystem in 2025. Plugins accounted for 91% of them and themes for 9%. WordPress core, which is what people mean when they say “WordPress”, had six.

Two more figures from the same source explain most of the hacked sites we are asked to clean up. 46% of those vulnerabilities had no fix available on the day they were made public. And in 2024, 1,614 plugins and themes were removed from the WordPress.org directory because of security issues nobody patched. A removed plugin does not disappear from the sites that run it. It stays installed, it keeps working, and it never receives another update.

Core is not spotless. In July 2026 it had one of its most serious flaws in years, wp2shell, which let an anonymous visitor run code on a default install. The patched releases went out on the day of the disclosure, and WordPress.org forced the update onto affected sites. A site with updates switched on was fixed within hours. That is how a serious hole looks in software somebody maintains.

The site that actually gets hacked

The story is nearly always the same one. The site starts from a purchased theme. The theme brings a page builder, a slider and a dozen companion plugins with it, and some of those only update under the theme author’s licence. Every new request gets another plugin, including requests that one line of code would have covered. Three years later the plugin screen lists 20 to 30 entries: a few are no longer used, a few were abandoned by their authors, a few have been pulled from the WordPress directory, and the rest are waiting for updates.

Often the owner never knew. They were sold a website build, and nobody said plainly that it was a purchased template with their logo and colours applied.

This is not a rare setup. When we counted plugins on 83,874 Baltic WordPress sites, Elementor was on a quarter to a third of them and Slider Revolution on at least 9,726. Three paid plugins alone (WPML, Slider Revolution and WP Rocket) came to 24,659 detections, and each of those updates only against a licence. If the licence sits with a developer who built the site five years ago and has since moved on, the plugin keeps running without its update channel, and nothing on the site tells you.

“If you add a plugin for everything, including things one line of code would do, never remove the ones you stopped using and don’t update the rest, then yes, the site will have security holes, and a bought-template site will have them sooner. That is not WordPress being insecure. We have sites that have not been updated in years, still load fast and have never had a hacked file, and when the client finally asked for the update, it went through without trouble. What never wins is a cheaply built template site that nobody maintains, followed by blaming WordPress.”

Rinalds Ažiņš, founder of Green Wire Media

What we see on sites built the other way

We write the theme ourselves, and most of the functions with it: the contact form, the cookie notice, the custom content types. Those are the things that usually arrive as plugins. We have launched sites with two to four plugins. Fewer plugins means fewer outside authors whose update schedule your site depends on.

Sites like that are uneventful to own. Several clients chose not to take a maintenance plan, and their sites have kept working for years: no hacked files, the same loading speed, and nothing broken when the update was finally requested. We do not recommend skipping maintenance. It does show where the risk comes from.

Two limits apply.

A custom site with many plugins still needs maintenance. A shop, several languages, a booking system: each of those plugins has to be updated, however well the theme is written.

Time catches up with good code too. This year we assessed a large site built many years ago by another agency. The code is good, and for its time very good. Updates had been switched off on purpose, and the site ran for years without a single incident: the admin area only opens from a list of allowed addresses, and the automated attacks in its logs all end nowhere. Bringing it up to date, however, is no longer a button. It is a project. The multilingual plugin that every translation rests on was abandoned by its author, so nobody will ship another fix for it, and that work now falls to whoever takes the site on.

Skipping maintenance on a well-built site is cheap for a long time and then expensive all at once.

The first price is not the price

Most platform decisions are made on the build quote alone. Our cost calculator adds what comes after it: hosting, plugin licences, maintenance, and the way running costs climb once a site ages. For a small business site the market averages look like this, with a maintenance plan included and without one:

	Build	10 years, maintenance included	10 years, no maintenance
WordPress + bought theme	1,800 EUR	17,500 EUR	14,000 EUR
WordPress + page builder	2,200 EUR	21,300 EUR	19,900 EUR
Custom WordPress	5,000 EUR	16,500 EUR	9,900 EUR

The custom build costs 3,200 EUR more on launch day and is the cheapest of the three over ten years in both columns. The two maintained totals sit close together only because the maintenance plan itself costs the same on either site, about 6,600 EUR of each figure. Everything around the plan is cheaper on the custom build: fewer paid plugins, and running costs that hardly grow. Without a plan the gap opens to about 4,100 EUR, because on a bought-theme site the postponed updates come back as repair work. The extra build cost is earned back in year eight or nine.

These are estimates of typical market cost in October 2026, not our price list. Put your own numbers into the calculator and see where the lines cross for your project.

”I’ll have AI build it instead”

You can. A model will produce a working, good-looking site, and some of the code it writes is better than a lot of hand-written code.

It does not make the original problem go away. When we opened the code of generated sites, we found pages with no meta description, a single heading in the whole document and megabytes of images pasted into one file. App builders fail in a more serious place: CVE-2025-48757 describes Lovable-generated projects whose database tables could be read and written by anyone, without logging in.

So yes, you can build a site with AI alone. Unless someone who knows what to check reads the result, it can be less secure than the WordPress site it replaced and rank worse in search. And a generated site ages as well. Its libraries and its hosting need the same attention a plugin list does, and somebody still has to give it.

No platform wins every project

WordPress is still a good choice for most business sites. It is not the right one for all of them, and each project deserves the decision rather than a default. A shop with standard needs may be better served by Shopify, and we compared the two in Shopify vs WooCommerce. An application with user accounts and its own logic belongs on a framework such as Laravel. For a five-page site that the owner wants to edit alone, a site builder like Mozello is a reasonable answer.

Every one of those has its own strengths and its own costs. The option that never wins is the cheaply built template site that nobody maintains.

Four checks on your own site

1. Count the plugins. Open Plugins in the WordPress dashboard. Then ask of each one whether the site still uses it.
2. Count the pending updates. A long list is the usual sign that nobody is looking after the site.
3. Look up each free plugin on WordPress.org. Read the “last updated” line. A date years in the past, or a notice that the plugin is closed, means nobody maintains it.
4. Ask who built the site two questions. Is the theme purchased or written for you, and in whose name are the paid licences?

If the answers worry you, the fix is rarely a new platform. Usually it is fewer plugins, current versions and somebody whose job it is to keep them that way. That is what a care plan covers. If the site is already too far behind for an ordinary update, start with a rescue review, and if it is time to build it properly, this is how we approach WordPress development.