Is WordPress safe anymore?

Not for a business site running on plugins that nobody keeps updated. WordPress core is actively maintained and rarely the weak point. In Patchstack data for 2025, 91% of new vulnerabilities were in plugins and 9% in themes, with only 6 in core. The risk comes from plugins, themes and updates that are not kept up.

Why do WordPress sites get hacked?

Mostly through vulnerable or abandoned plugins and themes, weak logins and missed updates. WordPress is also the most popular platform, so attackers scan for it at scale.

Is a custom-coded website more secure than WordPress?

Generally it has a smaller attack surface because it has no public plugin ecosystem and far less third-party code. It still needs hosting, dependency and security updates, which is why ongoing management matters.

WordPress is not safe anymore.

Vulnerabilities are climbing and the plugins around WordPress are where attackers get in. A custom-coded site with security updates is the safer way to run a business website.

By Bashir Bandi22 Oct 2026Websites

WordPress is not safe anymore, and the weak point is not the core software. It is everything people bolt onto it. A typical business site runs the core software, a theme and a dozen or more plugins, each written by a different team and each needing updates. That pile is where attackers get in.

For a business that depends on its website for enquiries, there is a simpler and safer approach: a custom-coded site, kept up to date by someone who is responsible for it.

What the security data says

Patchstack, a WordPress security company, publishes an annual report on vulnerabilities in the WordPress ecosystem. Its latest report, covering 2025, found:

11,334 new vulnerabilities in the WordPress ecosystem, a 42% increase on 2024.
91% were in plugins and 9% in themes. Only 6 were in WordPress core, and these were low priority.
46% had no fix from the developer at the time they were publicly disclosed.
For heavily exploited vulnerabilities, the median time to mass exploitation was 5 hours.

Source: Patchstack, State of WordPress Security in 2026. Patchstack sells WordPress security products, so read it as industry research with a point of view. The direction of the numbers matches what other security firms report.

WordPress also runs a very large share of the web, about 40% of all websites according to W3Techs. That makes it the most attractive target. Attackers do not pick your business. They scan for known weaknesses in popular plugins across millions of sites and attack whatever answers.

Why a small business site is exposed

Plugins multiply the risk

Every plugin is extra code that runs on your site, written by someone you have never met. If a plugin is abandoned or sold, or its vendor is compromised, your site inherits the problem. Security researchers have reported attacks where attackers got into a plugin vendor and pushed malicious code through the normal update channel.

The patching treadmill

Safe means updating the core, theme and every plugin promptly, testing that nothing breaks and repeating forever. If the person who built your site has moved on, nobody may be doing it. When exploitation starts within hours, a monthly check is too slow.

Some fixes arrive late or never

Nearly half of the vulnerabilities in the Patchstack data had no developer fix when they were disclosed. Updating does not help when there is no update.

The damage lands on your business

A hacked site can mean spam pages that wreck your search results, a browser warning that scares customers away, redirects to scam sites or a site that is offline during your busiest week. For a trade or a service business, that is lost enquiries.

What custom-coded means

A custom-coded site is built for your business from clean code, without a theme and a stack of plugins. The pages are fast because they carry only what they need. Forms, galleries and tracking are written into the site rather than rented from third-party add-ons.

The result has a much smaller attack surface. There is no public plugin ecosystem to scan for, no login page that every bot on the internet knows the address of and far less third-party code to go wrong.

Custom code still needs security updates

No site is immune, and we do not claim that custom code cannot be attacked. Hosting software, the libraries a site depends on and the forms that accept input all need attention. The difference is that the work is smaller, predictable and done by the people who built the site.

That is why we recommend a custom-coded site with ongoing security updates, not a one-off build you never touch again. Our website management service covers:

Updates to hosting and dependencies
Monitoring for downtime and problems
Backups and a tested way to restore
Fixes and small changes when the business changes

What if my site is already on WordPress?

You do not have to panic. If you keep WordPress, a few things reduce the risk: remove plugins you do not use, replace anything abandoned, turn on automatic updates where it is safe, use strong unique logins with two-factor authentication and keep tested backups.

If you are tired of that routine, or the site is slow and dated as well, a rebuild is usually the cleaner answer. We migrate the content and redirect the old addresses so you keep your search visibility. See website redesign services.

What does it cost?

Our websites start from $1,500, with security updates and management available as a monthly service. The website cost guide explains what changes a quote and how to check whether a site pays for itself.