Is WordPress Secure?

Is WordPress secure? The honest answer is yes, and the reason people keep asking is that they mean something slightly different from what they're asking. This post is about the gap between the question and the real one, and the small number of factors that actually decide whether a WordPress site is safe or not.

Short version, if you want it up front: WordPress core is one of the most heavily audited pieces of open source software on the internet, run by security professionals, patched fast, and generally speaking not the thing that gets sites hacked. What gets sites hacked is what people bolt onto it, how it's hosted, and whether anyone updates it. If those three are handled properly, WordPress is as secure as anything else you'd put on the public internet.

The question underneath the question

Nobody asks "is WordPress secure" as a computer science question. When people ask, they mean one of the following.

"Will I get hacked if I use WordPress?" A risk question, not a technical one.

"Is WordPress less secure than Wix or Squarespace?" A comparison question, usually prompted by someone trying to sell them a hosted platform.

"My WordPress site got hacked, is that WordPress's fault?" A blame question, usually asked after the fact.

"Should I use WordPress for my business?" A decision question that's really about whether the security overhead is worth it.

Those are four different questions and they have four different answers. I'll take them in order.

Will I get hacked if I use WordPress?

Depends almost entirely on what you do with it. A WordPress site set up properly, kept up to date, hosted on a decent server, with a small number of well-chosen plugins, is very unlikely to get compromised. A WordPress site with thirty abandoned plugins, an admin user called "admin" with a password of "password123", running on the cheapest shared hosting money can buy, on a version of WordPress from 2019, is going to get compromised. The gap between those two sites is enormous, and it's the gap that matters, not the fact that both of them run WordPress.

The vast majority of WordPress compromises trace back to one of three things: an out-of-date plugin with a known vulnerability, a weak or reused admin password, or a hosting environment that's shared with another compromised site. None of those are WordPress. All of them are the ecosystem around it. If you handle those three, you've eliminated the top three attack vectors that account for most real-world compromises.

Which is a boring answer, but boring answers are usually right. WordPress security is not glamorous. It's updating plugins, using strong passwords, and picking a host that takes the platform seriously.

Is WordPress less secure than Wix or Squarespace?

This is the comparison that comes up most often. Someone considering WordPress reads a scary article about WordPress being "hacked" (usually meaning some individual sites got compromised) and then reads that Wix or Squarespace is "more secure" because it's hosted.

Both parts of that framing are misleading, so let's do it properly.

What Wix and Squarespace actually secure - They run the servers, they run the CMS, they patch it, they handle the updates, they lock down the admin surface. That means the classes of problem WordPress users worry about, things like an unpatched core version, a compromised host, a bad plugin update, don't apply. Those problems still exist for Wix and Squarespace users, but they're the platform's job to solve, not yours. If you don't want to think about security at all, that's genuinely a real benefit.
What they don't secure - Your account. If someone phishes your login, or you reuse your password, they're in your site. The hosted platform can't help. The same is true of WordPress. Account security is on you regardless of platform.
What the comparison misses - WordPress is open source, so when a vulnerability exists it gets a CVE, it gets reported, it gets written about, and the fix is public. Wix and Squarespace vulnerabilities exist too, they just aren't publicly disclosed the same way, so you don't hear about them. The absence of headlines is not the same thing as the absence of vulnerabilities. It's the presence of a company that doesn't want to talk about them.
The honest verdict - For a brochure site with no interactive features, run by someone who doesn't want to touch the technical side, Wix or Squarespace is a defensible choice, and yes the day-to-day security burden is lower. For anything with any real requirements (custom code, a proper e-commerce store, a membership site, ownership of your data, portability off the platform), WordPress properly configured is fine, and comparable in real-world outcomes to the hosted platforms. What decides the outcome is the setup, not the letters WP.

I've written full posts on WordPress vs Wix and WordPress vs Squarespace if you want the longer version of each comparison.

My WordPress site got hacked, is that WordPress's fault?

Almost always no, and I say that as someone who's cleaned up a lot of hacked WordPress sites. The pattern that turns up in the logs and the file system is remarkably consistent. It's almost never a WordPress core exploit. It's almost always one of the following.

A vulnerable plugin - Somebody publishes a security advisory for Popular Plugin X. Attackers write a scanner that hits every WordPress site on the internet looking for that plugin, unpatched, in the next 48 hours. If your site's on that list, you're compromised. The fix is not "stop using WordPress". The fix is "update your plugins promptly and remove the ones you don't need". The common WordPress security issues post covers this in more detail.
A weak or reused admin password - Brute force is still one of the most common ways in. Not because it's clever, because there's an enormous amount of automated login-form hammering going on at all times, and eventually one of the sites they hit will have a weak password. Lock down wp-login.php is the specific remedy.
A shared hosting compromise - On badly-configured shared hosting, a compromise on someone else's site can jump into yours. This is not a WordPress problem. It's a hosting problem. Change host. What your WordPress host won't do covers what to look for.
A nulled theme or plugin - Someone downloaded a paid plugin from a "free" site. It came with a backdoor. Nothing on the internet or in the WordPress ecosystem can save you from this. Don't do it.

If your site got hacked and you're wondering whether it was WordPress's fault, run through that list. If any of them apply, that's your answer, and it's not WordPress.

Should I use WordPress for my business?

This is the real question, and the answer depends on three things.

Do you need what WordPress gives you? Full ownership of your content and data. No platform vendor risk. A vast ecosystem of themes and plugins. Custom code where you want it. Portability. If any of those matter, WordPress is a reasonable choice and the security overhead is worth managing. If none of them matter, a hosted platform will be less work.

Are you prepared to keep it updated? Not you personally, necessarily. A monthly maintenance retainer with someone who knows what they're doing costs less than an hour of most professionals' time and covers the bulk of what needs doing. If you're not going to update it and you're not going to pay someone else to update it, then no, don't use WordPress. Don't use anything self-hosted.

Do you understand that the platform is not the threat? The threat is what runs on it. If you install every plugin you see recommended and never review the list, if you use the same password everywhere, if you host it on the cheapest thing you can find, you'll get compromised eventually. Not because of WordPress. Because of the choices you made around it.

If those three things are handled, WordPress is secure. Not "secure enough". Actually secure. As secure as anything you'd put on the public internet, in the real-world sense that matters.

Where this fits

The Protect My WP handbook is the long-form version of everything above. Thirteen chapters covering the server, the core, the users, the files, the database, HTTPS, the firewall, plugins, performance, monitoring, backups, and the maintenance workflow that ties it all together. It's the specific answer to "how do I make sure my WordPress site isn't the one that gets hit".

If this post left you with more questions than it answered, that's fair. The book is the answer to those questions.

Get the book for £19.