WordPress vs Squarespace: Security Compared

In July 2024, a dozen or so companies woke up to find their domains no longer belonged to them. They were Squarespace customers. Nobody had guessed a password, and no server had been broken into. The accounts had simply been migrated from Google Domains in a way that let someone else claim the admin email address first.

I start there because it is the most useful thing in this comparison, and because it is the part the marketing pages on both sides skip. The usual WordPress versus Squarespace argument is about plugins and patching. The incident that actually cost Squarespace customers their businesses was about account recovery, which is the layer nobody puts in a comparison table.

So this post is organised around where each platform's security actually fails in practice rather than where the feature lists differ. It's current for July 2026, and I have nothing to sell you either way.

Short version, if you want it up front: Squarespace's platform security is genuinely good and its account security has a documented weak spot. WordPress inverts that. Which one is safer depends less on the platform than on which of those two failure modes you are equipped to handle.

Draw the line around what you own

Every hosted platform draws a line. On one side is what they secure, on the other is what remains yours. The comparison only makes sense once you know where Squarespace's line sits, because everything they own is a problem you will never have, and everything you own is a problem they will never solve for you.

On Squarespace, what remains yours is smaller than most people assume, and specific: your account credentials, your Extensions installs, your DNS and domain settings, and anything you paste into Code Injection or Code Blocks. Everything else, the servers, the CMS, the database, the network, the CDN, the TLS certificates, patching, DDoS mitigation, 24/7 SOC monitoring, is behind the line and not your problem.

Note what is on your side of that line, though. DNS and domain settings, and the account that controls them. That is precisely where July 2024 happened. The line is drawn in a sensible place, but the sliver left to you contains the keys to everything else.

On WordPress the line barely exists. You pick the host, install the CMS, choose the theme, add the plugins, and own the upkeep of all of it. That is a far larger surface, and it is the honest reason WordPress sites get compromised more often. It is also why no Squarespace-style incident can happen to you without your involvement: there is no migration process between you and your registrar that you did not set up yourself.

What Squarespace does better than WordPress

A lot of pro-WordPress writing pretends the advantages only run one way. They don't, and two of the items below are things WordPress cannot match at any price.

The maintenance failure mode simply does not exist - This is the big one. Squarespace patches constantly and invisibly. No 11pm vulnerability email, no core version to update, no site sitting on a six-month-old plugin with a public exploit. Look at any list of how WordPress sites actually get compromised and the top entry is always deferred maintenance. Squarespace deletes that entire category, and it deletes it for the kind of owner least equipped to handle it.
A very small, tightly curated Extensions ecosystem - Squarespace has around forty to fifty Extensions across Sales, Marketing, Inventory, Finance and Shipping. That's tiny compared to WordPress plugins or Shopify apps, and it's deliberate. The single most common way WordPress sites get compromised is a vulnerable plugin. Squarespace has almost designed that failure mode out by not having much of a plugin ecosystem in the first place.
Passkey support, and it's good - Unusually for the sector, Squarespace supports passkeys for two-factor authentication, including hardware security keys like YubiKey, up to five per account, plus TOTP apps and (in a handful of countries) SMS. Backup codes are available in sets of eight. As of the May 2026 help doc, that's a stronger baseline than most hosted platforms and better than Wix, which still has no hardware-key or passkey option.
Re-authentication on sensitive actions - Squarespace prompts a fresh authentication when you change your password, change 2FA settings, or touch DNS and domain permissions. That's a specific mitigation against session hijacking that isn't universal even among enterprise SaaS.
Baseline platform security - Squarespace's public pages list TLS, HSTS, a WAF, DDoS mitigation, a 24/7 SOC, PCI-DSS-compliant payment integrations (card data goes direct to the processor, never to Squarespace's servers), and a 99.9% uptime target. They're certified under the EU-US, Swiss-US and UK Data Privacy Frameworks.

Put those together and a pattern emerges: Squarespace is strongest exactly where inattentive owners are weakest. An unmanaged WordPress site run by someone who will not log in again for a year is genuinely riskier than the Squarespace equivalent. That is not magic, and it is not marketing. They have removed the surfaces where non-experts reliably fail, and then, in the passkey and re-authentication work, gone further than most of the sector on the surface that is left.

Back to July 2024, in detail

Which brings us to the exception, and the reason it belongs at the centre of this comparison rather than in a footnote.

Between the 9th and 12th of July 2024, a coordinated wave of domain hijackings hit Squarespace customers. Compound Finance, Celer Network, Pendle Finance, Unstoppable Domains and around a dozen other companies (mostly in crypto and web3) had their domains taken over. The attackers had exploited a weakness in Squarespace's migration of Google Domains customers over to its own registrar. They pre-registered admin email addresses they'd guessed from public data, then used those addresses to take over the migrated Squarespace accounts. Researchers reported that 2FA was effectively disabled on migrated accounts. Squarespace's own post-mortem, published on 23 July 2024, blamed "a weakness related to OAuth logins" and said it was fixed within hours.

Two things are worth taking from this. One, no CVE-tracked platform vulnerabilities or major breaches surfaced in the year since, in the reputable coverage I could find. So the response held. Two, the design choice underlying the incident (email addresses not validated at account creation) is still there. If you're running a site of any real value on Squarespace, that's a good reason to make sure the email address on the account is one only you control, on a domain you control, and that 2FA is on with a hardware key or a passkey.

I'd hold this against Squarespace less than the internet did at the time. It was a migration edge case, not rotten engineering, and the fix was fast. But it demonstrates the thing worth understanding about hosted platforms generally. When the failure is on their side of the line, you do not get to patch it, you do not get advance warning, and you find out when your domain stops resolving. That is the trade you are making, and it is a reasonable trade. It is just not the trade the comparison articles describe.

What WordPress does better than Squarespace

The other direction, which also has to be said honestly.

You control the security response - When Squarespace has a vulnerability, you find out when they tell you, or when your site behaves oddly, or not at all. The July 2024 incident is a case in point: customers found out because their domains were being drained, not because Squarespace saw it coming. WordPress core and plugin vulnerabilities get published CVEs and you can patch on your own timeline. That's more work, but it's also more agency.
Full data ownership and export - Squarespace 7.1, which has been the default for all new sites since 2020, does not support the built-in XML export at all. Older 7.0 sites can export a WordPress-compatible XML file of blog posts and basic pages, but products, galleries, member areas, forms, design, CSS and images embedded by reference are all excluded. If you're on Squarespace 7.1 and you decide to leave, you're rebuilding. WordPress can be moved between hosts in an afternoon.
No vendor risk - Permira took Squarespace private in a $7.2 billion deal that closed on 17 October 2024. Anthony Casalena is still CEO, and the platform is unlikely to disappear, but private-equity ownership does change the incentive structure over time and it's worth noting. WordPress isn't owned by anyone.
You can implement things they won't - IP allow-listing on the admin login. Custom rate limiting. Custom security headers on any tier. A web application firewall of your choice. Log aggregation to your own SIEM. Enforced 2FA policies for all collaborators. Code Injection and Code Blocks on Squarespace let you paste arbitrary JavaScript, which is powerful but also means the same code you'd use for tracking can be used against you if your account is taken over. On WordPress you can layer all of the above properly.
Missing compliance paperwork - Neither of Squarespace's public security or measures pages currently lists SOC 2 or ISO 27001 certification. That doesn't mean it isn't in progress somewhere, but it does mean that if procurement asks, you may struggle to hand over the same paperwork that Wix or a serious WordPress host can produce.

Notice these are not really security features. They are control, ownership and the ability to respond. On a good day that distinction does not matter at all. It matters entirely on the day something goes wrong, which is the only day security is ever measured.

Three things the comparison usually gets wrong

A few areas where the standard version of this argument misleads people in both directions.

Account security is on you either way - Every platform has a login. Every login can be phished. Every login can be brute-forced if you use a weak password. Turn on 2FA, use a passkey or hardware key on Squarespace where the option exists, use a password manager. That single hour matters more than the platform choice.
"WordPress gets hacked more" is a misleading statistic - Yes, more WordPress sites get compromised than Squarespace sites. WordPress runs somewhere in the region of 40% of the web. Squarespace runs a few percent. If you compare absolute numbers, of course WordPress "wins". If you compare rate per properly-configured site, the numbers are much closer and much harder to pin down, because Squarespace doesn't publish theirs. The absence of headlines is not the same as the absence of incidents, and July 2024 is a specific example of that.
Squarespace's AI features add a new surface - Design Intelligence (Blueprint AI, Brand Identity, the Beacon AI assistant) was introduced in May 2024 and rolled out through Refresh 2024 and 2025. There's no published documentation on the account-access security controls specific to these AI features. If you're using them in an account with sensitive data you should be reading the settings carefully. This applies to Wix's AI agents too, but neither platform's security page has caught up with what's now possible.

So which one

If security is the deciding factor, the choice comes down to which failure mode you are actually equipped to handle: neglected maintenance, or no control when the platform slips.

Pick Squarespace if the site is going to be simple, you're not going to touch it after launch, you don't need to own the data or move it later, you don't need custom code or unusual integrations beyond Code Injection, and you'd rather pay a monthly fee than think about maintenance. If you do go this route, put a hardware key or passkey on the account, use an email address on a domain you fully control for the login, and turn on the strongest 2FA option. The July 2024 lesson is that Squarespace's defaults are more forgiving than they should be, and the strongest available settings matter.
Pick WordPress if you need customisation, ownership, portability, enforced team 2FA, SOC 2 or ISO 27001 paperwork through a serious host, or capabilities Squarespace doesn't offer, and you're prepared to either keep it updated yourself or pay someone else a modest retainer to do it.
The one thing that trumps the choice - whichever platform you pick, spend an hour on account security. Long unique password. Password manager. Two-factor authentication with the strongest method the platform supports. Review who has access. That single hour makes more difference to your real-world security outcome than choosing between the two platforms does.

Where this fits

Everything above assumes the WordPress option comes with a maintenance habit attached. That habit is what the Protect My WP handbook is. Fourteen chapters covering the server, the core, the users, the files, the database, HTTPS, the firewall, plugins, performance, monitoring, backups, AI agents, and the maintenance workflow that keeps a site on the right side of this comparison rather than becoming the neglected install everyone warns you about.

Chapter 3 is the one most relevant to the story this post opened with. Account security, enforced two-factor, and controlling the email address and domain that everything else recovers through. The July 2024 lesson applies to WordPress too, and the people who came through it fine were the ones who had already done that work.

Get the book for £19.