WordPress security
Is WordPress secure? The core is. The plugins are the risk.
WordPress itself is well looked after: only 6 of the 11,334 vulnerabilities found around WordPress in 2025 were in WordPress itself. 91% were in plugins, and a new one typically gets attacked within hours of becoming known. A site is only as secure as its least cared-for plugin. Unless its visitors never reach WordPress at all.
Your whole site, on your own domain.
Free while we're in beta. No credit card.
Test it on one of your pages
About twenty seconds, no account. You see your page and the copy side by side and click through it yourself.
A copy that works like your site
A plain HTML export saves each page with the files it links to. Anything a page loads only after it opens, like images that appear as you scroll, a menu that fills in, content a script fetches or a link that redirects, often goes missing. And you hear about it from a visitor.
A MakeStatic copy works like your site, it doesn't just look like it. You test it yourself, side by side with your site, before deciding anything. And if a page of the copy ever behaves differently from yours, write to [email protected] and we'll fix it.
- Images that load as you scroll, in every size your site has for phones and big screens.
- Fonts, icons and everything your theme or page builder brings along.
- Content a script loads after the page opens, and menus that fill in on hover.
- Links that redirect to another address still redirect.
- Videos that play and let you skip ahead.
- Contact forms that deliver and a search box that answers.
WordPress itself is well looked after
WordPress has a security team, and since version 3.7 it installs its own security releases in the background. In 2025, only 6 vulnerabilities were reported in WordPress itself.
That doesn't make it immune. wp2shell, in July 2026, was a flaw in WordPress itself that anyone could exploit, and WordPress pushed the fix to sites as a forced update. It's the exception, not the rule.
Where the risk is
- 91% of the vulnerabilities found in 2025 were in plugins, 9% in themes.
- 46% had no fix available when they went public.
- The first attack on a new vulnerability comes after a median of 5 hours, and about half of the serious ones are attacked within a day.
- Plugins and themes only update themselves where someone switched that on for each one, or when WordPress's security team forces an update.
- In the last published study of hacked sites, 39.1% of the systems were out of date when they were infected.
Why updating isn't the whole answer
An update closes a hole once there's a fix. For almost half of them there's none when they become known, and the attacks start within hours.
A small company's website is rarely targeted on purpose. It gets found by bots that try the same known flaw on every WordPress they reach, and WordPress runs 40.2% of all websites.
What a security plugin does
A security plugin such as Wordfence checks the requests that reach WordPress and blocks the ones that match its rules; in its extended mode, its firewall runs before WordPress does. That helps against every attack it has a rule for.
But every visitor still reaches WordPress and its plugins, and the security plugin is one more to keep up to date.
When visitors never reach WordPress
A static copy answers every visitor with files. No plugin runs for them and no database answers them. The contact form still arrives, because it reaches us and we email it to you, and search still works, right in the visitor's browser.
A plugin flaw can only be exploited where WordPress answers, and at your public address it no longer does.
What's still yours to look after
The WordPress you edit in stays online at its own address, so it still needs its updates. A missed one no longer puts the site your visitors see at risk, and nothing from it reaches them until you publish. Your domain, your email and your passwords are still yours to keep safe.
Sources
Patchstack, State of WordPress Security in 2026 (figures for 2025); Sucuri, 2023 Hacked Website & Malware Threat Report; the WordPress documentation on automatic updates; W3Techs, September 2026. Checked on 28 September 2026.
Frequently asked questions
- Is WordPress safe enough for a small company's website?
- WordPress itself, yes, if it's kept up to date. What decides it is the plugins on it and how quickly each one gets updated. Or whether visitors reach them at all.
- Do I still have to update WordPress if my public site is a static copy?
- Yes. The WordPress you edit in still needs its updates. What changes is what a missed update puts at risk: your editing installation, not the site your visitors see.
- Is a security plugin still worth having?
- On the WordPress you edit in, it can be, because that one stays online. On the public site, a static copy leaves it nothing to guard.
- Which is more secure, a static site or WordPress?
- A static site gives an attacker far less to work with: files, and nothing that runs for a visitor. That's why the copy is static and WordPress stays where you edit.
Free while we're in beta
MakeStatic is new, and while it's in beta you get all of it for free: your whole site, on your own domain. No credit card, no commitment.
At some point it will cost something. When there's a price, you'll see it before anything about your site changes.