So, is WordPress secure? The short answer is yes, and also: it depends on you. The software at the heart of WordPress is looked after by a real security team and patched regularly. The sites that get hacked are almost always the ones that fell behind on the basics.
If you run a business on WordPress, or you are thinking about it, that should make you calmer rather than more nervous. The things that go wrong are predictable, which means they are preventable. This guide separates myth from reality and finishes with a short list of what to do this week.
So, Is WordPress Secure?
WordPress core is the main software you download from wordpress.org, without any plugins or themes. It has a dedicated WordPress Security Team that finds and fixes issues, hardens the software, and backports important fixes to older versions. Anyone who finds a flaw is asked to report it privately so it can be fixed before it becomes public. You can read how that works on the official WordPress security page.
That is a good sign. Software with no security process is a gamble. Software with a team, a reporting route and regular releases is run seriously.
But "core is well maintained" is only part of the picture. Think of buying a car with excellent brakes. If you never service it, fit bald tyres and leave the keys in the door, the brakes will not save you.
Where WordPress Sites Actually Get Hacked
When a WordPress site is compromised, the cause is rarely a dramatic flaw in core. It is usually one of a short list of ordinary things.
Plugins and Themes
A typical business site runs a good number of plugins, each written by a different developer. Any of them can have a bug. When one is found, a fix is released, and attackers race to hit every site that has not updated yet.
This is the most common route in. If you want to understand it better, our article on WordPress plugin vulnerabilities explains how they are found and what to do about them.
Abandoned plugins are worse. If the developer stopped updating it two years ago, any new flaw will never be fixed.
Weak and Reused Passwords
Attackers do not need to be clever if your password is Summer2024! or the same one you use on five other sites. When a different service is breached, those passwords end up in lists, and bots try them against WordPress sites. Others are handed over directly, through WordPress phishing emails that look like real alerts.
You can check whether a password has appeared in known breaches at Have I Been Pwned, which does the check without sending the full password anywhere.
Outdated Software
Old WordPress versions, old PHP versions and old plugins all stop getting security fixes eventually. Running them is like leaving a window open because you could not be bothered to buy a new latch. The official hardening handbook says it plainly: keep WordPress current, because older versions no longer receive security fixes.
Cheap or Neglected Hosting
Hosting matters more than people think. A bargain server shared with hundreds of other sites, running old software and no isolation between accounts, puts your site at risk even if you do everything right. Good hosts keep the server patched, back it up and isolate your account.
Too Many Admins
Every account with full power is a door. The intern who left last spring, the freelancer from two years ago and the "test" user someone created and forgot are all risks. Fewer admins, fewer problems.
WordPress Security Myths vs Reality
Let's clear up a few things you will hear in the pub, in forums, and from salespeople.
| Myth | Reality |
|---|---|
| "WordPress is insecure because it is open source." | Open code can be reviewed by many people. What matters is how quickly flaws are fixed and applied. |
| "Hackers only target big sites." | Most attacks are automated. Bots scan the whole internet for old plugins and weak logins and do not care if you are small. |
| "My site is too small to be interesting." | A small site is still useful to an attacker: to send spam, redirect your visitors or host something nasty. |
| "A security plugin makes me hack-proof." | No tool does. A plugin reduces risk and helps you spot trouble, but updates and strong passwords still matter. |
| "My host takes care of everything." | Hosts protect the server. Your WordPress admin, users and plugins are still your job. |
| "Changing the sign-in URL is enough." | It cuts a lot of bot noise, but it is one layer, not a strategy. |
| "If nothing looks wrong, I'm fine." | Many compromises are invisible. Hidden spam pages and quiet redirects can run for weeks. |
The last myth is the one that hurts. Plenty of owners find out only when Google flags the site or a customer emails to say something odd happened. Our guide to the signs your WordPress site has been hacked shows what to look for.
Is WordPress Secure Compared With Other Platforms?
People often ask how it stacks up against hosted website builders. The fair comparison is about who does the work.
With a hosted builder, the company runs the servers, applies updates and limits what you can install. You get less flexibility and less to worry about.
With WordPress, you choose the host, the plugins and the theme. You get enormous flexibility and you also take on the upkeep, either yourself or through someone you hire.
Neither is automatically safer. A well-run WordPress site with updates, two-factor and tested backups can be very secure. A neglected one will eventually cause trouble. If you do not want to do the upkeep yourself, that is fine, but pay someone to do it, or use one of the WordPress care plans many agencies offer. The point is that someone owns the job.
What a Well-Kept WordPress Site Looks Like
It helps to picture the good version. Imagine a small consultancy with a ten-page site, three people who log in, and a contact form that brings in most of its leads.
On the safe version of that site, everyone has a unique password and a code on their phone. Updates are applied within a few days of release. The old "test" plugin was deleted months ago. Backups are made regularly, copied off the server, and someone restored one last quarter to prove it works. Alerts go to a shared inbox that a person actually reads.
Nothing there is exotic. It is a handful of dull habits, repeated. That is the real answer to whether WordPress is secure: the platform gives you a sound base, and the habits turn it into a safe site.
Now picture the other version. Same site, but eight plugins are two years out of date, the former web designer still has an admin login, the password is shared in a group chat, and the last backup was made when the site launched. Same software, completely different risk.
Key takeaway: the gap between a safe WordPress site and a hacked one is rarely money or technical skill. It is attention.
What a Business Owner Should Do This Week
You do not need to become a security expert. Here is a short list you can get through in a few sittings, in order of how much risk each one removes.
1. See Where You Stand
Run the free security check for a quick outside view. It takes a couple of minutes and gives you a first list of things to look at.
2. Update Everything
Log in, go to Dashboard, then Updates. Update WordPress, plugins and themes. If you are nervous about breaking something, take a backup first, and update on a staging copy if you have one. Delete plugins and themes you do not use. Deactivated is not the same as safe.
3. Clean Up Users
Open Users and look at every administrator. Do you recognise each one? Remove anyone who no longer works with you, and give people the lowest role that lets them do their job. An editor does not need to be an administrator.
4. Fix Passwords and Turn On Two-Factor
Make sure every admin has a unique, long password. Turn on two-factor authentication, which asks for a code from your phone as well as the password. It is the single best upgrade for sign-in. Our two-factor guide takes you through it.
5. Test Your Backup
A backup that has never been restored is a guess. Make a fresh one, store a copy somewhere other than your server, and confirm you could actually restore it. Our backup strategy guide covers how.
6. Add Basic Hardening
Make sure the whole site loads over HTTPS (here is how to force HTTPS in WordPress). Switch off what you do not use, such as XML-RPC and the plugin code editor, and stop your site from revealing usernames. The WordPress hardening checklist has the full list in plain English.
7. Decide Who Is Watching
Someone needs to look at alerts and updates regularly. That might be you for ten minutes a week, or it might be a person you pay. Write down who it is.
How Stack Guard Helps
Everything above works without any particular plugin. But some of it is easier with help, and that is where Stack Guard comes in.
Stack Guard Free gives you a security score from 14 checks, so you can see in one place what is on and what is missing. It hides your sign-in page, supports two-factor, locks out repeated failures, applies hardening switches, runs manual malware scans, and keeps a 7-day activity log of what happened on the site. It also makes manual, verified backups with a one-click restore you can roll back for seven days. See the dashboard and site owner pages for the detail.
Pro adds things that run without you remembering: scheduled scans, file change monitoring, a check that flags plugins and themes running several versions behind, a longer log and fuller alerts. It starts at $95 a year for one site, with a 14-day money-back guarantee on a first purchase.
If you want to compare it with other options first, our guide to choosing the best WordPress security plugin lays out what to look for.
It is not magic, and it will not replace updates or good passwords. What it does is make the habits easier to keep and shorten the time between "something happened" and "I know about it".
How Often Should You Revisit This?
Security is not a one-off job. A sensible rhythm for a small business site looks like this:
- Weekly: glance at pending updates and any alerts. Ten minutes.
- Monthly: review users, confirm a fresh backup exists, and skim the activity log.
- Twice a year: do a proper review of everything, plugins, hosting, access and recovery. Our WordPress security audit is built for exactly that.
- Whenever people change: when staff, freelancers or agencies come and go, remove their access the same day.
If a rhythm like that feels like too much, that is useful information. It means you should hand the job to someone, or use tools that run the checks and tell you when something needs a human.
The Calm Takeaway
So, is WordPress secure? It is secure enough to run a serious business on, as long as someone looks after it. The software has a proper security team. The risk comes from outdated plugins, weak logins, careless access and nobody checking.
Do the seven things above this week, put a recurring reminder in your calendar, and you will be ahead of most sites on the internet. If you want to go deeper after that, the WordPress security audit gives you a full afternoon checklist.