The short answer
- Of the 11,334 new vulnerabilities found in the WordPress ecosystem in 2025, 91% were in plugins and 9% in themes. Only 6 were in WordPress core, and none of those were serious (Patchstack annual report).
- You can check your own site in a few minutes: open Dashboard > Updates and Tools > Site Health in the admin area. Updates that have been waiting for months are the clearest warning sign.
- Six things to do today: update everything, delete unused plugins and themes, review admin accounts, turn on two-step login, confirm backups, and enable auto-updates.
- An outside scan shows what attackers can see from the internet. It cannot reliably list every plugin version; for that you need the admin screen or a check from inside the site.
- Strange pages in search results, redirects on mobile, or an admin user you do not recognize suggest the site may already be compromised.
Why are WordPress sites targeted?
WordPress runs 39.3% of all websites (W3Techs, 11 November 2026). That scale is the reason. When a weakness is found in a popular plugin, the same attack works on every site still running the old version, so attackers automate it and try it everywhere, whatever the size of the business.
The weak spots are very unevenly spread. Patchstack, a company that tracks WordPress security, counted 11,334 new vulnerabilities in 2025. Plugins accounted for 91% and themes for 9%. WordPress core had 6, all low priority.
Speed matters too. In the same report, the median time from public disclosure to mass exploitation was 5 hours for heavily exploited vulnerabilities. A plan to "update everything next quarter" leaves a long gap.
Patchstack also found that 46% of vulnerabilities had no fix from the developer in time for public disclosure. So "no updates available" does not prove that a plugin is safe.
Is my WordPress site secure? How to check from the admin screen
Even if an agency built the site years ago, the admin area tells you what is installed. If you have no login, ask the agency for an administrator account first.
- 1
Log in
Add /wp-admin to the end of your website address and sign in.
- 2
Open Dashboard > Updates
This one screen lists pending updates for WordPress itself, plugins and themes. If nothing is waiting, it says you are up to date.
- 3
Open Plugins > Installed Plugins
Each plugin shows its current version underneath. A plugin with a newer version is highlighted with a notice. Count the inactive ones too.
- 4
Open Tools > Site Health
The Status tab lists issues by severity. The Info tab shows the WordPress version, active theme, active and inactive plugins, and server details. The copy button gives you a report you can paste into an email.
- 5
Open Users > All Users
Filter by Administrator. Look for names you do not know, former staff, and old agency accounts.
What "update available" means. A newer version exists, and newer versions often include security fixes. Once a fix is published, the weakness it fixes is public knowledge too, so an update left waiting is a known way in.
Abandoned plugins. If the author has stopped working on a plugin, no fix will arrive, and so no update notice will either. Search for the plugin on WordPress.org. A banner saying it "hasn't been tested with the latest 3 major releases of WordPress" means it may no longer be maintained. A notice that it "has been closed and is no longer available for download" means it is time to plan a replacement.
The same goes for WordPress itself. Officially, only the latest release series is actively maintained. Older versions sometimes get security fixes, but WordPress describes that as a courtesy with no guarantee.
A WordPress security checklist you can finish today
Work from the top. Allow an hour or two. If you are worried an update might break the layout, do step 4 first.
- 1
Update everything
From Dashboard > Updates, update plugins, themes and WordPress. Then click through your home page, contact form and checkout to confirm they still work.
- 2
Delete what you do not use
A deactivated plugin still leaves its files on the server. Delete unused plugins outright. For themes, keep the active one and a single default theme as a fallback.
- 3
Review admin accounts
Keep Administrator for the people who truly need it; writers can be Editors or Authors. Avoid usernames like "admin", and use long passwords that are not reused elsewhere.
- 4
Confirm your backups
You need both the files and the database. Check with your host whether automatic backups are on, how many days are kept, and whether you can restore one yourself.
- 5
Turn on two-step login
A code from your phone on top of the password, usually added with a plugin or offered by your host. A leaked password alone no longer gets anyone in.
- 6
Enable auto-updates
On the Plugins screen, click "Enable auto-updates" in the right-hand column. For themes, click the theme under Appearance > Themes. Available since WordPress 5.5; WordPress checks twice a day.
These six steps make your site a much harder target for automated attacks that hunt for outdated software. They cost nothing, and they come before any security product.
What a WordPress vulnerability scanner can and cannot see
A check from outside, the way an attacker sees the site, and a check from inside answer different questions.
| Outside scan | Inside check (admin screen or internal scan) | |
|---|---|---|
| Can find | Open ports, encryption and certificate problems, files exposed by mistake, missing security headers, known vulnerabilities detectable from outside | The exact version of every plugin and theme, inactive leftovers, admin accounts, matches against known vulnerabilities |
| Cannot find | Plugins that do not reveal their version, anything behind the login, your user list | How the site looks to an attacker |
Security Ready's full scan is an automated outside scan. It covers the "Outside scan" column and sends each finding with instructions for fixing it. The first scan is free for one server, with no payment details. If you want the inside view as well, the Standard plan includes an internal scan with a WordPress plugin that sends only the names and versions of your plugins and themes and matches them against known vulnerabilities.
A clean result from either method is not a guarantee. Automated scans do not find weaknesses nobody has published yet, or deeper problems behind the login. We also do not clean up hacked sites or remove malware.
For more on scan types and their limits, see what a vulnerability scan is.
What to ask your web agency (copy and paste)
With a build-and-hand-over contract, updates can end up being nobody's job. The aim is to learn the current state and agree who handles updates from now on.
- Hi, we are reviewing the security of our WordPress site. Could you send us the following?
- 1. The current versions of WordPress, all plugins and all themes (the Tools > Site Health > Info export is fine).
- 2. The date of the last update, and who is responsible for updates today.
- 3. Any plugins that are no longer maintained or have been removed from the WordPress.org directory.
- 4. Whether backups exist, how often they run, and how a restore works.
- 5. A list of administrator accounts, and which ones your team uses.
- 6. A quote for handling updates every month.
How often should you run a WordPress vulnerability check?
With heavily targeted flaws exploited within hours, a once-a-year review leaves most of the year uncovered. Split the work between what runs by itself and what a person checks.
| How often | What |
|---|---|
| Automatic, daily | Plugin and theme auto-updates; alerts about newly published vulnerabilities |
| Monthly, 10 minutes | Open Updates and Site Health. Read the emails WordPress sends after auto-update attempts |
| Quarterly | Delete unused plugins, themes and admin accounts. Look for abandoned plugins |
| Yearly, and after a redesign | Test that a backup really restores. Run a fresh outside scan |
If you keep Security Ready running, it rescans weekly and compares your server's software with newly published vulnerabilities twice a day. Plans start at $19 a month.
Signs your WordPress site is already hacked
If updates have been ignored for years, check for an existing break-in before you tidy up. Any one of these means dealing with that first:
- Search results show pages or text on your domain that you never wrote
- Visitors on phones are redirected to another site
- An administrator you do not recognize appears under Users
- Plugins or files you did not install
- A warning email from your host or from Google
The step-by-step version is in Is my website hacked? Signs, how to check, what to do. For the basics beyond WordPress, such as your certificate and email spoofing protection, the 30-second check needs no sign-up.
Frequently asked questions
Is WordPress itself insecure?
No. In 2025 only 6 vulnerabilities were reported in WordPress core, none of them serious, against more than eleven thousand in plugins and themes. Keeping the site updated and tidy addresses where most of the risk is.
Can I check my WordPress site for vulnerabilities for free?
Yes. The Updates and Site Health screens in your admin area are free and the most accurate view of what is installed. For the outside view, Security Ready's first full scan is free for one server and needs no payment details.
Will updating break my site?
It can, and the risk grows the longer updates have been skipped. Take a backup first, update one plugin at a time, and look at the site after each one so you know what caused any problem. If the site takes payments or bookings, ask a developer to do it.
How many plugins is too many?
There is no fixed number. What matters is whether each one is still maintained. Every extra plugin is one more thing to update and one more possible way in, so remove the ones you do not use.
Is a security plugin enough?
Not by itself. A security plugin or firewall can block many attacks, but the underlying weakness is still there. Update first, then add protection on top.
Doesn't my hosting company take care of this?
It depends on the plan. Hosts mainly look after the server side, and updating the WordPress install, plugins and themes is often left to you. Check your plan for who handles updates, automatic backups, and a firewall.
I cannot log in to the admin area. What now?
Ask whoever built the site for an administrator account. If they cannot be reached, contact your hosting company. While you are at it, confirm that the hosting account and the domain are registered in your company's name.
See where your own site stands — free
The free in-depth scan checks your site from the outside against thousands of known weaknesses and tells you how to fix each one. No payment details needed. For businesses; scans only with the owner's authorization.