Tag Archive for: WordPress security

The Free Digital Audit: What We Look For (And Why Most Sites Fail)

/in , , , /by

Every business owner we talk to has the same quiet worry: they know their website could be doing more, but they can’t see what’s actually wrong with it. It looks fine. It loads. The contact form works. So what’s the problem?

That’s exactly the gap a digital audit closes. A site can look perfectly healthy on the surface while quietly leaking leads, sinking in search results, or sitting one outdated plugin away from a security incident. Our free audit is a human-led review — not an automated score out of 100 — across the five areas that most often decide whether a small-business website earns its keep. Here’s what we examine in each, and the specific way we most often see sites fall short.

Why a Human-Led Audit Beats an Automated Score

You’ve probably run your site through a free online scanner and gotten back a number and a wall of red warnings. Those tools have their place, but they can’t tell you which of those forty warnings actually matters for your business. A machine flags a missing image alt-tag with the same urgency as a broken checkout form.

Think of it like a home inspection. A moisture meter can tell you a wall reads damp — but it takes an inspector to know whether that’s yesterday’s spilled coffee or a burst pipe behind the drywall. Our audit is the inspector: we look at the readings, but we tell you what they mean for your leads, your rankings, and your risk — in plain English, ranked by what to fix first.

The Five Areas We Evaluate

Every Connect4 audit covers the same five dimensions, because a weakness in any one of them undermines the others. A fast, beautiful site that no one can find is as much a problem as a well-ranked site that scares visitors off.

1. Security

What we check: Whether your core platform, themes, and plugins are current; whether SSL is correctly configured; whether automated backups exist and have actually been tested; and whether any known-vulnerable components are installed. On WordPress, outdated plugins are the single most common entry point for attacks.

Where most sites fail: The site was built once, handed over, and never maintained. We routinely find sites running plugins two or three years out of date, no backup system in place, and an admin login exposed at the default URL. Nothing looks wrong — until the day it very much does, and there’s no clean backup to restore from.

2. Performance & Core Web Vitals

What we check: How fast your pages load and become usable, especially on a mobile connection, measured against Google’s Core Web Vitals thresholds. We look at image sizes, render-blocking scripts, and how quickly your main content appears.

Where most sites fail: The homepage carries a 3MB hero image that was never compressed, plus a stack of plugins each loading their own scripts. On a phone over cellular, the page takes six or seven seconds to become usable — and more than half of mobile visitors are gone before it finishes. Since Google uses these speed signals in ranking, a slow site loses twice: fewer visitors and lower placement.

3. Search & AI Visibility (SEO + AEO)

What we check: Whether search engines can properly read your site, whether your pages target the terms your customers actually search, whether Schema markup is present, and — increasingly — whether your business shows up when someone asks an AI tool for a recommendation. This last part is the newest and fastest-changing piece of the audit.

Where most sites fail: This is where the ground has shifted most. Being ranked #1 in Google no longer guarantees the click it used to. Ahrefs data from March 2026 showed AI Overviews — the AI-generated answer box above the normal results — appearing on nearly half of all Google searches, up sharply from a few months earlier. Roughly 58% of searches now end without anyone clicking through to a website at all. Purely informational content has seen traffic declines in the 20–40% range on sites that haven’t adapted. The good news for local businesses: commercial and ‘near me’ searches hold up far better, and a strong local foundation — an optimized Google Business Profile, consistent listings, and real reviews — is currently the most resistant to this shift. Most sites we audit have done nothing to position for it.

4. Conversion & Lead Capture

What we check: Whether a first-time visitor immediately understands what you do, who you help, and what to do next. We check the clarity of your above-the-fold message, the visibility and simplicity of your calls to action, and whether your contact forms actually work and are easy to complete.

Where most sites fail: The site talks about the business instead of the visitor. The headline is a tagline nobody understands, the phone number is buried in the footer, and the contact form asks for eleven fields when three would do. Traffic arrives — and leaves — because nothing tells the visitor, in the first five seconds, that they’re in the right place.

5. Analytics & Measurement

What we check: Whether you can actually see what your website is doing. We confirm GA4 is installed and tracking correctly, that Google Search Console is connected, and that form submissions and calls are being counted as conversions — so decisions rest on data, not guesswork.

Where most sites fail: There’s no working analytics at all, or an old Universal Analytics tag that stopped collecting data long ago. The owner has no idea which pages bring leads, where visitors drop off, or whether last quarter was better than this one. You can’t improve what you can’t measure — and most sites are flying blind.

The Pattern Behind Every Failure: ‘Set It and Forget It’

Look back across those five areas and you’ll notice the failures share a root cause. Almost none of them come from a site that was built badly. They come from a site that was built once — launched, handed over, and then left alone while the world around it kept moving.

A website isn’t a brochure you print and file away. It’s more like a storefront on a busy street: leave it untended and the paint peels, the locks wear out, and the competitor who repaints monthly slowly wins the foot traffic. The security patch you skip, the search-engine shift you don’t respond to, the analytics you never check — each is small in isolation and compounding over time.

The compounding math:  A small fix in month three lifts rankings by month six, which brings more traffic by month nine, which becomes more leads by month twelve. Consistency beats intensity — sustained monthly attention outperforms the occasional dramatic overhaul almost every time.

What You Can Do Right Now (No Developer Needed)

You don’t have to wait for us to start. Here are five things you can do this week to see your own site more clearly:

  • Run a 30-minute personal audit. Log into your site, set a timer, and hunt for the three most obvious problems. Write them down.
  • Search yourself in three places. Look up your business name and main service in Google, ChatGPT, and Perplexity. Note whether what comes back is accurate, complete, and current.
  • Get a fresh pair of eyes. Ask one trusted client or colleague to review your site cold and tell you honestly what’s confusing. Familiarity hides problems from you that they’ll spot in seconds.
  • Set up Google Search Console. It’s free and shows you directly how Google sees your site and what errors it’s found.
  • Book a monthly 15 minutes with yourself. First week of every month: check for updates, review your Google Business Profile, and read your latest analytics.

Where Connect4 Comes In

The steps above will surface symptoms. Diagnosing the cause — and fixing it without breaking something else — is where we help. Our free audit gives you a plain-English report with prioritized findings and a specific remediation plan: what to fix first, what can wait, and what it will take.

But the audit is a snapshot, and the real problem, as we’ve seen, is drift over time. That’s why the businesses that pull ahead don’t just get audited once — they move onto an ongoing care plan that handles security, performance, content, and visibility every month, so no single area is ever neglected long enough to become a vulnerability or a missed opportunity. Small businesses and nonprofits on that footing consistently outperform competitors spending the same money — or more — on periodic overhauls.

Start here:  Book your free digital audit, and we’ll walk you through exactly where your site stands across all five areas — then show you what an ongoing monthly care plan would keep in good health going forward. No obligation, no jargon, no automated score to decode.

No Platform is “Hack-Proof”

/in , /by

Website Security Risk Across WordPress, Drupal, Wix, Squarespace, Static, and AI

In short:  There is no single “most secure” website platform — security risk doesn’t disappear when you switch platforms, it relocates. WordPress and Drupal put the risk in code you maintain; Wix and Squarespace hand server security to the vendor but shift risk to your account; static sites shrink the attack surface but move it to your build pipeline; and AI-built sites are fast but ship insecure code by default. The safest platform is the one that’s competently maintained.

Why “which platform is safest?” is the wrong question

Every website has an attack surface. A database, a login page, a plugin, a dependency, a DNS record, an admin account — each is a door, and no platform has zero doors. What changes from one platform to the next isn’t whether the risk exists; it’s where the risk concentrates and who is responsible for closing it.

That reframing matters, because it cuts through the marketing. “We handle security for you” is true of hosted builders — for the parts they control. “Static sites can’t be hacked” is nearly true for the server, and not at all true for the supply chain that builds them. Once you know where each platform hides its risk, the right choice for your business gets a lot clearer. Here’s the whole landscape on one page:

Platform Where the risk concentrates Who patches it Best fit
WordPress Third-party plugins (91% of its vulnerabilities) You / your maintainer Custom, owned, SEO-flexible business sites — with upkeep
Drupal Rare but severe core flaws; modules You / your team (on a tight clock) Complex, enterprise & high-compliance sites
Wix Your account; third-party apps; platform-wide incidents Wix (infrastructure); you (account) Simple sites wanting low maintenance
Squarespace Your account & DNS; platform operations Squarespace (infra); you (account) Design-forward simple sites (MFA on)
Static / Jamstack Build pipeline, dependencies, third-party scripts You (dependencies); host (CDN) Brochure/blog sites with technical skill
AI-built (vibe coding) Insecure generated code (45–70%); host platform Whoever reviews the code — often no one Prototypes; risky for unreviewed production

Where website security risk concentrates by platform, and who is responsible for it.

Platform by platform

WordPress — the power-and-responsibility platform

WordPress runs about 43% of the web, which makes it the single biggest target for automated attacks. Its core is genuinely secure — only six low-risk core vulnerabilities in all of 2025. The risk is the plugin ecosystem every business site accumulates: 91% of WordPress vulnerabilities in 2025 were in plugins, and for the most heavily targeted flaws, the weighted median time from public disclosure to mass exploitation was about five hours. You (or whoever maintains your site) are responsible for keeping all of it patched.

Best for: businesses that want full control, ownership, custom functionality, and SEO flexibility — provided someone actually maintains it.

Drupal — fewer vulnerabilities, heavier when they hit

Drupal has a far smaller footprint than WordPress, a more curated module ecosystem, and one of the oldest, most disciplined security teams in open source. That means fewer vulnerabilities overall. But when a core flaw does land, it can be severe and exploited fast: Drupalgeddon2 in 2018 was an unauthenticated remote-code-execution bug, and despite a week’s advance warning, an estimated 115,000 sites were compromised within 48 hours of the exploit going public. You’re responsible for patching, on a tight clock.

Best for: complex, high-compliance, enterprise or government sites with a technical team — usually overkill for a small business.

Wix — hand the servers to the vendor

Wix is closed and fully hosted: Wix runs the servers, the patching, and the DDoS defense, so there are no plugins or server software for you to update, and your day-to-day attack surface is small. The trade-off is that your risk shifts to three places you do control or add: your account (passwords, phishing, two-factor authentication), the third-party apps you install, and “shared fate” — when the platform itself has a flaw, every site on it is exposed at once. In mid-2025, a critical authentication-bypass in Base44 (Wix’s AI app builder) briefly let attackers reach private applications across its shared infrastructure; Wix patched it within 24 hours.

Best for: simple sites where low maintenance matters more than deep control.

Squarespace — same model, and a lesson about your account

Squarespace is also closed and hosted, with the vendor handling infrastructure security. Its cautionary tale is about the other half of hosted risk: on these platforms, your account is your security perimeter. In July 2024, after Squarespace absorbed roughly 10 million domains from Google Domains, the migration left multi-factor authentication disabled and accounts claimable by email — and attackers seized about a dozen high-profile domains, repointing their DNS to cryptocurrency-drainer phishing pages. The site code was never “hacked”; the accounts and DNS were.

Best for: design-forward simple sites — with Multi Factor Authentication turned on, non-negotiable.

Static / Jamstack — the smallest attack surface

A static site is a set of pre-built files served from a CDN — no database, no server-side code running on each request, no plugins. That eliminates the entire category of injection and plugin-vulnerability attacks that dominate WordPress and Drupal, and there’s almost nothing to patch. But the risk doesn’t vanish; it moves upstream to the build pipeline and its dependencies. 2025 was a brutal year there: the self-propagating Shai-Hulud npm worm and hundreds of thousands of new malicious packages showed how a single poisoned dependency can inject code into a built site or steal secrets during the build. Client-side third-party scripts (forms, analytics, chat widgets) and your host/DNS account are the other exposures.

Best for: brochure and blog sites where you have — or hire — technical skill; a poor fit for booking systems, memberships, or e-commerce without bolting on APIs that re-add attack surface.

AI-built (vibe coding) — fastest to ship, least predictable

Describe a site in plain English and an AI tool builds it. It’s astonishingly fast — and, on current evidence, insecure by default. Veracode’s 2025 study of more than 100 models found that 45% of AI-generated code failed basic OWASP security tests (Java was worst, around 72%); the Cloud Security Alliance put the figure at 62%, and Checkmarx as high as 70%. Carnegie Mellon found that while about 61% of AI-generated code works, only roughly 10% passes a security review. The failure mode is consistent: the AI optimizes for “it runs,” not “it’s safe,” and the person prompting it usually can’t tell the difference — a well-documented false sense of security. AI-built sites also inherit the shared-fate risk of whatever platform hosts them.

Best for: prototypes and internal experiments; risky as an unmonitored, public-facing business site unless a competent human security-reviews the output.

Connect4 Tip

The platform question is really a maintenance question. “Which is most secure?” almost always resolves to “which one has a competent human keeping it patched and its accounts locked down?” Choose your platform for control and fit — then make sure someone actually owns the upkeep. A neglected site is a liability on any platform; a maintained one is safe on nearly all of them.

So which should you choose?

Match the platform to three things: how much control and custom functionality you need, who is going to maintain it, and your tolerance for risk. In practice:

  • Simple site, no maintainer, want hands-off — a hosted builder (Wix or Squarespace) with MFA turned on is a legitimate, reasonably secure choice.
  • Business site needing custom features, integrations, SEO, and ownership — WordPress with a care plan gives you the most power without the exposure that comes from neglect.
  • Content or brochure site, technical skill available, security and speed are priorities — static / Jamstack, with disciplined dependency hygiene.
  • Complex, enterprise, or government site — Drupal, with a technical team on a fast patch cadence.
  • AI-built — great for a fast first draft; don’t ship it to production handling real customer data until a human has security-reviewed it.

What you can do right now (any platform)

  • Turn on multi-factor authentication everywhere — your site login, your host, and especially your domain registrar. It works on every platform and closes the most common door.
  • Inventory what you’re actually running — plugins, modules, dependencies, and every third-party script embedded in your pages. You can’t secure what you haven’t listed.
  • Delete what you don’t use. Every unused plugin, module, or dependency is attack surface you can remove for free.
  • Confirm backups exist and that you can restore one. An untested backup is a hope, not a plan.
  • If your site was AI-built or inherited, get the code security-reviewed before it handles customer data.

Where Connect4 can help

The platform you’re on matters less than whether someone competent is keeping it secure. That’s the part we own.

  • Platform selection matched to your real needs — an honest recommendation based on your functionality, budget, and who will maintain it, not a one-size pitch.
  • Managed maintenance and virtual patching for WordPress, so updates and protection operate on the same timeline the threats do.
  • Secure migrations between platforms — done with MFA and DNS handled correctly, so you don’t repeat the 2024 Squarespace mistake.
  • Security review of AI-built or inherited sites before they go live with real data.
  • Ongoing monitoring, backups, and hardening rolled into a monthly care plan, so nothing is ever neglected long enough to become a vulnerability.

Frequently asked questions

Which website platform is the most secure?

There’s no single answer — security risk relocates rather than disappears. Static sites have the smallest server-side attack surface, hosted builders like Wix and Squarespace offload infrastructure security to the vendor, and WordPress and Drupal give the most control but require active patching. The safest platform is the one that’s competently maintained.

Is WordPress less secure than Wix or Squarespace?

Not inherently. WordPress core is very secure; its risk is unmaintained plugins plus being the web’s biggest target. Hosted builders reduce your maintenance but shift risk to account security and platform-wide incidents. A maintained WordPress site and a hosted site with MFA are both reasonably safe.

Are static (Jamstack) sites really unhackable?

No. Removing the database and plugins eliminates most injection attacks, but the risk moves to the build pipeline and dependencies — npm supply-chain attacks like the 2025 Shai-Hulud worm — plus third-party scripts and your host/DNS account. Lower risk, not zero.

Is it safe to build my business website with an AI tool?

For prototypes, yes. For a live site handling customer data, be cautious: independent studies found roughly 45–70% of AI-generated code contains security flaws, and the tools consistently prioritize functionality over safety. Have the output security-reviewed before it goes live.

What’s the single most important security step, regardless of platform?

Enable multi-factor authentication on every account tied to your website and domain. On hosted and static platforms especially, your account is the perimeter — the 2024 Squarespace domain hijackings happened precisely because MFA was switched off during a migration.

The platform is a choice. Maintenance is the answer.

It’s tempting to look for a platform that makes security someone else’s problem forever. None exists. Hosted builders take the servers off your plate but hand you the account and the third-party apps. Static sites shrink the surface but hand you the supply chain. AI builds fast but hands you code no one has checked. WordPress and Drupal give you the most control and hand you the responsibility that comes with it.

So choose your platform for fit — the control, functionality, and ownership your business actually needs — and then make sure the upkeep has an owner. That single decision does more for your security than any logo on your tech stack. If you’d like help picking the right platform, or keeping the one you have locked down, that’s exactly what we do.

5 Hours to Exploit: The Terrifying Speed of Modern WordPress Attacks

/in , , /by

In short:  For the WordPress flaws attackers target most, the median time from public disclosure to mass exploitation is now about five hours — and 46% of vulnerabilities have no patch available the day they’re disclosed. Weekly update cycles no longer match the threat. Continuous monitoring and virtual patching do.

Five hours: the new normal

Five hours. According to Patchstack’s State of WordPress Security in 2026 report, that’s the weighted median time — for the most heavily targeted vulnerabilities — between a flaw being publicly disclosed and the first wave of mass exploitation in the wild. Not five days. Not five weeks. Five hours.

A quick note on that number, because precision matters: five hours isn’t the average for every bug. It’s the weighted median for the flaws attackers actually pile onto — weighted by how intense the exploitation gets. The broader figure is nearly as sobering: about half of all high-impact vulnerabilities are exploited within 24 hours of disclosure. Either way, if your update strategy is “I’ll check on it this weekend,” you’re not operating on a schedule that matches the current threat environment.

How the botnet economy works

The botnets that exploit WordPress vulnerabilities are automated and always running. They don’t take weekends. They don’t wait for business hours. They continuously scan millions of sites, comparing installed plugin versions against a database of known vulnerabilities, and they begin exploitation the moment a viable target is identified.

The economics are what make this dangerous for small sites. When the cost of attacking a target approaches zero, even low-value targets — a solo therapist’s website, a small non-profit — are worth exploiting. You don’t have to be important to be attacked; you just have to be reachable. By one estimate drawing on Patchstack’s data, roughly 13,000 WordPress sites are compromised every day.

91% of the risk lives in your plugins

WordPress core is maintained by a large, well-resourced team with a strong security track record. In all of 2025, only six vulnerabilities were reported in WordPress core — all of them low-risk. The danger lives in the ecosystem of plugins that most business websites accumulate: contact forms, gallery tools, SEO plugins, booking systems, event calendars. Patchstack found that 91% of new vulnerabilities in 2025 were in plugins.

Two numbers make the plugin problem worse than it first sounds. First, 43% of these vulnerabilities can be exploited with no login at all — any anonymous bot can trigger them. Second, 46% had no patch available on the day they were disclosed. And Patchstack found that premium plugins and themes were associated with roughly three times as many known-exploited vulnerabilities as free ones — paying for a plugin is not the same as it being safe.

The silent infection: what modern hacks look like

Modern attacks rarely crash your website — that would tip you off. Instead they work quietly:

  • They mine cryptocurrency using your server’s processing power, slowing your site and running up your hosting bill.
  • They create hidden admin accounts so they keep access even after the original hole is closed.
  • They inject invisible spam links that drag down your domain’s reputation and rankings with Google.
  • They harvest your client contact list and sell it.

You may not know you’ve been compromised for weeks — until your traffic mysteriously drops, a client calls to report something alarming, or Google adds a warning to your search listing.

Why weekly updates are no longer enough

The five-hour window breaks the traditional advice. “Keep your plugins updated” assumes you have days to react. For heavily targeted vulnerabilities, you often have hours — and a weekly or monthly cycle simply can’t move that fast. Patchstack puts it bluntly in the report: regular plugin updates are a second line of defense, but when attackers weaponize new vulnerabilities within mere hours, updates alone are not a viable defense.

There’s an even more uncomfortable wrinkle. Remember that 46% of vulnerabilities have no patch on the day they go public. In those cases there is literally nothing to update — the hole is known, actively scanned for, and the plugin is still broken. The only thing that protects you in that gap is a layer that can block the exploit before a fix exists.

Connect4 Tip

You can’t patch a hole that doesn’t have a patch yet — and 46% of the time, there isn’t one on day one. That single fact is the entire case for a WordPress-specific firewall that can block an exploit before the official fix exists. Updates are necessary. They’re just no longer sufficient on their own.

“Should I just use something other than WordPress, then?”

It’s a fair question — and the honest answer is: usually not for security reasons alone. Switching platforms tends to solve the wrong problem.

Start with what the data actually says. WordPress core isn’t the weak point — six low-risk vulnerabilities in a year is an excellent track record. The risk comes from two things: the open plugin ecosystem, and the fact that WordPress runs about 43% of the web, which makes it the single biggest target for automated attacks. Any platform that large and that open would attract the same swarm. Part of why you hear about WordPress vulnerabilities at all is that they’re publicly disclosed — which is a strength, not a weakness. The holes you never hear about on a closed platform don’t stop existing.

That said, hosted, closed platforms — Squarespace, Wix, Shopify — do have a real, honest advantage here: they manage server security and updates for you, and there’s a much smaller third-party plugin surface to go wrong. If you have a simple brochure site and you never want to think about maintenance, that’s a legitimate trade to make.

But it is a trade. In exchange you give up flexibility and custom functionality, deep control over SEO and performance, the ability to integrate the specific tools your business runs on, and — crucially — ownership. You don’t own the platform; you rent space on someone else’s. And hosted builders are not magic: they still get breached, and you’re still responsible for strong passwords, two-factor authentication, and the security of any third-party apps or integrations you bolt on.

The real bottom line is this: the problem isn’t WordPress, it’s unmaintained WordPress. A well-maintained WordPress site — tested updates, a WordPress-specific firewall, hardened logins, real backups — is secure and gives you power no hosted builder can match. A neglected one is a liability on any platform. If your website is a genuine business asset, migrating a working site purely out of security fear is an expensive answer to a question that ongoing maintenance already solves.

What you can do right now (no developer needed)

  • Turn on automatic updates for plugins, themes, and core at minimum. Auto-updates aren’t perfect, but for most small sites they beat a manual weekly cycle by days — and days are the whole game here.
  • Enable two-factor authentication on every admin account. With 43% of vulnerabilities needing no login, locking down the logins you do control is the highest-ROI ten minutes you can spend today.
  • Delete plugins you don’t use. Go to Plugins → Installed Plugins and remove anything inactive or abandoned. Every plugin you don’t need is attack surface you can eliminate for free.
  • Install a security plugin with a firewall. The free Wordfence Security plugin includes a firewall and malware scanner — turn both on and run a full scan.
  • Confirm your backups work. Make sure daily backups exist and that you’ve actually restored one. An untested backup is a hope, not a plan.

Where Connect4 can help

The do-it-yourself steps close the easy gaps. Closing the five-hour gap — reliably, around the clock, without you watching for it — is what a managed care plan is for.

  • Continuous vulnerability monitoring, not a weekly glance — automated systems that watch for new disclosures affecting your specific plugins as they happen.
  • Virtual patching via a WordPress-specific firewall that blocks a known exploit at the traffic level within hours of disclosure — covering you during the gap before the plugin developer ships a fix, including the 46% of cases where no fix exists yet.
  • Staging-tested updates applied fast, so patches go live quickly without risking your live site.
  • Real-time malware scanning with alerting, so a compromise is caught and remediated in hours — long before Google finds it for you.
  • A real 3-2-1 backup strategy — three copies, two media types, one off-site — with periodic restore tests.
  • All of it rolled into a monthly care plan, so security, performance, and updates are handled continuously rather than whenever someone remembers to log in.

Frequently asked questions

How fast are WordPress vulnerabilities exploited after disclosure?

For the most heavily targeted vulnerabilities, Patchstack’s 2026 report puts the weighted median time from disclosure to mass exploitation at just five hours. About half of all high-impact vulnerabilities are exploited within 24 hours, and 70% of heavily targeted ones within a week.

Why isn’t updating my plugins once a week enough?

Because attackers weaponize the most-targeted flaws within hours of disclosure, and 46% of vulnerabilities have no patch available on the day they’re disclosed. A weekly or monthly cycle assumes you have days to react — for high-priority flaws, you often have hours.

Should I switch to Squarespace, Wix, or another platform instead of WordPress?

Usually not for security reasons alone. WordPress core is very secure; the risk comes from unmaintained plugins and WordPress being the web’s biggest target. A maintained WordPress site is safe. Hosted builders reduce upkeep but trade away flexibility, ownership, and control.

What does virtual (real-time) patching actually mean?

Virtual patching uses a WordPress-specific firewall to block a known exploit at the traffic level within hours of disclosure — protecting your site during the gap before the plugin developer ships an official fix. It’s the layer weekly updates can’t provide.

How many WordPress sites actually get hacked?

Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, up 42% year over year, and by one estimate roughly 13,000 WordPress sites are compromised every day. The overwhelming majority trace back to plugin vulnerabilities, not WordPress core.

Speed is the whole game

The defining fact of WordPress security in 2026 is speed. The systems attacking your site are automated, tireless, and faster than any human update schedule can reliably beat on its own. You will not out-click a bot that starts working five hours after a vulnerability goes public — and you can’t manually patch a hole that has no patch yet.

The answer isn’t to panic, and it isn’t to abandon the platform that runs 43% of the web. It’s to put protection in place that operates on the same timeline the threat does: continuous monitoring, virtual patching, and fast, tested updates. If you’d rather not spend your evenings racing botnets, that’s exactly what a care plan is for.

The WordPress Security Crisis: Why Outdated Plugins Are an Open Door

/in , , /by

In short:  Outdated plugins are the number-one way WordPress sites get hacked. In 2025, 91% of newly discovered WordPress vulnerabilities were found in plugins — not in WordPress itself — and the most-targeted flaws are attacked within about five hours of being disclosed. Keeping plugins updated (or virtually patched) is the single biggest thing that keeps a small-business site safe.

The threat landscape has changed

WordPress powers roughly 43% of all websites on the internet — which also makes it the single most-targeted web platform in the world. The mental image of a hacker hunched over a keyboard in a dark room is badly out of date.

In 2026, the attacks aimed at your website are run by botnets: networks of thousands of compromised computers running automated scripts that scan millions of WordPress sites per hour. Each script compares the plugin versions installed on your site against a constantly updated list of known vulnerabilities. Your site isn’t chosen. It’s found — the way a burglar walking down a street doesn’t pick a house so much as notice the one with an unlocked window.

And the window between a vulnerability being made public and the first attempt to exploit it is now measured in hours. According to Patchstack’s State of WordPress Security in 2026 report, roughly half of high-impact vulnerabilities are exploited within 24 hours of disclosure, and the most heavily targeted flaws are often hit within about five hours.

Just how bad is it? The 2026 numbers

The scale of the problem is easy to underestimate. Patchstack — one of the WordPress ecosystem’s primary vulnerability-intelligence providers — documented 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42% jump over the year before. Here’s the part that matters most for site owners:

  • 91% of those vulnerabilities were in plugins. Only six were in WordPress core, and all six were low-risk.
  • 43% could be exploited with no login required — meaning any anonymous visitor (or bot) can trigger them.
  • Nearly half had no patch available on the day they were disclosed. The flaw goes public before the fix does.

That last point is the one most people miss. You can be a diligent site owner who applies every update the moment it appears and still be exposed during the gap between “everyone now knows about this hole” and “the developer has shipped a fix.”

Why plugins are the primary attack surface

Think of your website as a building. WordPress core is the steel frame — designed, stress-tested, and maintained by one large, well-resourced team with a strong security track record. That frame is solid.

Plugins are everything bolted onto the frame afterward: the side doors, the service entrances, the vents, the window latches. There are over 60,000 plugins in the official WordPress directory, built by developers ranging from full-time, security-conscious teams to solo hobbyists who may not have touched their code in a year. Every plugin you install is another door added to the building — and some of those doors were installed by contractors who’ve since gone out of business.

When a vulnerability is found in a popular plugin — a contact form, an events calendar, an SEO tool — and a patch is released, a race begins immediately. Sites on the current version get the fix. Sites one version behind are the unlocked doors the botnets are already walking down the street looking for.

What a successful attack actually looks like

The most damaging modern attacks don’t crash your site or deface it with obvious graffiti. That would tip you off. Instead, they work quietly:

  • Malware redirects silently send your visitors — especially the ones arriving from Google — to fraudulent or harmful sites.
  • Hidden admin accounts are created so the attacker keeps access even after the original hole is closed.
  • Invisible spam links are injected into your pages, which drags down your domain’s reputation with Google.
  • Your server’s resources get quietly hijacked to mine cryptocurrency or blast out spam email.

You may not notice any of it for weeks — until your traffic mysteriously craters, or a client calls to say your website “did something weird” on their phone.

The blacklist effect: instant traffic death

Google’s Safe Browsing system continuously scans billions of pages for malicious code. When it finds harmful code on your domain, it slaps a warning — “Deceptive site ahead,” “This site may be hacked,” or “The site ahead contains malware” — on every browser and every search result pointing to you. Your organic traffic drops to near zero, immediately.

Here’s the good news, and an important correction to a common myth: getting removed from the blacklist is usually fast. Once the malware is genuinely and completely cleaned up, you request a review in Google Search Console, and Google typically clears the warning within 24 to 72 hours (up to a week or two in complicated cases).

Here’s the catch: that’s just the warning coming down. Rebuilding the search traffic and rankings you lost is a separate, slower process that can take several weeks to months — and Google limits repeat offenders to one review request every 30 days, so you don’t get many chances to get the cleanup right. The lesson isn’t “recovery is impossible.” It’s that the cleanup has to be thorough the first time, and the traffic damage outlasts the red screen by a wide margin.

Prevention vs. recovery: the math is clear

Recovering from a hack that reaches the blacklist stage costs far more than preventing one. Add up the developer remediation time, the lost revenue during the blacklisted stretch, the weeks of suppressed rankings while search traffic claws its way back, and the trust you have to rebuild with clients — and it compounds fast.

The monthly cost of professional maintenance is a small fraction of the expected annual cost of a single serious breach. And that math tilts further toward prevention the larger and more established your business is, because you have more traffic and more revenue to lose in the window where your site is dark.

Connect4 Tip

The cheapest security fix you’ll ever make is the one you make before anything breaks. If your site earns you leads, bookings, or sales, treat maintenance the way you treat business insurance — a small, predictable cost that exists specifically so a bad day doesn’t become a bad quarter. The goal isn’t to react faster than the bots. It’s to never be the unlocked door in the first place.

What you can do right now (no developer needed)

  • Apply your pending updates today. Log in to your WordPress dashboard and update plugins, themes, and core — one at a time, checking the site after each.
  • Hunt for abandoned plugins. Go to Plugins → Installed Plugins and flag anything not updated in over a year. Abandoned plugins are a top source of unpatched holes — research whether each is still actively maintained, and replace the ones that aren’t.
  • Install a security plugin. If you don’t have one, the free Wordfence Security plugin is a solid starting point. Run a full scan and review the results.
  • Turn on two-factor authentication for every admin account. Given that 43% of vulnerabilities need no login at all, hardening the logins you do control is the highest-ROI ten minutes you can spend today.
  • Confirm your backups. Make sure your hosting plan includes automatic daily backups — and that you actually know how to restore from one. A backup you’ve never tested is a hope, not a plan.

Where Connect4 can help

Doing the basics yourself closes the easy doors. Closing the hard ones — reliably, week after week, without you thinking about it — is what a managed care plan is for.

  • Managed, tested updates. We apply plugin and core updates in a staging environment first, so an update never breaks your live site — and so you’re never sitting a version behind while the bots go hunting.
  • WordPress-specific protection and virtual patching. This one matters more than it used to. In Patchstack’s 2026 testing, standard hosting and edge firewalls blocked only about 12% of actively exploited WordPress vulnerabilities. Generic firewalls aren’t enough. We deploy protection built for WordPress specifically, including virtual patching that shields you during that dangerous gap between a flaw going public and the developer shipping a fix.
  • Real-time malware scanning with alerting, so a compromise is caught and remediated in hours — long before Google’s Safe Browsing scanner finds it for you.
  • A real 3-2-1 backup strategy — three copies, two types of media, one off-site — with periodic restoration tests, because a backup that hasn’t been restored has never actually been proven to work.
  • Login hardening across the board: rate limiting, enforced two-factor authentication, brute-force blocking, and admin-URL obscuring.

Frequently asked questions

Are outdated WordPress plugins really a security risk?

Yes. In 2025, 91% of newly discovered WordPress vulnerabilities were found in plugins, according to Patchstack. Once a flaw is disclosed, automated bots begin exploiting it within hours, so sites running older plugin versions are exposed almost immediately.

How quickly do hackers exploit a known WordPress vulnerability?

Very quickly. Patchstack’s 2026 report found that about half of high-impact vulnerabilities are exploited within 24 hours of disclosure, and the most heavily targeted flaws are often attacked within roughly five hours.

How long does it take to recover from a Google Safe Browsing blacklist?

After the malware is fully removed, Google’s Safe Browsing review usually clears the warning within 24 to 72 hours. Restoring the search traffic and rankings you lost is a separate process that can take several weeks to months.

Do I still need extra security if my host already has a firewall?

Usually yes. In Patchstack’s 2026 testing, standard hosting and edge firewalls blocked only about 12% of actively exploited WordPress vulnerabilities. WordPress-specific protection and virtual patching close the gap while plugin developers work on official fixes.

What is the single most effective thing I can do to secure my site today?

Enable two-factor authentication on every administrator account and turn on managed, tested plugin updates. Together they close the two most common entry points: stolen logins and known, unpatched plugin flaws.

Don’t wait for the red screen

The uncomfortable truth about WordPress security is that the systems attacking your site are automated, tireless, and faster than any human update schedule can reliably beat on its own. You will not out-react the bots. But you don’t have to — you just have to not be the unlocked door. Tested updates, WordPress-specific protection, real backups, and hardened logins turn your site from an easy target into one the automated scripts skip over on their way to the next one.

If you’d rather not spend your week thinking about any of this, that’s precisely what a care plan is for. Let’s make sure the next security headline is someone else’s problem.