Santhrupti Shankar

What if you lose all the time, effort and money spent on your website to a security breach? Just think of the damage to your reputation as well as the financial loss if you become a victim of a ransomware or malware attack.

Is your website security giving you sleepless nights? Does the question “Is WordPress secure?” live rent-free in your mind? Then, read on, as we peel back the layers, to reveal the various factors which influence the answer. And, by the way, it’s not a simple “yes” or “no”. Let’s explore this further.

WordPress is a wildly popular website building platform used by more than 60 million websites, including 30.6% of the top 10 million websites. This makes it an extremely attractive target to malicious actors or hackers.

At its core, WordPress is robust and secure. Any security issues that arise are dealt with deftly by its team of developers, contributors and security experts. The actual issue, however, is that it’s rarely deployed in isolation. Its users often install plugins and themes to customise their WordPress websites. And, it is from here that the vulnerability stems.

What Affects WordPress Security?

WordPress is not invulnerable to security lapses. There are 3 main factors that impact its security:

1.  People involved in development
2. Budgetary allocation and
3. Time taken for development and testing

1. The people who actually build and maintain a WordPress Site

There are 3 broad categories into which you can put them:

  a. The Core WordPress Team

The WordPress Security Team comprises of highly-qualified, experienced and well-trained experts, both developers and researchers. To ensure that WordPress Security is top-notch, they are continuously engaged in developing new technologies, following security best practices, and finding and fixing security issues by releasing patches. Also, they follow a full disclosure policy. This means that every security issue found and fixed by their team is made public knowledge.

Despite this level of diligence, security lapses do occur. Remember the vulnerability of WordPress’ REST API which was exploited to deface 1.5 million pages in 2017? It was fixed by the WordPress developers in 6 days with the release of a high priority patch.

b. Plugins and Themes Developers

There are thousands of plugins and themes available to be used with WordPress. The WordPress Security Team isn’t directly accountable for their quality. Instead, there is a team of volunteers checking and testing these but that doesn’t guarantee fool-proof security.

Third parties like development companies or individual developers build and offer these plugins and themes either for free or for payment. If it’s a paid service then usually it has a team that maintains, examines and improves it periodically.

On the other hand, if it’s free, it’s probably offered by an individual developer who has a regular job. This is most likely a “side hustle”. So, ensuring high levels of security may not really be a priority due to lack of time and inclination.

c. Website Owners

Do you know what one of the most attractive things about WordPress is? Here’s the answer: WordPress makes it so easy to set up websites and you don’t even need to have superior technical knowledge and skills! The downside is that you now have people with a wide spectrum of technical abilities building websites. This means that the same quality and level of security can’t be maintained which, in turn, increases the likelihood that security issues may occur.

Additionally, website owners often adopt the “pay and forget” attitude. They just assume that security is automatically included in the development expenses that they have incurred. Moreover, they don’t realize just how much control they themselves have in enhancing WordPress security.

2. Budgetary allocation

A bigger budget doesn’t necessarily mean better security. However, it’s definitely a game changer.

WordPress, for example, is supported by investors pumping in millions of dollars. It’s the website development platform of choice for large corporations like TechCrunch, BBC America, Bloomberg Professional, Microsoft News Center and Facebook Newsroom to name a few. A significant portion of this money is spent to power its growth and acquire the best developers to ensure top-notch quality.

Conversely, companies and developers don’t find it very lucrative to allocate lots of resources into the development of free plugins and themes. This adversely affects their quality and the level of security afforded by them. Only the “premium” versions have dedicated teams maintaining and monitoring their quality and security.

Besides, most owners are happy spending only a couple of hundred dollars on their website’s development and opt to use cheap/free plugins and themes. Tighter budgets mean lesser financial autonomy of developers and an increase in the chances that security will take a backseat.

3. Time taken for development and testing

WordPress follows a planned process of releases. Months are spent on reviews and beta testing. Dedicated WP testers spend all of their time in ensuring the security of core WordPress.

In contrast, plugins/themes operate in a highly competitive landscape where the race to build newer features often means the sacrifice of quality and lack of in-depth security audit, as necessitated by other widely-used software.

The budget dictates the time that a developer can spend in building a site. This means that sites are built quickly without the requisite thorough analysis. And, limited time also means that these sites do not undergo the same rigorous testing that is needed to ensure utmost security.

So, “Is WordPress Secure?”

Though WordPress and its team of contributors leave no stone unturned to ensure the security of your website, the surrounding ecosystem in which it’s deployed is sensitive to security challenges. Therefore, you need to follow good security practices like keeping all your themes and plugins up to date, uninstalling any plugins or applications that you are not using and scanning your WordPress website with a malware scanner like       . Additionally, you can subscribe to a service like            which will not only help you avoid these pitfalls, but also recover from them if you should find yourself at the receiving end of a security breach.