CentrioHost Blog

WordPress is, by far, the most popular way to build a website. That popularity has the unfortunate side effect of also making WordPress sites a juicy target for malicious actors all across the world. And that might have you wondering whether WordPress is secure enough to handle those attacks.

First – some bad news: Every year, hundreds of thousands of WordPress sites get hacked.

Sounds grim, right? Well…not really, because there’s also good news:

Hackers aren’t getting in due to vulnerabilities in the latest WordPress core software. Rather, most sites get hacked from entirely preventable issues, like not keeping things updated or using insecure passwords.

As a result, answering the question of “is WordPress secure?” requires some nuance. To do that, we’re going to cover a few different angles:

• Statistics on how WordPress sites actually get hacked, so you understand where the security vulnerabilities are.
• How the WordPress core team addresses security issues, so you know who’s responsible and what they are responsible for securing.
• If WordPress is secure when you follow best practices, so you know if your website will be safe.

How WordPress Sites Get Hacked (By The Data)

Ok, you know that plenty of WordPress sites are getting hacked each year. But…how is it happening? Is it a global WordPress issue? Or does it come from those webmasters’ actions?

Here’s why most WordPress sites get hacked, according to the data that we have…

Out-of-Date Core Software

Here’s an unsurprising correlation from Sucuri’s 2017 Hacked Website Report. Of all the hacked WordPress sites Sucuri looked at, 39.3% were running out-of-date WordPress core software at the time of the incident.

So right away, you can see a pretty close relationship between getting hacked and using out-of-date software. However, this is definitely an improvement over 61% from 2016. ?

According to the WPScan Vulnerability Database, ~74% of the known vulnerabilities they logged are in the WordPress core software. But here’s the kicker – the versions with the most vulnerabilities are all way back in WordPress 3.X:

But – unfortunately – only 62% of WordPress sites are running the latest version, which is why many sites are still unnecessarily vulnerable to those exploits:

Finally, you can see this connection once more with the major WordPress REST API vulnerability from February 2017 where hundreds of thousands of sites were defaced.

WordPress 4.7.1 contained multiple vulnerabilities that were eventually used to deface those sites. But…weeks before the vulnerabilities were exploited, WordPress 4.7.2 was released to fix all of those vulnerabilities.

All the WordPress site owners who hadn’t disabled automatic security patches or otherwise had promptly updated to WordPress 4.7.2 were safe. But those who didn’t apply the update weren’t.

Takeaway: The WordPress Security Team does a great job at quickly fixing issues in the WordPress core software. If you promptly apply all security updates, it’s highly unlikely that your site experiences any issues as a result of core vulnerabilities. But if you don’t, you take a risk once an exploit gets out into the wild.

2. Out-of-Date Plugins Or Themes

One of the things people love about WordPress is the dizzying array of available plugins and themes. As of writing this, there are over 56,000 on the WordPress repository, and thousands of additional premium ones scattered across the web.

While all those options are great for extending your site, each extension is a new potential gateway for a malicious actor. And while most WordPress developers do a good job of following code standards and patching any updates as they become known, there are still a few potential issues:

• A plugin or theme has a vulnerability and, because there aren’t as many eyes on it as the WordPress core software, that vulnerability goes undetected.
• The developer has stopped working on the extension but people are still using it.
• The developer quickly patches the issue, but people just don’t update.

So how big is the issue?

Well, in a survey from Wordfence of hacked website owners, over 60% of the website owners who knew how the hacker got in attributed it to a plugin or theme vulnerability.

Similarly, in Sucuri’s 2016 report, just 3 plugins accounted for over 15% of the hacked websites they looked at.

Here’s the kicker, though:

The vulnerabilities in those plugins had long since been patched – site owners just hadn’t updated the plugin to protect their site.

Takeaway: WordPress themes and plugins introduce a wildcard and can open your site to malicious actors. Much of this risk can be mitigated by following best practices, though. Keep your extensions updated and only install extensions from reputable sources.

We also have to mention these GPL clubs you might see floating around the internet where you can get any premium WordPress plugin or theme for just a couple dollars. While WordPress is licensed under GPL, which is awesome and one reason we love it, buyer beware. These are sometimes also referred to as nulled plugins.

Buying plugins from GPL clubs mean you’re trusting a third-party to grab the latest updates from the developer and a lot of times you won’t get support. Getting plugin updates from the developer is the safest route. Also, we are all about supporting developers and their hard work!

3. Compromised Login Credentials For WordPress, FTP, or Hosting

Ok, this one isn’t really WordPress’ fault. But a non-trivial percentage of hacks are from malicious actors getting their hands on WordPress login credentials, or the login credentials for webmasters’ hosting or FTP accounts.

In that same Wordfence survey, brute force attacks accounted for ~16% of hacked sites, with password theft, workstation, phishing, and FTP accounts all making a small, but noticeable, appearance.

Once a malicious actor gets the metaphorical key to the front door, it doesn’t matter how otherwise secure your WordPress site is.

WordPress actually does a great job mitigating this by automatically generating secure passwords, but it’s still up to users to keep those passwords safe and also use strong passwords for hosting and FTP.

Takeaway: Taking basic steps to keep account credentials secure can prevent malicious actors from walking right in. Use/enforce strong passwords for all WordPress accounts and limit login attempts to prevent brute force attacks (Host SEO Hosting does this by default ?).

For hosting accounts, use two-factor authentication i