Is WordPress Secure?
WordPress can be secured, but its public runtime, plugins, database, and admin access all need care. Static delivery removes several of those components from ordinary page views.
Updated October 2026
Why WordPress Is a Security Target
WordPress is widely used, and its ecosystem gives attackers many sites and extensions to study. Core, themes, plugins, PHP, hosting, and accounts all need secure maintenance.
Plugins and themes are the main way in
Third-party plugins and themes add code, permissions, and update work. Keep only what you use, review the source, and apply security updates promptly.
Code runs on every request
WordPress executes PHP and queries a database on each page load, behind a public admin login. That means PHP vulnerabilities, SQL injection, and brute-force attacks on wp-admin all have something live to target.
Security is a maintenance treadmill
A WordPress security process covers core, extensions, PHP, hosting, accounts, backups, monitoring, and recovery. Each extra component needs an owner and an update routine.
One breach, real damage
A compromised WordPress site can be defaced, injected with spam or malware, used to phish your visitors, or knocked offline. Recovery can include restoring backups, removing injected pages, resetting credentials, and reviewing search visibility.
WordPress security in 2026
Security issues are a growing concern for WordPress site owners. As of October 2026, the 7.x releases alone have included these security updates:
- WordPress 7.0.2 July 2026
Fixed a critical SQL injection that could lead to remote code execution. WordPress forced automatic updates for affected sites.
- WordPress 7.0.3 August 2026
Twelve security fixes.
- WordPress 7.0.4 August 2026
Fixed remote code execution on sites using Imagick with Ghostscript, exploitable by a user with Author access or higher.
- WordPress 7.1.1 September 2026
Eleven more security fixes, which also affect the 7.0 branch.
Core is only part of it. Patchstack reports that about 91% of WordPress vulnerabilities reported in 2025 were in plugins (State of WordPress Security in 2026). Every plugin on a site is one more thing to keep patched.
A static site removes request-time components
Pagesmith generates a static Astro site served from Cloudflare's edge. Ordinary page views do not depend on a public WordPress runtime, database, plugin stack, or wp-admin login.
No plugins to exploit
There are no third-party plugins running on your site, so the single most common WordPress attack vector is absent from ordinary public page delivery.
No PHP on the live site
Pages are pre-rendered HTML, not code executed on every request. With no server-side runtime on the public site, PHP-specific attacks do not target the page-serving path.
No database to inject
Content is compiled into the site at build time. There is no live database serving the public pages, so the ordinary page-serving path has no WordPress database query to inject.
No public login to brute-force
There is no wp-admin on your live site. Editing happens in Pagesmith, not through a login page exposed as wp-admin. The Pagesmith account and collaborator access still need strong authentication.
No public WordPress stack to patch
You do not maintain WordPress core, plugins, or PHP for public page delivery. Pagesmith, third-party integrations, accounts, and any exported code still need security maintenance.
DDoS absorbed at the edge
Static files are served from Cloudflare's edge network. This gives the site a distributed delivery layer, though no provider can promise that every denial-of-service attack is harmless.
WordPress vs a Static Site: The Attack Surface
The same content, two very different security postures. Here's what an attacker can actually reach.
| Attack vector | WordPress | Static site (Pagesmith) |
|---|---|---|
| Plugin & theme vulnerabilities | Primary risk | No public WordPress plugins |
| Server-side code / RCE (PHP) | PHP runs on every request | No runtime on the live site |
| SQL injection | Live database | No database |
| Brute-force / login attacks | Public wp-admin | No public login |
| Security updates & patching | Core + plugins + PHP, ongoing | No WordPress stack |
| Security plugin / WAF needed | Recommended | Platform controls still apply |
| DDoS resilience | Depends on host | Distributed edge delivery |
No site is unhackable. A static site removes the vectors WordPress is most often breached through. Hosting and domain accounts, the build chain, third-party scripts, forms, and APIs still need protection.
Switch Without Losing Your Content
Paste your WordPress URL and choose Preserve to keep the current design or Enhance for a modern redesign. Pagesmith imports the homepage first, then the rest of your pages and posts from the sitemap. Follow the step-by-step WordPress migration guide.
Free to start. No credit card required. Code export is available on eligible plans.
WordPress Security FAQ
Is WordPress secure?
WordPress core is actively maintained, but a production site also includes themes, plugins, PHP, a database, hosting, and user accounts. Each component needs secure configuration and updates. A static public site can remove the request-time WordPress, PHP, database, and public admin stack from ordinary page views.
Why does WordPress get hacked?
Common risks include vulnerable extensions, outdated software, weak credentials, insecure hosting, and poor access controls. The exact cause varies by incident. WordPress sites need a regular process for updates, backups, account security, monitoring, and recovery.
Is a static site more secure than WordPress?
A static public site can have a smaller request-time attack surface. Pagesmith serves pre-built files without a public WordPress runtime, database, or wp-admin login. Domains, hosting accounts, build dependencies, forms, APIs, and other connected services still require security controls.
Do I still need security plugins and updates with Pagesmith?
No. A Pagesmith site has no WordPress plugins, core, or PHP runtime to update. Pagesmith runs the hosting, SSL, and platform updates for you, and forms come with built-in spam protection. Keep your Pagesmith login secure, as you would with any account.
Is a static site completely unhackable?
No. Static delivery removes several request-time components, but the site still depends on accounts, DNS, hosting, the build chain, third-party scripts, and any forms or APIs. Use strong authentication, limited permissions, monitoring, backups, and a recovery plan.
What about contact forms and dynamic features on a static site?
Pagesmith sites are static-first. Forms and other dynamic features use separate services or functions where needed. Those endpoints still handle untrusted input, so validate data, limit access, monitor abuse, and follow the security guidance for each service.
Can I move my existing WordPress site to Pagesmith?
Yes. Paste the public URL of your WordPress site and choose Preserve to keep the current design or Enhance for a modern redesign. Pagesmith imports the homepage first, then the rest of your pages and posts from the sitemap. Forms, galleries, an online store, and other plugin features are rebuilt by asking the AI.
Does a static site hurt SEO compared to WordPress?
No. Pagesmith sites are fast and SEO-friendly: crawlable HTML, page titles and descriptions, canonical URLs, structured data, and a sitemap. Titles and descriptions come with the import, and if a page address changes, the AI adds a 301 redirect from the old one.