WordPress security myths, and why outdated plugins matter

Most WordPress sites are not hacked through WordPress itself. They are hacked through plugins and themes that were not updated, or were abandoned by their developers. Several popular beliefs about WordPress security point people at the wrong problem: the core software, a security plugin, a hidden login page. This article tests seven of those beliefs against the evidence and shows how to tell when a plugin has become a risk.

Where WordPress security problems actually come from

The security company Patchstack, which tracks WordPress vulnerabilities, counted 11,334 new ones in 2025. 91% were in plugins, 9% in themes, and six were in WordPress itself. Wordfence, another WordPress security company, found the same pattern in 2024: 96% of disclosed vulnerabilities were in plugins.

The reason is simple. WordPress core is one piece of software with a large security team behind it. The plugin directory alone holds tens of thousands of plugins, each maintained, or not, by a different developer.

Myth: WordPress itself is insecure

WordPress is run with security in mind. Its security team has more than 50 experts, and since version 3.7 WordPress installs minor and security releases automatically in the background. The team can push an urgent fix to millions of sites without the owner doing anything.

Core is not perfect. In 2026 three serious flaws in WordPress itself were fixed and later listed by the US cybersecurity agency CISA as exploited in the wild. For the first of them, WordPress forced the update out through the automatic update system. The lesson is not that WordPress is unsafe. It is that automatic core updates should stay switched on, because they are what closed those flaws on most sites.

Myth: my site is too small to be a target

WordPress's own hardening guide says that many attacks are carried out by bots, without a person choosing the target. They scan for sites running a plugin with a known flaw, or try common passwords on every login page they find.

Speed matters here. Patchstack found that about half of the most serious plugin flaws were attacked within 24 hours of being made public.

Myth: a security plugin keeps me safe

A security plugin is useful, but it is one layer. It runs inside WordPress, so it only starts working after the request has already reached your site's code. Patchstack tested common firewalls against real WordPress plugin exploits in 2025 and found they blocked only a minority. Patchstack sells its own protection, so read that figure as its research, but the WordPress documentation reaches the same conclusion by another route: risk can never be reduced to zero, so plan for recovery as well as prevention.

The most important step, in WordPress's own words, is keeping WordPress, plugins and themes up to date and choosing ones that are actively maintained.

Myth: hiding the login page is enough

Moving the login page from /wp-admin to a secret address cuts down on automated password guessing. WordPress's guidance says it "can reduce noise" but should not be your only defence, and calls security through obscurity an unsound primary strategy.

Most of the ten most attacked plugin flaws of 2025, in Patchstack's count, did not need a login at all. The attacker sends a crafted request straight to the vulnerable plugin. For the login itself, use a strong unique password and two-factor authentication. Our help article covers two-factor authentication in WordPress.

Myth: a deactivated plugin cannot hurt

Deactivating a plugin stops WordPress loading it. The files stay on the server, and a plugin's files can often be requested directly by their web address. That is why the plugin developer handbook tells developers to block direct access to their files, and why WordPress's hardening guide says to delete any plugin you are not using.

It has happened. In 2020 a flaw in a file manager plugin let attackers upload and run their own code through a single file inside the plugin's folder, and it was exploited widely before sites updated. Deleting unused plugins and themes removes that risk entirely. See how to deactivate and delete a WordPress plugin.

Myth: premium themes are safer, and nulled copies are fine

Paying for a plugin does not make it safer. Patchstack found that premium plugins and themes had three times as many known exploited flaws as free ones, because fewer independent researchers examine code they cannot download freely.

"Nulled" copies, premium plugins and themes shared for free with the licence check removed, are worse. The security company Sucuri downloaded a nulled theme from a top search result and found a hidden backdoor that could disable security plugins and send out the site's database password. Nulled copies also never receive updates. Install plugins and themes only from the WordPress.org directory or the developer's own site.

Myth: updates break sites, so it is safer to wait

Updates occasionally break something. Waiting is still the bigger risk. Once a fix is published, the details of the flaw are, in WordPress's words, almost certainly in the public domain, and attackers use them against every site that has not updated. Patchstack found that six of the ten most attacked WordPress flaws in 2025 had been made public before 2025, on sites that had not been updated.

WordPress has made updating safer. Since version 6.3 it restores the previous version if a manual plugin or theme update fails, and since 6.6 it rolls back a failed automatic plugin update. A tested backup taken before each round of updates covers what those features do not.

How to tell a plugin has been abandoned

Patchstack found that 46% of the vulnerabilities disclosed in 2025 had no fix from the developer at the time they were made public. An abandoned plugin will never get one. Check each plugin's page on WordPress.org for these signs:

The last two are the most serious, and nothing we have found shows WordPress warning you in the dashboard when a plugin you have installed is closed. You have to look. Our guide on when to replace an outdated or abandoned plugin explains how to choose a replacement, and our help article on common WordPress security myths and the WordPress security checklist cover the rest.

Let Noiz keep it current

Most of these myths share one fix: update every week, and delete what you do not use. WordPress Care does the updating for you. Every week Noiz updates WordPress, themes and plugins with a restore point taken first and a rollback if an update breaks something, checks that the site and its key functions still work afterwards, scans for known plugin and theme vulnerabilities and patches them as fixes are released. If the worst happens, hack fix and recovery is included. Add it to a Noiz hosting plan from the client area, or order it for a site hosted elsewhere.

Sources

Checked 19 October 2026.

WordPress

• WordPress.org, Security
• WordPress Security White Paper (September 2025)
• WordPress Advanced Administration, Security
• WordPress Advanced Administration, Hardening WordPress
• WordPress Advanced Administration, Brute force attacks
• WordPress Advanced Administration, Upgrading WordPress
• WordPress.org, Plugin and theme auto-updates
• WordPress Plugin Handbook, Best practices
• WordPress Plugin Handbook, Plugin developer FAQ
• Make WordPress Core, Rollback for failed manual plugin and theme updates (6.3)
• WordPress 6.6 release
• WordPress 7.0.2 release and WordPress 7.1.2 release

Vulnerability data

• CISA, Known Exploited Vulnerabilities catalogue
• NVD, CVE-2020-25213 (File Manager plugin)
• Patchstack, State of WordPress Security in 2026
• Wordfence, 2024 Annual WordPress Vulnerability and Threat Report (PDF)
• Sucuri, The dangers of installing nulled WordPress themes and plugins
• Sucuri, WordPress security plugins: how to choose the right one

Noiz

• WordPress Care
• Help articles linked in the text, on docs.noiz.ie

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.