Here’s a fact that surprises most WordPress site owners: WordPress itself is one of the safer platforms you could choose. In 2025, security researchers found just six vulnerabilities in WordPress core — the actual software. Six, across the entire year, for the platform running a huge share of the internet.
So if WordPress is that solid, why does “my site got hacked” remain one of the most common calls a web agency gets? Because almost nobody’s problem is WordPress. It’s everything they bolted onto it. Of the 11,334 new WordPress vulnerabilities discovered in 2025 — a 42% jump on the year before — 91% were found in plugins. Not the platform. The extras.
If you run a WordPress site and haven’t looked at your plugin list in a while, this is worth ten minutes.
Why plugins are the actual risk
Every plugin you install runs with real privileges inside your site — it can touch your database, your files, your customer data. And the ecosystem that makes WordPress so flexible (anyone can build and publish a plugin) is the same one that makes it risky: quality varies enormously, and a lot of the free plugins your site depends on are maintained by one person, in their spare time, for no money.
That shows up in the numbers. When researchers report a vulnerability to a plugin’s developer, more than half don’t patch it before the details go public — sometimes because the plugin is genuinely abandoned, sometimes because a free plugin earning nothing simply can’t justify a costly security fix ahead of paying client work. Either way, the vulnerability becomes public knowledge with no fix waiting, and the average WordPress site is running over 30 plugins at once — 30 separate pieces of software, of wildly varying quality, all with a key to your front door.
Why “just update everything” isn’t enough by itself
This is the uncomfortable part, and it’s worth knowing honestly rather than being told the reassuring version.
Patches often don’t exist yet. Close to half of all vulnerabilities disclosed in 2025 had no fix available from the developer at the moment they became public — so “we keep everything updated” can still leave you exposed, because there’s sometimes nothing to update to.
Speed is brutal. The median time between a vulnerability becoming public and the first real-world exploit attempt is around five hours. Automated bots are scanning the entire web for the specific flaw within the same afternoon it’s disclosed — long before most businesses even hear about it, let alone patch.
Even auto-updates aren’t a silver bullet. In April 2026, a supply-chain attack saw a batch of previously legitimate plugins compromised at the source and pushed out as routine updates — meaning some site owners were breached specifically because they had automatic updates switched on and trusted the source. Not a reason to turn updates off; a reason to understand that no single habit is a complete defence.
None of this means updating is pointless — it closes the 78% of hacks that Sucuri’s 2025 data found involved at least one outdated plugin. It means updating is necessary but not sufficient on its own.
What actually reduces the risk
A layered, boring, effective approach — the kind that quietly wins:
Audit your plugin list monthly, and be ruthless. For each plugin, ask: do we still use this? Was it updated recently? Does it have a healthy number of active installs and a responsive support history? There’s no magic number of plugins to aim for, but the principle is simple: five well-maintained plugins are safer than fifteen mixed ones. Every unused plugin — active or merely installed — is attack surface for nothing in return.
Delete, don’t just deactivate. A deactivated plugin or an unused theme still sits on your server as exploitable code; deactivating stops it running but doesn’t remove the files. If you’re not using it, remove it properly.
Vet before you install. Check the last-updated date, the number of active installations, and whether support requests actually get answered before adding anything new to your site. And watch for ownership changes — a well-known plugin quietly sold to a new owner is exactly the supply-chain pattern that bit sites in April.
Layer your defences, don’t rely on one. A web application firewall (we’ve written a full guide to picking one) blocks a meaningful share of attacks before they ever reach your vulnerable plugin code — genuinely useful given how many vulnerabilities have no patch yet. Pair it with monitoring or a managed security service that watches for the in-between moments no single update cycle catches.
Keep backups that you’ve actually tested. If the worst happens anyway, a clean, recent, restorable backup is the difference between an afternoon’s inconvenience and a genuine crisis. Only a minority of site owners, by industry surveys, have any real recovery plan at all — don’t be in that majority.
Know when DIY maintenance stops making sense. If updating your site feels like a chore you keep deferring, that deferral is exactly how sites end up on the wrong side of these statistics. A real cost comparison worth knowing: agencies report cleanup after a hack running into the thousands of dollars, against a fraction of that for a year of proactive, professionally managed updates. The unglamorous maintenance is the cheap option.
The takeaway
WordPress isn’t the risk. Your plugin list is — specifically, the plugins you forgot you installed, the ones nobody’s updated in two years, and the one you added for a single feature eighteen months ago and never removed. None of the fixes here are exotic. They’re the same unglamorous basics that show up in every security story we’ve told: know what you have, keep only what you use, layer your protection, and don’t assume any single habit — even updating — is a complete answer.
Where Oasis Web Asia comes in
We manage WordPress maintenance for Singapore SMEs properly: a lean, audited plugin list, tested backups, a web application firewall configured correctly, and updates handled on a schedule instead of “whenever someone remembers.” If your site has quietly accumulated a decade of plugins nobody remembers installing, we can take a look and tell you honestly what to keep, what to remove, and what’s actually putting you at risk — the same evidence-first web development Singapore SMEs trust us with.
If you just opened your plugins page and didn’t recognise half the list, that’s exactly the conversation we like to have.
Start a conversation → — get a free consultation with our Singapore-based team.