WordPress is not the problem. Unmanaged WordPress is.

That distinction matters, because the platform is everywhere. According to W3Techs, WordPress is used by 39.6% of all websites and holds a 58.3% share of sites with a known content management system (data dated 22 October 2026). Popularity brings an ecosystem, a huge talent pool and low entry costs. It also brings attention from attackers.

This is a balanced look at what running a WordPress site really involves in 2026, and when it is still the right choice.

What the security data says

Patchstack's State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase over 2024. The most useful detail is where they sit:

  • 91% were in plugins and 9% in themes.
  • Only 6 were in WordPress core, all low priority.
  • 46% had no fix from the developer at the time of public disclosure.

So the core software is in decent shape. The risk comes from the third-party code you add around it. A typical business site uses a form plugin, an SEO plugin, a page builder, a slider, a cache plugin and a security plugin, each written by a different party with a different level of care.

Speed is the other uncomfortable number. The same report says the weighted median time from disclosure to mass exploitation for heavily exploited vulnerabilities was 5 hours, and that about half of high-impact vulnerabilities were exploited within 24 hours. A monthly "update day" is no longer fast enough on its own. The report also found that traditional hosting defences blocked only 12% of WordPress-specific vulnerability attacks in its first test, so you should not assume your host protects you automatically.

Plugin takeovers: a risk you cannot see

In April 2026, a supply chain incident showed a different kind of risk. Patchstack reported that a plugin portfolio called EssentialPlugin had been sold on Flippa in 2025, and that the new owner's first commit planted a backdoor. It sat dormant until 5 April 2026. Two days later, the WordPress.org Plugins Review team closed the plugins permanently and pushed a forced update to remove the backdoor.

TechCrunch noted that WordPress users are not notified when a plugin changes ownership. Reporting differs on the exact number of plugins affected (Patchstack lists 22 by name), but the lesson is stable: a plugin that was safe last year can be controlled by someone else today, and you will not be told.

For an owner, the practical takeaway is to keep the plugin list short and to know who maintains each one.

The ongoing costs nobody quotes

Most website quotes cover the build. WordPress adds recurring work after launch:

  • Updates and testing. Core, theme and every plugin need regular updates, ideally tested on a staging copy first. An update that breaks the checkout or contact form costs real money.
  • Security monitoring. Someone has to watch for disclosed vulnerabilities in your specific plugins and react within hours or days, not months.
  • Premium licences. Many useful plugins and themes renew annually. These add up quietly, and an expired licence often means no updates.
  • Backups and recovery. Backups only count if a restore has been tested.
  • PHP and hosting upkeep. WordPress runs on PHP, which has its own support calendar. Old plugins can block a PHP upgrade, leaving you on an unsupported version.
  • Performance drift. Each plugin tends to add scripts, styles and database queries. Sites that started fast often slow down over time as features accumulate. This is a pattern rather than a rule, and good development can prevent it.

None of this is unique to WordPress, but it is easy to underestimate because the first year feels cheap.

When WordPress is still the right choice

I do not recommend leaving WordPress by default. It is a strong fit when:

  • You publish content regularly (articles, news, resources) and several people need to edit without a developer.
  • Your needs are common: brochure site, blog, standard lead forms, a modest shop.
  • You want to avoid lock-in to a single agency, since many developers can take over a standard WordPress build.
  • You have a maintenance owner, whether in-house or a service provider, and a budget line for it.
  • Budget or time is limited and a proven, well-supported platform gets you live sooner.

A lean build that uses few plugins, a reputable theme, managed hosting and a real update routine can run safely for years.

When a custom build fits better

A custom or more bespoke approach tends to make sense when:

  • The site is really an application: bookings, memberships, quotes, dashboards or workflows that are being forced through stacks of plugins.
  • You rely on many overlapping plugins and each update feels risky.
  • You handle sensitive data or have strict compliance needs.
  • Performance directly affects revenue and you need tight control over what loads.
  • The website needs to connect cleanly with your internal systems.

Custom is not automatically more secure. Any code needs maintenance, and a poorly built system is worse than a well-maintained WordPress site. The real advantage is a smaller, deliberate surface: only the code your business needs, with a clear owner for every part.

A quick self-check

If you run WordPress today, these five questions tell you a lot:

  1. How many plugins are active, and could you name what each one does?
  2. When was the last update applied, and who applied it?
  3. Do you have a staging copy and a tested backup restore?
  4. Which PHP version does the site run, and is it still supported?
  5. Who is responsible if a plugin you use is reported as vulnerable tomorrow morning?

If several answers are "I am not sure," the site is not necessarily at risk, but it is unmanaged.

Where I can help

If you want an outside opinion on whether your site should stay, be cleaned up or be rebuilt, start with the free Digital Business Audit. If your site is really trying to be a system, my page on business systems explains how I think about it.

Sources