Key Takeaways
- WordPress sites are unfortunate targets for cyberattacks, and outdated plugins are major drivers for these threats.
- Auto-updates are handy, but it’s also important to track what happens after they run.
- While some plugins may look good to install, they could be outdated, making them an easy target for hackers.
- We spoke with three industry experts — Alexander Gilmanov, Jaron Phillips, and Roger Williams — about how you can keep your WordPress site safe.
WordPress is the most powerful content management system in the world, serving as the backbone for more than 60% of websites on the internet.
While Shopify, Wix, and Squarespace follow WordPress’s lead, there’s one thing that makes the CMS number one: plugins.
WordPress plugins are among the most versatile, creative, and powerful tools available for customizing a website.
While other platforms offer add-ons, plugins are built specifically for the WordPress ecosystem rather than just integrating via an API.
Unfortunately, there’s one major challenge with plugins: Industry experts warn that outdated plugins are a prime target for cyberattacks.
So, we asked industry experts to weigh in on the best approaches to WordPress updates, security, and automation.
The Risk of Plugin Vulnerabilities in Numbers
- Around 90% of known WordPress vulnerabilities target plugins
- 52% of WordPress vulnerabilities are caused by outdated plugins
- WordPress sites face approximately 90,000 attacks per minute
- 75% of malicious files found on WordPress sites are generic malware
Research also shows that the average cost of a data breach for small businesses can reach $200,000. This includes expenses for recovery, loss of business, and legal fees.
One of the most notable WordPress breaches occurred in 2018.
Ironically, the WP GDPR Compliance Plugin, which is designed to help with GDPR compliance, had a vulnerability that allowed attackers to gain administrative access to WordPress sites.
And this happens every day: Just days ago, on April 1, hackers exploited the “Must-Use” plugin feature to hide malicious code.
Tip #1: Auto-Updates Are Useful — If You Keep an Eye on Them
Every site is susceptible to cybersecurity issues, but WordPress in particular is vulnerable as it doesn’t have centralized control over all its components, many of which are third-party.
It’s as Alexander Gilmanov, CEO of Amelia Booking Plugin, said:
“WordPress is the #1 tool to build websites today. With all the benefits, it means that it is also the #1 target for all the ‘bad guys.’”
He added: “They will do everything, try and find any hole or vulnerability to exploit, often in automated mode. And if they succeed in getting unauthorized access, it’s only a question of: How business-critical is the data they manage to access?”
Keeping your plugins up-to-date is the most straightforward way to prevent exploits — especially with automated updates for frontend checks and rollbacks.
Frontend checks ensure your site looks and works correctly after an update. They help catch any visual or functional issues that could affect the user experience.
If something does go wrong, a rollback lets you undo the update and restore your site to its previous state.
“Being able to use automation there is a superpower! And it’s especially useful that the frontend check and rollback are automated as well,” said Gilmanov. “It will save thousands of hours!”
Tip #2: Don’t Let a “Zombie Plugin” Take Down Your Site
From 2023 to 2024, there were nearly 6,000 reported WordPress vulnerabilities and 97% of them came from plugins, while 3% came from themes, according to a report by Patchstack.
Researchers also found that many WordPress plugins are “zombie plugins” — they may look new or updated, but in reality, they’re abandoned and packed with security risks.
Jaron Phillips, founder of WPhost, has seen this too.
“In all our years of managing the security of hundreds of WordPress websites, the primary entry point for malicious actors we’ve observed is through outdated plugins,” said Phillips.
He also warned that simply having security add-ons and packages isn’t enough to protect your site from outdated plugins or themes.
“Failing to update your plugins is like leaving your site’s front door wide open to hackers,” he said.
Manually updating is tedious, which is why many WordPress users opt for auto-updating.
But Phillips warned that auto-updating isn’t always the best solution either — if a new version conflicts with your site’s theme or other plugins, it could cause issues that are difficult to detect.
“If a failed plugin update takes your site down at 2 AM, you’re probably not going to find out unless a customer wakes you,” Phillips said.
“Managed WordPress hosting providers who manage your plugin updates for you won’t leave your site in a broken state displaying the white screen of death to the world.”
Instead, Phillips recommends opting for managed WordPress hosting:
“This monotonous, time-consuming task can be left to WordPress experts. You can get back to more important work and relax knowing that your site will always be up to date and online.”
Managed hosting is a service that lets your hosting provider take care of everything for you so you don’t have to handle updates, security, backups, and performance optimization yourself.
Tip #3: Let Tech Handle Updates (But Without the Risk)
Kinsta, a managed WordPress hosting provider, recently launched a service that automates plugin and theme updates.
It includes visual regression testing, scheduled updates, rollback protection, and per-plugin/theme controls, allowing users to enable or disable updates individually.
“As the WordPress ecosystem becomes more complex, every plugin and theme update carries both security importance and potential risk,” said Roger Williams, the community manager at Kinsta.
“Since WordPress doesn’t label updates as security-related, site owners must treat all updates as critical.”
A major driver behind this tool is that WordPress site security is shifting from a reactive approach to more proactive strategies.
Site owners no longer have to choose between updating immediately and avoiding site breakage; smart systems are able to bridge the gap.
“If anything looks off, the update is rolled back automatically and the site owner is notified,” said Williams.
“This system ensures speed, safety, and reliability — helping agencies, developers, and site owners protect their sites without constant manual oversight.”
