The Good

WordPress is the most popular CMS on the Internet.

WordPress is the world’s most popular content management system powering 34% of all websites on the internet. On top of that: WordPress has a 60.8% market share in the CMS market. WordPress powers 14.7% of the world’s top websites. 

It has a well-developed toolset and a huge variety of plugins and a large community of developers ready to customize your site from end-to-end. It is easy to see why so many companies choose WordPress as their go-to CMS.

The Bad

WordPress is an attractive target for hackers. Its sheer popularity means that once a program is written to infiltrate one website, it can be used on thousands of websites. Many WordPress website owners don’t follow basic security practices such as frequent admin password updates, running plugin software updates, and keeping WordPress up to date. These things require a certain amount of technical acumen that many business owners may not possess.

Data shows that at least 30,823 out of 42,106 identified WordPress websites have exploitable vulnerabilities. This means that 73.2% of the most popular WordPress installations are vulnerable.

The Ugly

What would a hacker want to do with your WordPress website? Many website owners are surprised to learn that their CMS is a target at all. Hackers are after a few things when they target a WordPress website:

• Customer Data: Stolen customer data can be monetized in various malicious ways.
• Malicious Software: The web server can run malicious software and host content to serve the needs of hackers
• Deface the Website: Some hackers are hired by competitors to deliberately deface the website or take it offline.
• SEO Spam: Hackers may leverage your website to improve their SEO rankings. They may host pages on your domain and point links to their website.
• Email Spam: Hackers may turn your website into a mail server and send malicious emails to various contact lists. This can result in your domain being blacklisted.

How to Stop It

The best way to stop WordPress websites from getting hacked is to follow strict security protocols.

• Run WordPress Updates: You should strive to remain on the latest version of WordPress
• Run Plugin Updates: Keep your plugins up to date; roll back updates only if you have issues with your site afterward.
• Update Passwords: Keep tight control of your admin passwords, and ensure that you update your password regularly.
• Remove Unused Accounts: Remove un-used user accounts

How to Make It Easy & Affordable

In 10+ years of building WordPress websites, we find that the easiest way to maintain high security, performance and keep everything up-to-date is to host with WP Engine. All accounts at WP Engine have WordPress updates run automatically. Plugin Updates can also be handled by an automated service at WP Engine that updates the plugin, and then checks to see if there issues with the site as a result, and then rolls back only if needed. These two features make it easy to keep WordPress sites updated and secure. Additionally WP Engine hosting comes with development, staging, and production environments and includes nightly backups.

WP Engine’s Smart Plugin Manager is available on all Hosted Plus Plans.