The State of WordPress Security: Insights from HeyPulso’s Latest Scan

At heypulso.com, our mission is to illuminate the hidden vulnerabilities and maintenance pitfalls that plague the digital landscape. We empower domain owners with actionable insights to fortify their online presence. In our latest comprehensive scan, we analyzed a staggering 43,960 domains, providing a stark, data-driven snapshot of current web security postures, with a particular focus on the pervasive WordPress ecosystem.

Our findings reveal a landscape rife with fundamental security oversights, exposing countless websites to unnecessary risks. While WordPress powers a significant portion of the internet, our data suggests that many site administrators are falling short on critical security best practices. This report dissects the key statistics, offering a candid look at where the web stands and what needs urgent attention.

The WordPress Landscape: An Overview

Out of the 43,960 domains scanned by HeyPulso, we identified 10,984 active WordPress sites. This prevalence underscores WordPress’s dominance, but also highlights the immense attack surface it presents if not properly secured. The sheer volume means that vulnerabilities, especially in widely used components, can have far-reaching consequences.

One fundamental layer of security is SSL/TLS encryption. Our scan found that 23,701 domains (53.9%) across all scanned sites have a valid SSL certificate. While this is encouraging for just over half, it also means a significant proportion of sites are still transmitting data unencrypted, leaving users vulnerable to eavesdropping and data interception.

Geographically, our scans covered a broad spectrum, with the highest concentrations observed in:

• France (FR): 18,709 domains
• Chile (CL): 8,743 domains
• United States (US): 1,247 domains
• Spain (ES): 618 domains
• Germany (DE): 281 domains

This global distribution emphasizes that security challenges are universal, affecting domains regardless of their physical location.

Critical Gaps: Security Headers and Exposed Services

For WordPress sites, the implementation of robust security headers and the careful management of core services are non-negotiable. Yet, our data paints a concerning picture of widespread neglect in these foundational areas:

• Missing X-Frame-Options: A staggering 82.9% of WordPress sites were found missing the X-Frame-Options header. This omission leaves sites vulnerable to clickjacking attacks, where malicious actors can embed a legitimate site within an iframe on their own page to trick users into clicking hidden elements.
• Missing Content Security Policy (CSP): Even more alarming, 88.1% of WordPress sites lacked a Content-Security-Policy. CSP is a powerful security mechanism that helps prevent Cross-Site Scripting (XSS) and other data injection attacks by specifying which dynamic resources are allowed to load. Its absence is a significant vulnerability vector.
• Missing HSTS: The Strict-Transport-Security (HSTS) header was absent from 77.9% of WordPress sites. HSTS forces browsers to interact with a site only over HTTPS, mitigating SSL stripping attacks where an attacker downgrades a connection to insecure HTTP.
• XML-RPC Exposed: Nearly half of all WordPress sites, specifically 49.9%, had XML-RPC exposed. While XML-RPC has legitimate uses, it’s a frequent target for brute-force attacks and DDoS amplification, and often remains enabled even when not actively used, creating an unnecessary entry point for attackers.

These statistics highlight a systemic failure to implement basic, yet crucial, security configurations. Without these fundamental defenses, even well-maintained sites are operating with significant, easily exploitable weaknesses.

The State of Site Maintenance: A Grading Report

To provide a clearer understanding of overall site health and security posture, HeyPulso assigns a Maintenance Score to each WordPress site. This score reflects various factors, including updates, configuration, and adherence to security best practices. Our grading system (A-F) reveals a critical lack of proactive maintenance across the 10,984 WordPress sites we graded:

WordPress Maintenance Score Distribution

Grade	Score Range	Number of Sites	Percentage of Sites
A	80-100	57	0.5%
B	60-79	4096	37.3%
C	40-59	5561	50.6%
D	20-39	1169	10.6%
F	0-19	101	0.9%

Chart Description: A pie chart illustrating the distribution of WordPress Maintenance Scores, showing the vast majority falling into the ‘C’ and ‘B’ categories, with very few ‘A’ grades and a notable percentage in ‘D’ and ‘F’.

The data is stark: only a minuscule 0.5% of WordPress sites achieve an ‘A’ grade, indicating excellent maintenance and security practices. Conversely, over half (50.6%) languish in the ‘C’ category, signifying significant room for improvement, while another 11.5% fall into the ‘D’ or ‘F’ categories, representing sites with critical security and maintenance deficiencies. These low scores are often correlated with outdated software, unpatched vulnerabilities, and neglected security configurations, making them prime targets for malicious activity.

The Plugin Paradox: Popularity and the Attack Surface

WordPress’s extensibility through plugins is both its greatest strength and a significant security challenge. While plugins add functionality, each one also expands a site’s attack surface. Our scan identified the most frequently installed plugins, highlighting those that, due to their widespread adoption, represent high-value targets for attackers. A vulnerability in any of these could impact thousands of sites instantly.

Top 10 Most Frequently Installed WordPress Plugins

Plugin Name	Number of Installations
Contact Form 7	3,152
Elementor	3,070
Elementor Pro	1,783
Revslider	1,055
Complianz Gdpr	1,033
Cookie Notice	852
WooCommerce	837
WP Rocket	748
JS_Composer	726
Pojo Accessibility	661

This list comprises a mix of essential functionalities: form builders (Contact Form 7), page builders (Elementor, Elementor Pro, JS_Composer), e-commerce (WooCommerce), compliance (Complianz GDPR, Cookie Notice), and performance optimization (WP Rocket). While these plugins are indispensable for many, their ubiquity means that security vigilance is paramount. Attackers frequently scan for vulnerabilities in popular plugins, knowing that successful exploits can grant access to a vast number of sites. The presence of these plugins, especially on sites with low maintenance scores and missing security headers, creates a perfect storm for potential compromise.

Beyond Plugins: Themes and Core Foundations

Themes also play a critical role in WordPress security. They dictate a site’s appearance and can introduce their own vulnerabilities if not properly maintained or securely coded. Our scans identified the most popular themes in use:

• hello-elementor: 1,059 sites
• Divi: 951 sites
• astra: 611 sites
• twentyseventeen: 287 sites
• oceanwp: 201 sites

Like plugins, popular themes require diligent updates and security audits. An outdated or poorly coded theme can be as dangerous as a vulnerable plugin.

Global Threats and Performance Metrics

The digital threat landscape is ever-present. Our scanner detected 238 active phishing sites within the scanned domains, underscoring the constant battle against malicious actors attempting to defraud users. These sites often leverage compromised legitimate domains, further emphasizing the need for robust security measures.

Beyond security, site performance also impacts user experience and SEO. The average response time across all scanned domains was 1346ms. While not directly a security metric, slow response times can indicate poorly optimized sites, which often correlates with neglected maintenance – a factor that can indirectly impact security by deterring regular updates or monitoring.

Conclusion: A Call for Proactive Security

The data from HeyPulso’s 43,960-domain scan paints a clear picture: the WordPress ecosystem, while powerful, is operating with significant, systemic security deficiencies. From missing fundamental security headers and exposed services to widespread poor maintenance grades and the inherent risks of popular plugins, there’s an urgent need for improvement.

Website owners and administrators must adopt a proactive security posture. This includes:

• Implementing essential security headers (CSP, HSTS, X-Frame-Options).
• Disabling unused services like XML-RPC.
• Regularly updating WordPress core, plugins, and themes.
• Choosing reputable plugins and themes and monitoring them for vulnerabilities.
• Conducting regular security scans to identify and address weaknesses.

The findings are not meant to deter WordPress usage but to serve as a wake-up call. With proper attention to security best practices, the platform can remain a robust and reliable foundation for millions of websites.

Secure Your Site Today with HeyPulso

Don’t let your WordPress site become another statistic. Take control of your digital security and gain clear visibility into your site’s vulnerabilities and performance. HeyPulso offers comprehensive scanning and actionable insights to help you maintain a secure and efficient online presence.

Visit https://heypulso.com today to get a free scan of your domain and discover how you can fortify your website’s defenses.