WordPress Maintenance Scores: A Global Snapshot from HeyPulso’s Scanner

At HeyPulso, our mission is to shine a light on the real-world security and performance posture of websites across the internet. We continuously scan domains to identify vulnerabilities, assess maintenance quality, and provide actionable insights. In our latest comprehensive analysis, we put 43,960 domains under the microscope, uncovering critical statistics about WordPress maintenance and security.

Our findings paint a concerning picture, particularly for the vast ecosystem of WordPress sites. While WordPress powers a significant portion of the web, our data indicates a widespread neglect of fundamental maintenance practices, leaving many sites vulnerable and underperforming.

Our Scanner’s Global Snapshot: Key Figures

Before diving into the specifics of WordPress, let’s establish the broader context of our scan:

• Total Domains Scanned: 43,960
• WordPress Sites Identified: 10,984
• SSL Adoption: 23,701 domains (53.9% of all scanned domains) had valid SSL certificates, a foundational security measure.
• Phishing Sites Detected: A concerning 238 domains were identified as active phishing sites, highlighting the constant threat landscape.
• Average Response Time: The average response time across all scanned domains was 1346ms, a metric heavily influenced by site maintenance and optimization.

These initial figures set the stage for a deeper exploration into the health of WordPress sites.

The Alarming State of WordPress Maintenance Scores

Out of the 10,984 WordPress sites identified, each was graded on a comprehensive maintenance score, ranging from A (excellent) to F (critical issues). The results are stark, revealing a significant deficiency in site upkeep across the board.

WordPress Maintenance Grade Distribution (10,984 Sites)

Grade	Score Range	Number of Sites	Percentage
A	80-100	57	0.5%
B	60-79	4,096	37.3%
C	40-59	5,561	50.6%
D	20-39	1,169	10.6%
F	0-19	101	0.9%

The most striking statistic is that only 0.5% of WordPress sites achieved an ‘A’ grade, signifying truly excellent maintenance. This means that out of nearly 11,000 WordPress sites, a mere 57 are operating at optimal levels of security, performance, and best practices.

The vast majority, over half (50.6%) of WordPress sites, landed in the ‘C’ category, indicating significant room for improvement across multiple maintenance aspects. When combined with ‘D’ (10.6%) and ‘F’ (0.9%) grades, it means 62.1% of WordPress sites are performing at a mediocre to critical level of maintenance. This widespread lack of proper upkeep directly translates into increased security risks, slower performance, and a poorer user experience.

Critical Security Header Deficiencies & XML-RPC Exposure

Beyond general maintenance scores, our scanner delved into specific security configurations, revealing critical vulnerabilities prevalent among WordPress sites. Security headers are a fundamental defense layer, yet they are alarmingly absent:

• Missing X-Frame-Options: A staggering 82.9% of WordPress sites were missing the X-Frame-Options header. This header prevents clickjacking attacks, where malicious sites embed your content to trick users into clicking hidden elements.
• Missing Content Security Policy (CSP): Even more concerning, 88.1% of WordPress sites lacked a Content Security Policy. CSP is a powerful security standard that helps prevent cross-site scripting (XSS) and other code injection attacks by specifying which dynamic resources are allowed to load.
• Missing HSTS (HTTP Strict Transport Security): 77.9% of sites were missing HSTS. This header forces browsers to interact with your site only over HTTPS, protecting against protocol downgrade attacks and cookie hijacking.

These missing headers represent glaring security gaps, leaving sites wide open to common web attacks. Furthermore, our scan found that 49.9% of WordPress sites had XML-RPC exposed. While XML-RPC can be useful for certain integrations, it has historically been a vector for brute-force attacks and DDoS amplification, making its exposure a significant security risk if not properly secured.

Popularity vs. Prudence: Top Plugins and Themes

The WordPress ecosystem thrives on its vast array of plugins and themes. Our scan also identified the most commonly used ones, offering insight into the software powering these sites. While popularity often indicates robust features, it also means a larger attack surface if these components are not kept updated.

Top 10 WordPress Plugins Found:

Rank	Plugin Name	Installations
1	Contact Form 7	3,152
2	Elementor	3,070
3	Elementor Pro	1,783
4	Revslider	1,055
5	Complianz GDPR	1,033
6	Cookie Notice	852
7	WooCommerce	837
8	WP Rocket	748
9	JS_Composer	726
10	Pojo Accessibility	661

Plugins like Contact Form 7, Elementor, and WooCommerce are staples for many WordPress sites, offering essential functionality. However, the presence of plugins like Revslider (Slider Revolution), which has a historical record of significant vulnerabilities, underscores the critical need for constant updates and diligent maintenance. An outdated popular plugin can quickly become an open door for attackers.

Top 5 WordPress Themes Found:

Rank	Theme Name	Installations
1	hello-elementor	1,059
2	Divi	951
3	astra	611
4	twentyseventeen	287
5	oceanwp	201

Similar to plugins, popular themes like Hello Elementor, Divi, and Astra are widely used. While generally well-maintained by their developers, the responsibility falls on site owners to ensure their themes (and all other components) are always running the latest, most secure versions.

Where We Looked: A Geographic Lens on Our Scan Data

While our comprehensive scan graded 10,984 WordPress sites for maintenance, this particular dataset focuses on the overall landscape. A granular breakdown of WordPress maintenance scores by individual country requires further specific analysis. However, we can shed light on the geographical distribution of the 43,960 domains our scanner evaluated, providing context on where our observations originate.

Top Countries by Scanned Domains:

Country Code	Domains Scanned
FR	18,709
CL	8,743
US	1,247
ES	618
DE	281

These figures indicate the regions where HeyPulso’s scanner is most active, with a significant concentration of scans in France and Chile, followed by the United States, Spain, and Germany. While we cannot, from this specific data, isolate the maintenance scores of WordPress sites in France versus Chile, the overarching trends observed across all 10,984 WordPress sites – with a staggering 50.6% receiving a ‘C’ grade and only 0.5% achieving an ‘A’ – strongly suggest that these maintenance challenges are likely widespread. The issues of missing security headers and exposed XML-RPC are indicative of a global challenge for WordPress site owners, transcending geographical boundaries and highlighting a universal need for better security practices.

Performance and Threat Landscape: The Interconnected Impact

Poor maintenance isn’t just a security risk; it directly impacts user experience. An average response time of 1346ms suggests that many of these sites are not optimized for speed. Slow loading times deter visitors, impact SEO, and can reduce conversion rates. This performance lag is often a direct symptom of neglected maintenance, such as unoptimized databases, outdated software, or inefficient hosting configurations.

The detection of 238 phishing sites within our scanned domains further underscores the severity of the threat landscape. Compromised WordPress sites are frequently leveraged by attackers to host malicious content, including phishing pages, distributing malware, or launching further attacks. Regular maintenance, including security audits and timely updates, is the first line of defense against such exploitation.

Conclusion: The Urgent Call for Better WordPress Maintenance

Our scan data reveals a critical need for improved WordPress maintenance across the board. The alarmingly low percentage of ‘A’ graded sites, coupled with pervasive security header deficiencies and exposed XML-RPC interfaces, indicates that a significant portion of the WordPress ecosystem is operating at elevated risk.

These findings are not isolated to a particular region or specific type of site; they represent systemic challenges that demand immediate attention from site owners, developers, and hosting providers alike. Prioritizing regular updates, implementing robust security configurations, and conducting routine performance checks are no longer optional – they are essential for the integrity and security of the web.

Don’t let your WordPress site become another statistic. Take control of your site’s health and security today. Visit https://heypulso.com for a free scan and discover how your WordPress site stacks up against these critical benchmarks. Identify vulnerabilities, improve performance, and ensure your online presence is secure and thriving.