The Unseen Vulnerabilities: A Deep Dive into WordPress Security Header Adoption

At heypulso.com, our mission is to illuminate the hidden security postures of websites across the internet. We recently completed an extensive scan of 43,960 domains, providing a stark snapshot of web security in practice. Among these, we identified 10,984 WordPress sites, a testament to the platform’s enduring popularity. However, our findings reveal a concerning trend: a widespread neglect of fundamental security headers, leaving thousands of WordPress sites unnecessarily exposed.

This report leverages real, verified data from our scanner to shed light on critical areas of WordPress security, from the adoption of crucial security headers to overall site maintenance and the prevalence of popular plugins and themes.

The Alarming State of WordPress Security Headers

Security headers are a first line of defense, instructing browsers on how to behave when interacting with your site. They mitigate common attacks like Cross-Site Scripting (XSS), clickjacking, and protocol downgrade attacks. Our scan paints a worrying picture of their adoption among WordPress sites:

• X-Frame-Options: A staggering 82.9% of WordPress sites are missing this crucial header. Without it, attackers can embed your site within an iframe on a malicious page, facilitating clickjacking attacks where users are tricked into clicking on hidden elements.
• Content Security Policy (CSP): The most complex yet powerful security header, CSP, is missing from an alarming 88.1% of WordPress sites. CSP acts as a whitelist, controlling which resources (scripts, stylesheets, images, etc.) the browser is allowed to load. Its absence leaves sites highly vulnerable to XSS and data injection attacks.
• HTTP Strict Transport Security (HSTS): Essential for enforcing HTTPS, HSTS is missing from 77.9% of WordPress sites. This header tells browsers to only connect to your site via HTTPS, preventing downgrade attacks and ensuring all communication is encrypted. This is particularly concerning given that only 53.9% of all scanned domains (23,701 out of 43,960) even have a valid SSL certificate in the first place, highlighting a broader issue of secure communication.
• XML-RPC Exposed: Beyond headers, a significant 49.9% of WordPress sites still have XML-RPC exposed. While it has legitimate uses, XML-RPC is a frequent target for brute-force attacks, DDoS amplification, and content scraping. Disabling it when not needed is a critical security best practice often overlooked.

These statistics underscore a significant blind spot in WordPress security. While WordPress itself has robust security features, the widespread lack of proper header configuration leaves sites vulnerable to well-understood and preventable web attacks.

WordPress Maintenance: A Call for Improvement

Beyond specific headers, our scanner also assigned a comprehensive maintenance score to each of the 10,984 WordPress sites, evaluating factors like software updates, secure configurations, and general hygiene. The distribution of these grades is a clear indicator of the overall state of WordPress upkeep:

• A (80-100): Only 57 sites (0.5%) achieved an ‘A’ grade, indicating excellent maintenance and security practices.
• B (60-79): 4096 sites (37.3%) received a ‘B’, suggesting good, but not perfect, maintenance.
• C (40-59): The vast majority, 5561 sites (50.6%), landed in the ‘C’ category, signaling average to subpar maintenance with noticeable gaps.
• D (20-39): A concerning 1169 sites (10.6%) received a ‘D’, indicating significant neglect and high vulnerability.
• F (0-19): A small but critical group of 101 sites (0.9%) failed outright with an ‘F’ grade.

This distribution highlights a critical challenge: over 60% of WordPress sites (50.6% C + 10.6% D) are operating with ‘C’ or ‘D’ maintenance grades. This means the majority of WordPress installations are likely missing critical updates, have insecure configurations, or are failing to implement basic security measures. Imagine a pie chart where over half the slices represent sites that are barely passing or outright failing in terms of security maintenance. This widespread mediocrity creates a fertile ground for attackers.

Popularity vs. Vigilance: A Look at Plugins and Themes

WordPress’s strength lies in its extensibility through plugins and themes. However, this ecosystem also introduces a significant attack surface if not managed diligently. Our scan identified the most prevalent components:

Top 10 WordPress Plugins Found:

Plugin Name	Count
Contact Form 7	3152
Elementor	3070
Elementor Pro	1783
Revslider	1055
Complianz Gdpr	1033
Cookie Notice	852
Woocommerce	837
Wp Rocket	748
Js_composer	726
Pojo Accessibility	661

Plugins like Contact Form 7 and Elementor, used by thousands of sites in our scan, are powerful but also frequently targeted. A single vulnerability in a widely used plugin can expose thousands of websites simultaneously. The presence of Revslider (1055 sites), a plugin historically associated with critical vulnerabilities, underscores the importance of keeping all components updated and patched.

Top 5 WordPress Themes Found:

Theme Name	Count
hello-elementor	1059
Divi	951
astra	611
twentyseventeen	287
oceanwp	201

Similarly, popular themes such as Hello Elementor and Divi are foundational to many WordPress sites. While these themes are generally well-maintained by their developers, the sheer number of installations makes them attractive targets for attackers. Any unpatched vulnerability can have a cascading effect across the web. Regular updates are non-negotiable for these widely adopted components.

The Broader Landscape: SSL, Phishing, and Global Reach

Our scanner’s reach extends globally, identifying domains primarily in France (FR: 18,709), Chile (CL: 8,743), the United States (US: 1,247), Spain (ES: 618), and Germany (DE: 281). This broad geographic distribution highlights that security challenges are not limited to a single region.

Across all scanned domains, we also detected 238 phishing sites. While not exclusively WordPress, the prevalence of these malicious sites often correlates with underlying security weaknesses and the ease with which compromised servers can be exploited for nefarious purposes. The average response time across all domains was 1346ms, which, while not a direct security metric, can sometimes indicate overloaded or poorly optimized servers that might also be neglecting security.

Actionable Insights for a Safer WordPress

The data from our extensive scan delivers a clear message: WordPress site owners must prioritize fundamental security practices. The high percentages of missing security headers, coupled with widespread mediocre maintenance grades, present an undeniable risk.

To secure your WordPress site, consider the following:

1. Implement Security Headers: Prioritize X-Frame-Options, Content Security Policy (CSP), and HSTS. Tools and plugins can assist in generating and implementing these, but understanding their purpose is key.
2. Regular Maintenance & Updates: Keep your WordPress core, plugins, and themes updated to their latest versions. Our data shows this is a major failing for over 60% of sites.
3. Disable XML-RPC: If you don’t actively use it, disable XML-RPC to close a common attack vector.
4. Enforce HTTPS: Ensure you have a valid SSL certificate and use HSTS to force secure connections.
5. Audit Plugins & Themes: Regularly review installed plugins and themes, removing any that are unused or outdated. Be mindful of the security track record of popular components.

Conclusion: Secure Your WordPress Today

The insights from our 43,960 domain scan, encompassing 10,984 WordPress sites, paint a sobering picture of web security. The vast majority of WordPress sites are operating without crucial security headers, leaving them exposed to well-known attack methodologies. This widespread vulnerability is further compounded by a pervasive lack of diligent maintenance.

As security researchers at heypulso.com, we urge every WordPress site owner to take these findings seriously. Proactive security is not an option; it’s a necessity in today’s threat landscape. Don’t wait for a breach to discover your vulnerabilities.

Take the first step towards a more secure website. Visit https://heypulso.com today for a free scan of your domain and discover your site’s security posture. Knowledge is the first step to protection.