Unveiling the State of WordPress Security: A HeyPulso Data Report

At HeyPulso, our mission is to illuminate the hidden vulnerabilities and performance bottlenecks lurking across the internet. We achieve this through our robust scanning technology, meticulously analyzing domains for security posture, maintenance health, and potential threats. Recently, we conducted an extensive sweep, scanning 43,960 domains to bring you a comprehensive, data-driven look into the current state of WordPress security.

WordPress powers over 43% of all websites on the internet, making it a prime target for attackers. Understanding its security landscape isn’t just academic; it’s essential for site owners, developers, and security professionals alike. This report leverages real, verified data from our scanner to provide actionable insights into where WordPress sites are thriving, and more importantly, where they are falling short.

The Digital Landscape: Our General Scan Findings

Out of the 43,960 domains we scanned, a substantial 10,984 sites were identified as running on WordPress. This highlights the platform’s pervasive influence across the web. While WordPress’s popularity is undeniable, its security implementation varies wildly.

One fundamental security measure is the adoption of SSL/TLS certificates. Our scan revealed that 23,701 domains (53.9%) across all scanned sites have valid SSL. While this figure represents a majority, it also means a significant portion—nearly half—of the internet still operates without this basic layer of encryption, leaving data vulnerable during transit.

WordPress Security Posture: A Deep Dive into Headers

Security headers are a website’s first line of defense against common web vulnerabilities like Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks. Our findings for WordPress sites paint a concerning picture:

• Missing X-Frame-Options: A staggering 82.9% of WordPress sites were missing the X-Frame-Options header. This header prevents your site from being embedded in iframes on other malicious sites, protecting users from clickjacking attacks.
• Missing Content Security Policy (CSP): Even more critically, 88.1% of WordPress sites lacked a Content Security Policy. CSP is a powerful security standard that helps mitigate XSS attacks by allowing site administrators to specify which dynamic resources are allowed to load. Its absence leaves sites wide open to various injection attacks.
• Missing HSTS: The HTTP Strict Transport Security (HSTS) header was absent from 77.9% of WordPress sites. HSTS forces browsers to interact with your site only over HTTPS, preventing protocol downgrade attacks and cookie hijacking. Its absence means users could still be vulnerable to initial unencrypted connections.
• XML-RPC Exposed: Furthermore, 49.9% of WordPress sites had XML-RPC exposed. While XML-RPC can be useful for certain integrations, it has historically been a vector for brute-force attacks and DDoS amplification. Leaving it exposed without proper protection or necessity is a significant security oversight.

These statistics underscore a widespread deficiency in fundamental security hardening practices among WordPress site owners. The lack of these critical headers significantly elevates the risk profile for nearly all scanned WordPress installations.

The State of Maintenance: Grades Reveal Neglect

Beyond specific security headers, we graded the overall maintenance health of all 10,984 WordPress sites. Our Maintenance Scores reflect a holistic view, encompassing factors like outdated software, configuration issues, and general site hygiene that directly impact security and performance. The distribution of grades is highly skewed towards lower scores:

Grade Range	Sites	Percentage
A (80-100)	57	0.5%
B (60-79)	4096	37.3%
C (40-59)	5561	50.6%
D (20-39)	1169	10.6%
F (0-19)	101	0.9%

This distribution is stark: over half (50.6%) of all WordPress sites received a ‘C’ grade, indicating significant room for improvement. Even more concerning, 10.6% scored a ‘D’ and 0.9% an ‘F’, pointing to severe neglect that likely includes unpatched vulnerabilities, poor configurations, and other critical security flaws. Only a minuscule 0.5% achieved an ‘A’ grade, highlighting that truly well-maintained WordPress sites are a rare exception rather than the norm.

Poor maintenance directly correlates with increased security risks. Outdated plugins, themes, or core WordPress versions are common entry points for attackers. The prevalence of lower grades suggests a widespread lack of proactive security management.

The Ecosystem: Popular Plugins and Themes

WordPress’s strength lies in its vast ecosystem of plugins and themes. However, popularity can also equate to wider attack surfaces if these components are not securely developed or regularly updated. Our scan identified the most frequently used plugins and themes:

Top 10 WordPress Plugins Found

Plugin Name	Installations
Contact Form 7	3152
Elementor	3070
Elementor Pro	1783
Revslider	1055
Complianz Gdpr	1033
Cookie Notice	852
Woocommerce	837
Wp Rocket	748
Js_composer	726
Pojo Accessibility	661

The prominence of plugins like Contact Form 7 and Elementor (and its Pro version) is expected, given their utility for site building and interaction. The presence of Revslider, however, is noteworthy. While a powerful slider plugin, it has a history of critical vulnerabilities, making its widespread use (1055 installations) a point of concern if not kept meticulously updated. Similarly, e-commerce solutions like WooCommerce are critical components that demand constant vigilance due to the sensitive data they handle.

Top 5 WordPress Themes Found

Theme Name	Installations
hello-elementor	1059
Divi	951
astra	611
twentyseventeen	287
oceanwp	201

These popular themes, like their plugin counterparts, are widely used for good reason. However, like any software, they require regular updates and careful selection to ensure they don’t introduce vulnerabilities. An outdated theme, even a popular one, can be a gateway for attackers.

Global Footprint and Hidden Dangers

Our scan covered domains across various geographical regions, with the top countries identified as:

• France (FR): 18,709 domains
• Chile (CL): 8,743 domains
• United States (US): 1,247 domains
• Spain (ES): 618 domains
• Germany (DE): 281 domains

This distribution reflects a broad international scope for our scanning efforts. While not directly a security metric, understanding regional concentrations can help tailor security awareness and resource allocation.

Beyond misconfigurations, the internet is rife with direct threats. Our scanner detected 238 phishing sites among the total domains analyzed. Phishing sites, often designed to mimic legitimate brands, pose a significant risk to user data and trust. The continuous presence of these malicious sites underscores the constant battle against cybercrime.

Finally, average site performance can also indirectly impact security and user experience. Our scanner recorded an average response time of 1346ms. While not a direct security vulnerability, slow response times can indicate server overload, inefficient code, or other issues that might be exploited, or simply drive users away.

Conclusion: A Call to Action for Better WordPress Security

The data from our HeyPulso scanner paints a clear picture: while WordPress is ubiquitous, its security posture is, on average, alarmingly weak. The widespread absence of critical security headers, coupled with poor maintenance grades for the vast majority of sites, creates a fertile ground for cyber attackers.

Site owners and administrators must prioritize proactive security measures. This includes:

• Implementing Security Headers: Especially CSP, HSTS, and X-Frame-Options.
• Regular Maintenance: Keeping WordPress core, plugins, and themes updated to their latest versions.
• Minimizing Attack Surface: Disabling unnecessary features like XML-RPC if not required.
• Choosing Reputable Components: Selecting well-maintained plugins and themes, and staying informed about their security advisories.

The insights from our 43,960 domain scan are not just numbers; they are a direct reflection of the internet’s current security landscape. It’s a call to action for everyone involved in managing WordPress sites.

---

Is your WordPress site secure? Don’t leave it to chance.

Discover hidden vulnerabilities and get actionable insights with a free scan from HeyPulso. Visit https://heypulso.com today and take the first step towards a more secure website.