WordPress Security & SSL Adoption: Insights from 43,960 Scans

As security researchers at heypulso.com, we constantly monitor the web to identify trends and vulnerabilities that impact online safety. Our latest comprehensive scan, encompassing 43,960 domains, has provided a revealing snapshot of the current state of WordPress security, particularly concerning SSL adoption rates and other critical security measures.

WordPress, powering over 43% of all websites, is a cornerstone of the internet. Its widespread adoption, however, also makes it a prime target for attackers. Understanding the security posture of these sites is paramount for both site owners and the broader digital ecosystem.

Our scanner identified 10,984 WordPress sites within the total dataset, allowing us to drill down into specific security practices within this popular platform. The findings paint a picture of both progress and persistent challenges, urging a renewed focus on fundamental security hygiene.

The Broader SSL Landscape: A Foundation for WordPress Security

Secure Sockets Layer (SSL) certificates, indicated by HTTPS, are the bedrock of secure web communication. They encrypt data exchanged between a user’s browser and the website, protecting sensitive information like login credentials and personal data. Google and other search engines also prioritize sites with valid SSL, making it crucial for SEO and user trust.

Our scanner revealed that across all 43,960 domains analyzed, only 23,701 (53.9%) have valid SSL certificates. This means nearly half of the websites we scanned are still operating without this fundamental layer of encryption. While this figure represents the overall internet landscape, it includes the 10,984 WordPress sites we identified. This general trend indicates a significant portion of the web, including many WordPress installations, are likely exposing their users to unnecessary risks by not enforcing HTTPS.

The absence of SSL is not merely a technical oversight; it’s a critical security vulnerability that undermines user trust and data privacy. For WordPress site owners, ensuring a valid SSL certificate is active and properly configured should be a non-negotiable first step in securing their online presence.

WordPress-Specific Security Posture: Beyond Basic Encryption

While SSL is foundational, a truly secure WordPress site requires a multi-layered approach. Our scan delved deeper into specific security implementations on the 10,984 WordPress sites, uncovering significant gaps in critical areas.

Critical Security Header Deficiencies

Security headers are HTTP response headers that provide an additional layer of security by instructing browsers on how to behave when interacting with a website. They can mitigate various common attacks, yet our data shows a widespread neglect of these vital defenses among WordPress sites:

• X-Frame-Options: A staggering 82.9% of WordPress sites were missing this header. X-Frame-Options prevents clickjacking attacks by controlling whether a page can be loaded in an <iframe>, <frame>, <embed>, or <object>. Its absence leaves sites vulnerable to malicious embedding.
• Content Security Policy (CSP): An even higher 88.1% of WordPress sites were missing a Content Security Policy. CSP is a powerful security mechanism that helps prevent cross-site scripting (XSS) attacks and other code injection vulnerabilities by specifying which dynamic resources (scripts, stylesheets, images, etc.) are allowed to be loaded by the browser.
• HTTP Strict Transport Security (HSTS): Our scanner found that 77.9% of WordPress sites were missing the HSTS header. HSTS forces browsers to interact with a website only over HTTPS, even if the user types http://. This prevents SSL stripping attacks and ensures all subsequent connections are secure after the initial visit.

These numbers are alarming. They indicate that despite the availability of tools and knowledge, a vast majority of WordPress sites are failing to implement basic, yet highly effective, security measures. This leaves them, and their users, exposed to a wide array of client-side attacks that could otherwise be easily mitigated.

The Persistent Threat of Exposed XML-RPC

XML-RPC is a feature in WordPress that allows external applications to communicate with your site. While it once served legitimate purposes, its functionality has largely been superseded by the REST API, and it is now often seen as a security liability due to its susceptibility to brute-force attacks and DDoS amplification attacks.

Our data reveals that a concerning 49.9% of WordPress sites scanned still have XML-RPC exposed. This means nearly half of the WordPress sites are potentially vulnerable to attacks that exploit this endpoint, leading to compromised credentials, denial-of-service, or other malicious activities. Disabling XML-RPC when not explicitly needed is a straightforward and highly recommended security practice.

WordPress Maintenance: A Tale of Neglect and Opportunity

Beyond specific configurations, the overall health and security of a WordPress site heavily depend on consistent maintenance – keeping core, plugins, and themes updated, and adhering to best practices. We graded the 10,984 WordPress sites based on their maintenance scores, revealing a troubling distribution:

Figure 1: WordPress Maintenance Grade Distribution (10,984 Sites Graded)

Grade	Score Range	Number of Sites	Percentage
A	80-100	57	0.5%
B	60-79	4096	37.3%
C	40-59	5561	50.6%
D	20-39	1169	10.6%
F	0-19	101	0.9%

The vast majority of WordPress sites fall into the ‘C’ and ‘D’ categories, collectively representing 61.2% of all graded sites. Only a meager 0.5% achieve an ‘A’ grade, indicating excellent maintenance. This distribution suggests a widespread lack of proactive maintenance, leaving sites vulnerable to known exploits that could be patched with simple updates.

Poor maintenance scores often correlate with out-of-date software, insecure configurations, and unaddressed vulnerabilities. This significantly increases the attack surface for WordPress sites, making them easier targets for automated bots and sophisticated attackers alike.

Plugin & Theme Popularity: A Double-Edged Sword

The strength of WordPress lies in its extensive ecosystem of plugins and themes. However, popularity can also mean increased scrutiny from attackers looking for widespread vulnerabilities. Our scan identified the most prevalent plugins and themes:

Table 1: Top 10 Most Popular WordPress Plugins (by count)

Rank	Plugin Name	Count
1	Contact Form 7	3152
2	Elementor	3070
3	Elementor Pro	1783
4	Revslider	1055
5	Complianz Gdpr	1033
6	Cookie Notice	852
7	Woocommerce	837
8	Wp Rocket	748
9	Js_composer	726
10	Pojo Accessibility	661

These plugins are used by thousands of sites, making them high-value targets. A vulnerability discovered in any of these popular plugins could potentially impact a massive number of WordPress installations. Regular updates are critical, yet our maintenance scores suggest this isn’t always happening.

Similarly, popular themes also carry significant weight:

Table 2: Top 5 Most Popular WordPress Themes (by count)

Rank	Theme Name	Count
1	hello-elementor	1059
2	Divi	951
3	astra	611
4	twentyseventeen	287
5	oceanwp	201

Using popular themes and plugins is not inherently bad, but it underscores the absolute necessity of keeping them updated. Neglecting updates for these widely used components is a primary vector for website compromise.

Geographic Footprint and Emerging Threats

Our scan also provided insights into the geographic distribution of the scanned domains and detected threats:

• Top Countries: The majority of domains scanned were located in France (FR - 18,709), Chile (CL - 8,743), United States (US - 1,247), Spain (ES - 618), and Germany (DE - 281). This global reach highlights the universal nature of web security challenges.
• Phishing Sites: Disturbingly, our scanner detected 238 phishing sites within the total scanned domains. While not all of these are necessarily WordPress sites, this figure emphasizes the constant threat of malicious actors attempting to mimic legitimate sites to steal credentials and information. Proactive security measures help prevent legitimate sites from being compromised and turned into phishing platforms.
• Average Response Time: The average response time across all scanned domains was 1346ms. While not directly a security metric, slow response times can indicate poorly optimized sites, overloaded servers, or even compromised systems struggling under malicious load, indirectly pointing to potential maintenance or security issues.

Conclusion: A Call to Action for a More Secure WordPress Ecosystem

The data from our extensive scan paints a clear picture: while WordPress powers a significant portion of the internet, a substantial number of its installations are lagging in fundamental security practices. From the general lack of SSL adoption across the web to critical security header deficiencies, exposed XML-RPC, and widespread maintenance neglect on WordPress sites, the vulnerabilities are pervasive.

These findings are not meant to deter WordPress users but to empower them with knowledge. Securing a WordPress site doesn’t require advanced cybersecurity expertise, but rather a commitment to consistent, proactive measures:

1. Enforce SSL/HTTPS: Ensure your site has a valid SSL certificate and forces all traffic over HTTPS.
2. Implement Security Headers: Configure X-Frame-Options, Content Security Policy, and HSTS to bolster browser-side defenses.
3. Disable XML-RPC: If not actively used, disable XML-RPC to close a common attack vector.
4. Prioritize Maintenance: Regularly update WordPress core, plugins, and themes. This is the single most effective way to protect against known vulnerabilities.
5. Use Strong Passwords & Two-Factor Authentication: Basic, yet critical, security hygiene.

At heypulso.com, we believe that a more secure internet starts with informed site owners. Understanding where the weaknesses lie is the first step towards building a more resilient and trustworthy web.

Ready to see how your WordPress site stacks up? Get a free, comprehensive security scan today!

Visit https://heypulso.com to assess your website’s security posture and receive actionable insights to protect your digital assets.