WordPress powers about 43% of all websites. That sounds like a strength. In security terms, it is a target. Attackers do not write a custom exploit for your site. They write one exploit and run it against every WordPress installation on the internet.
The core software is rarely the problem. The plugins are.
The plugin maintenance problem
A typical small business WordPress site runs 20 to 30 plugins. Each is third-party code from a separate developer with its own update cycle and its own vulnerabilities, and each has direct access to your database. When a vulnerability is patched, attackers scan for unpatched sites within hours. One missed update is enough.
Every update also needs testing against your theme, your other plugins and your WordPress version. An update that quietly breaks your checkout or a form on mobile can cost you customers before anyone notices.
What a real audit found
A recent client site had 37 plugins installed. Six had known, active security vulnerabilities. Eleven inactive plugins were still installed and still running on the server. Nine had not been updated in over 12 months. Two were installed twice. Two developer tools were still on the production server.
The site owner believed it was secure because the developer had set it up properly. Setup is not maintenance. A site that was well built three years ago and never reviewed since is a liability with a clock on it.
The real cost
Hosting, premium plugins, developer maintenance and a single breach add up to between $1,640 and $6,800 a year. Most owners do not know this when they sign up.
Better options
Joomla is the most underrated content management system for organisations of your size. It is mature, actively maintained and used by governments, universities and large not-for-profits. A complex business site on Joomla needs three to five extensions where WordPress would need 20 to 30, because Joomla’s core does more. Multilingual support, granular access control and flexible content types are built in. Our typical Joomla build uses three or four extensions: Akeeba Backup, Admin Tools Pro, a form component and occasionally a gallery. It grows from a brochure site to a 400-page information site without changing platform. The honest counterpoint is that non-technical editors need more training than they would in WordPress.
Webflow suits marketing sites. No plugins, automatic security updates, and you edit content yourself. From $23 USD a month.
Shopify is the right call for selling online. Payments, inventory, shipping and PCI compliance in one managed platform. From $49 AUD a month.
Ghost Pro is built for publishing. Fast, clean, no plugins. $11 USD a month including hosting and backups.
Squarespace or Framer handle simple brochure sites that rarely change, from $23 AUD a month.
When WordPress is still right
Keep it if a developer applies plugin updates at least monthly, you have a staging site for testing, and someone receives and acts on security alerts. If none of those are happening, the site is accumulating risk regardless of how well it was built.
Your hosting backup is not a backup
A hosting backup is taken by the same company that hosts your site, on the same infrastructure, under their control. If they have an outage, a billing dispute or close down, the backup goes with the site.
Most backup plugins capture only the database and the wp-content folder. That restores your content, not a working site. A proper backup captures the entire site as one portable package. Akeeba Backup does this for both WordPress and Joomla, and you download the archive to storage you control. Then restore from it at least once, so you know it works before you need it.
Do this today
- Log in to WordPress and open Plugins, then Installed Plugins.
- Count them. Delete anything inactive, not just deactivated.
- Flag anything not updated in 12 months.
- Ask your developer when the last full update cycle ran and whether there is a staging site.
- If the answers are unsatisfactory, ask us for a migration scope.