96%
Third-party plugins
7,633 vulnerabilities.
White Paper V3 · For decision-makers and compliance
WordPress security: reputation vs. reality
"WordPress gets hacked all the time." Says who?
- 96% in plugins
- 7 in core
- 7 layers of defense
- Sources disclosed
Of the 7,966 vulnerabilities found in the WordPress ecosystem in 2024, 96% were in third-party plugins and seven were in core itself. None of them with broad threat impact. This whitepaper delivers the source-backed figures, the hardening framework, and the fair comparison with custom code for your next security review.
- 11 pages
- Free as a PDF
- German language
- Vendor-review ready
- GDPR and DACH context
11 pages · PDFFree
White Paper · V3
96%of vulnerabilities are in plugins, not in core
WordPress securityReputation vs. reality
lilox.ioSecurity & compliance
11pages
5chapters
5figures
7layers of defense
3implementation stages
8sources named
/ 01 · Why this whitepaper exists
The sentence that good website projects founder on
The security question rarely arrives with data. It arrives as a gut feeling, usually from IT or from someone in compliance, and it blocks the decision anyway. This whitepaper is the answer to it, in a form you can pass on internally.
The objection is understandable. But it confuses attack volume with code quality. Once you know the figures, the conversation moves to where it belongs: to operations.
01
"WordPress gets hacked all the time"
Attack volume is confused with platform weakness. WordPress runs on around 41% of all websites and is therefore the single largest attack surface on the web. Attackers automate against the largest installed base. That is economics, not code quality.
02
The real risk sits in operations
Neglected plugins, delayed updates, weak passwords and cheap shared hosting. All of it is addressable, and none of it has anything to do with the choice of platform.
03
Vendor reviews drag on without evidence
What a security officer wants to see is certificates, processes and figures with a source. That is exactly what the whitepaper delivers, so approval doesn’t stall on missing evidence.
/ 02 · Where the vulnerabilities sit
Where the vulnerabilities actually sit
7,966 new vulnerabilities were found in the WordPress ecosystem in 2024. The distribution is the single most important data point for any sceptical reviewer.
4%
Themes
326 vulnerabilities.
7
WordPress core
Under 0.1%, none with broad impact.
In 2025 the core team found exactly two core vulnerabilities. The bad reputation comes from operations, not from the platform. For context: of the 7,966 vulnerabilities from 2024, Patchstack rated 69.6% as low priority. Raw counts overstate the real risk. Source: Patchstack, State of WordPress Security 2025, data from 2024.
of all websites worldwide run on WordPress, close to 59% market share among all CMS. More than all other systems combined.
W3Techs, July 2026of "basic web application attacks" use stolen credentials. The login is the vector, not the code.
Verizon DBIRof compromised CMS sites were running outdated software at the time of infection. Thanks to auto-updates, WordPress is outdated less often than other CMS.
Sucuri 2023password attacks were blocked by Wordfence in 2024 alone, plus over 1.1 billion SQL injection attempts.
Wordfence Annual Report 2024/ 03 · Your outcome
What you take straight into the review
Not a plea for one platform. Six outcomes with which you close the security question on the facts.
Figures with a named source
Every value comes with its source and the year it was collected. In the meeting you are not holding an opinion, you are holding a data set.
A hardening framework with seven layers
Defense in depth from managed hosting to monitoring. Written so that a compliance lead can sign it off.
The fair comparison with custom code
Both sides set out honestly, including the real advantages of hand-coded sites. That is exactly what makes the argument credible.
Compliance evidence for the DACH region
ISO 27001, SOC 2 Type II, data processing agreement, EU data centers and the two levels of GDPR compliance. Exactly the evidence that shortens vendor reviews.
An implementation in three stages
Foundation before launch, access and resilience in week one, then ongoing governance. With clear thresholds for when a plugin gets replaced.
The sources’ interests disclosed
A dedicated section sets out which sources come from security vendors and where neutral sources such as Verizon, OWASP and W3Techs were used.
So the security question stops being an objection and becomes an argument.
Free, in your inbox immediately, no sales call. All we need is a name and an email address.
/ 04 · The attack vectors
The most common attack vectors
Knowing the vectors means you can close them deliberately. Almost all of them are addressable through operations and configuration, not through a change of platform.
47.7%
Cross-site scripting
14.2%
Broken access control
11.4%
Cross-site request forgery
~8%
SQL injection and other injection
~19%
Remainder: auth, upload, disclosure
Distribution of the WordPress vulnerabilities disclosed in 2024 by type. Source: Patchstack 2025
5 hours: median time to first exploit
That is the median time from a vulnerability being published to it first being exploited. 46% of the 2025 vulnerabilities had no vendor patch at all at the point of disclosure.
Which is why a firewall alone is not enough: in the 2026 pentests, generic WAFs caught only 12 to 26% of WordPress-specific exploits on average. WordPress-aware virtual patching belongs in the picture. Source: Patchstack 2026.
/ 05 · Defense in depth
Defense in depth: seven layers
A multi-layered hardening framework that a compliance lead can accept. The most important lever deliberately comes first.
01
Managed hosting
Isolated containers instead of shared-hosting neighbours, Google Cloud infrastructure, two hardware firewalls, automatic daily backups and uptime monitoring every two to three minutes.
✓ The biggest lever
02
Staying current
Auto-updates for core, themes and plugins, a minimal number of plugins, only maintained plugins, major updates on staging first.
03
WAF and virtual patching
WordPress-aware via Patchstack or Wordfence, plus Cloudflare DDoS protection. A generic firewall alone is demonstrably not enough.
04
Strong authentication
Two-factor for every account with write access, strong passwords or passkeys, limited login attempts, no default "admin" user.
05
Backups and recovery
Automated daily, stored separately, with a tested restore. A backup without a proven way back is not a backup.
06
Least privilege, TLS and wp-config
The lowest possible role per user, HTTPS enforced with HSTS, hardened configuration above the web root, security headers such as CSP and X-Frame-Options.
07
Monitoring and patch cadence
Server-side scanning, a vulnerability-intelligence subscription, high-priority gaps closed in hours rather than weeks.
/ 06 · Custom code compared
A fair comparison: custom code against WordPress
Honest rather than defensive. Hand-coded sites have real advantages. That does not automatically make them safer.
Where custom code has real advantages
The honest other side
- A smaller attack surface, no exposure to the 96% of plugin vulnerabilities
- No public exploit database for that exact code, bots find no matching CVE
- Fine-grained control, security can be designed in from the start
- No forced update pressure from third-party components
Where custom code is not automatically safer
What tends to get overlooked
- Custom code contains vulnerabilities too, usually un-audited and without community review
- No automatic security patches, every fix requires manual intervention
- Security depends entirely on one developer, so there is key-person risk
- Security through obscurity is not real security
- The OWASP Top 10 apply just the same. In 2025, 100% of applications tested had some form of broken access control
The honest bottom line
Security is determined far more by how a site is built, hosted and maintained than by whether it is WordPress or hand-coded. A well-maintained WordPress site on managed hosting is safer than a poorly maintained custom site with no patch process. And the other way round. The platform choice is subordinate to operational discipline.
/ 07 · Compliance and governance
Compliance and governance in the DACH context
Because the objection usually comes from someone in compliance, this part is decisive: WordPress can be run GDPR-compliant and to enterprise standards.
ISO/IEC 27001
plus 27017 and 27018 for cloud and personal data
SOC 2 Type II
continuously monitored, not a point-in-time audit
GDPR and DPA
EU data centers, data processing agreement in the dashboard
The host’s responsibility
Level 1: infrastructure
Encryption, access controls, EU data location and certifications. The host acts as processor; the data processing agreement under Art. 28 GDPR is part of it.
The operator’s responsibility
Level 2: application
Consent banner, cookie and script blocking, privacy policy and a documented process for data subject rights. Plus serving Google Fonts locally, see Munich Regional Court, ref. 3 O 17493/20.
Built securely. Hosted cleanly. Demonstrably compliant.
LILOX builds WordPress websites on managed hosting with exactly the hardening and compliance framework this whitepaper describes.
/ 08 · Recommendation
Three stages to security you can sign off on
What has to be in place before launch, what follows in week one, and what runs permanently after that.
Stage 1 · Before launch
Foundation
Managed hosting with verifiable certifications, EU data center, data processing agreement signed. Automatic core and security updates. Only reputable, maintained plugins, everything unused removed. HTTPS everywhere, wp-config hardened.
Stage 2 · First week
Access and resilience
Two-factor for all admin and editor accounts, least-privilege roles, limited login attempts. Daily backups with a confirmed, tested restore. Activate WAF plus WordPress-aware virtual patching and DDoS protection.
Stage 3 · Ongoing
Governance
Subscribe to vulnerability intelligence, patch high-priority gaps within hours. Server-side malware monitoring, quarterly plugin and user audits. Local Google Fonts, consent-controlled third-party scripts, data processing agreements kept current.
Thresholds
The thresholds at which you act
| Trigger | Consequence |
|---|---|
| A plugin with no update for twelve months, or with an unpatched high-severity gap | Replace immediately or apply virtual patching |
| Processing of special categories of personal data or payment data | PCI-DSS controls, hourly backups, extended monitoring |
| Maintenance discipline cannot be guaranteed in-house | Prefer managed hosting and a maintenance retainer. Operational discipline decides, not the platform |
/ 09 · What’s inside
Five chapters plus the recommendation
Built for people who have to defend the result internally. 11 pages, five figures, and a disclosed source base.
- 011 page
At a glance
The core message in three sentences, written for the meeting.
- 02Chapter 1
Reputation vs. reality
The distribution of vulnerabilities across plugins, themes and core, plus the actual causes of compromises.
- 03Chapter 2
The most common attack vectors
Which gaps get exploited in practice, and how quickly after disclosure.
- 04Chapter 3
How to avoid these risks
Seven layers of defense plus the concrete steps on updates, authentication and configuration.
- 05Chapter 4
Compliance and governance in the DACH context
Certificates, the two levels of GDPR compliance, and what a security officer wants to see.
- 06Chapter 5
A fair comparison with custom code
Both sides set out honestly, with the bottom line on operational discipline.
- 073 stages
Recommendation in three stages
Before launch, first week, ongoing operations. With three threshold rules.
- +Appendix
Transparency and sources
Context on the data, the disclosed interests of the vendor sources, and the full source selection.
/ 10 · Is this for you?
Who this whitepaper was written for
Written for decision-makers as well as security, IT and compliance leads who have to justify or approve a platform decision.
A fit
The whitepaper is for you if …
- your IT or compliance function is blocking the platform choice
- you have to justify a website relaunch and the security question is on the table
- you are preparing a vendor security review and need verifiable evidence
- you want to know whether a hand-coded site really would be safer
- you have to separate GDPR responsibility cleanly between host and operator
- you want to measure your provider on operational discipline rather than promises
Probably not a fit
Save yourself the download if …
- you are looking for a technical guide to server hardening
- you already run a documented security program for your website
- you expect legal advice on GDPR, the whitepaper does not replace a lawyer’s review
- you are looking for a buying recommendation for a specific security product
/ 11 · Who stands behind it
Nadine and Christoph
If your IT team or your external security officer has follow-up questions on the whitepaper, we answer them directly.
Managing Partner · CEO & Founder
Nadine Fraiss, MA
15 years in digital marketing, around ten of them exclusively in B2B. She has sat on both sides: as the client who had to justify agency budgets, and as the executive expected to deliver pipeline at the end of the quarter.
- Hypo Tirol Bank
- Hartlauer
- Egger
- Bots & People
Partner
Ing. Christoph Fraiss, MBA, MSc
Mechanical and industrial engineer with an international MBA. 15 years in industry as project lead for large-scale projects, Head of Engineering and plant manager. He knows acceptance processes in which evidence counts and assurances do not.
- Thermo Fisher
- Novartis
- Aenova
5 out of 5
Competent, friendly, committed, and doesn’t just tell you what you want to hear. Advice between equals, no fluff, always focused.
Prof. (FH) Dr. Uwe HeilDr. Heil KG Consulting & Coaching/ 12 · Frequently asked questions
What gets asked most often in a security review
Is WordPress secure enough for a company?
Run professionally, yes. Of 7,966 vulnerabilities from 2024, 96% were in plugins, 4% in themes and seven in core. What matters is managed hosting, update discipline, two-factor authentication and monitoring.
Why is WordPress attacked so often?
WordPress runs on around 41% of all websites and is therefore the single largest attack surface on the web. Attackers automate against the largest installed base. Sucuri itself makes clear that the high WordPress share of cleaned infections reflects popularity and says nothing about platform security.
Is a custom-built website safer?
Not automatically. Custom code has a smaller attack surface and no public exploit database, but it is usually unreviewed, without community review, without automatic security patches, and it carries key-person risk.
Can WordPress be run in a GDPR-compliant way?
Yes, on two levels. The infrastructure needs encryption, access controls, EU data location and a data processing agreement. The application needs consent management, script blocking, a privacy policy and a process for data subject rights.
Is a firewall enough protection?
No. In the 2026 pentests, generic firewalls caught 12 to 26% of WordPress-specific exploits on average. Because the median time to first exploit is five hours, WordPress-aware virtual patching belongs in the picture.
What does the whitepaper cost and what happens to my data?
The whitepaper is free. Processing under GDPR, servers in the EU, no sharing with third parties. No phone call without your invitation. You can unsubscribe from the newsletter at any time with one click.
Download
Get the whitepaper as a PDF
11 pages, in German, with five figures and a sources section you can pass straight to your IT team.
What’s in it
11 pages in German, five figures, one sources section to pass on.
- The distribution of vulnerabilities with source and year
- The most common attack vectors by type
- A seven-layer hardening framework plus detailed measures
- Compliance section for GDPR and the DACH region
- A fair comparison with custom code
- A recommendation in three stages with thresholds
Transparency on the sources
The data sources cited come predominantly from security vendors that make money protecting WordPress. The whitepaper sets out that interest in a dedicated section and additionally draws on neutral sources: Verizon DBIR, OWASP and W3Techs. The Sucuri figures are from 2023, the main Patchstack data set from 2024. References such as whitehouse.gov or NASA are publicly documented WordPress installations and not LILOX clients. The whitepaper is not legal advice.
/ 13 · Next step
Shall we check your website against the hardening framework?
We work through the seven layers of defense on your existing website and you get the result in writing, in a form you can put straight into the review.
