What are WordPress’s main security flaws and how to stay informed about future ones?

The main WordPress security flaws that get it hacked are those found in the code by hackers via WordPress core, a theme or a plugin.

The other major flaw is also the human one, with the use of weak passwords, data theft or sharing access with malicious people.

There are simple solutions to address the main WordPress security flaws, which I will detail in this post.

Admin accounts are doors into your site, so you should secure them with simple measures:

• Don’t choose an easy-to-guess admin username : admin, your first name, your business name
• Hide your username on your WordPress site
• Choose a password different from the one you use elsewhere
• Choose a strong password with words, lowercase and uppercase letters, digits and special characters. Example: Dromadaire59-Table31+Castor0909/Mamouth12*
• Use a password manager (like Dashlane or 1Password), which will also warn you if some sites where you entered your username have suffered a data leak
• Use an author account for the people who publish posts on your site
• Use a plugin fortwo-factor authentication

Some people spend quite a lot of time discovering security flaws in WordPress, whether in its core, its themes or its plugins.

This lets them pass the flaws on to WordPress or third-party developers, or hack sites by exploiting their discoveries.

WordPress’s answer to this is to offer « updates » to its software, and developers do the same for themes and plugins. Some of their updates will be called « security updates ».

You therefore need very good update management and to know when to apply them to close these flaws, which can’t be anticipated in advance as to what will happen in the future. But we can still add barriers against the best-known hacks.

Pro tip: don’t enable automatic updates, it can crash your site.

Latest example: the PHP2Shell flaws of October 2026, which affect PHP itself and not WordPress. And if you want to test your knowledge, try my cybersecurity quiz.

If you want to dig deeper into the subject, the official site Cybermalveillance.gouv.fr remains the reference.

Security plugins let you close known WordPress security flaws in a few clicks, and also monitor that your installation isn’t being attacked.

They generally offer a firewall and other barrier measures to prevent bots from forcing their way into your site.

See my list of the best security plugins to install the one that suits you best. The best, in my opinion, being Wordfence.

While security updates are essential, it is also important to consider that the versions of your WordPress, your theme and your plugins affect your vulnerability to attacks.

Indeed, depending on their versions, they can be incompatible with each other and open security gaps in your installation.

The same goes for the PHP version, which matters since some versions are no longer maintained, so your server must be configured so that its PHP version is at least the minimum acceptable one and that it is maintained.

See my tutorial to check your PHP version and update it.

To make sure the impact of a security flaw being exploited on your site is not fatal or very damaging, you absolutely must back up your site locally and on a third-party service.

You can also enable backups on your web hosting by contacting your host for extra security.

Securing a WordPress site is simple and I invite you to see my free ebook to put in place the first measures so you can sleep soundly!

To stay informed about future security flaws, subscribe to the newsletters of your plugin and theme developers. You can also takeJennifer’s maintenance service to delegate all that!