Is Jetpack Safe? What Small Business Owners Need to Know
Jetpack is maintained by WordPress's parent company and is genuinely well-supported. Here is what its connection to external servers means for your site.
Jetpack is not a typical third-party plugin. It is maintained by Automattic, the company that runs WordPress.com and employs much of WordPress’s core development team. It is professionally staffed, promptly patched, and one of the better-supported pieces of software in the WordPress ecosystem.
It is also software that connects your site to external servers. Here is what that means in practice.
What makes Jetpack different from other plugins?
Most plugins run entirely on your server. Jetpack connects your site to Automattic’s infrastructure. This enables features that require external processing: security scanning, content delivery, site statistics, and automated backups.
This connection is not a security hole. It is the product design. Automattic built Jetpack to extend WordPress with cloud capabilities. You are choosing to trust their servers when you install it.
That trust is well-placed, as these things go. Automattic has significant security resources and a strong incentive to maintain Jetpack carefully. It is used on millions of sites. A serious breach would be an enormous reputational event for the company.
What is Jetpack’s actual security history?
Like every plugin with a long history and millions of users, Jetpack has had vulnerabilities discovered and patched. The pattern has generally been good: issues are reported, Automattic responds, patches are released. Some Jetpack fixes deploy automatically to all users, which is a meaningful advantage over plugins that require manual updates.
In 2025, researchers logged 11,334 new WordPress security holes across the ecosystem. Jetpack accounts for a small portion of that, and its maintenance standards are above average. The risk is not zero, but it is lower than many alternatives.
What does the external connection actually mean?
When Jetpack is active, some of your site’s activity, including visitor data for statistics and file data for backups, passes through Automattic’s servers. Their privacy policy covers this.
For most small businesses, this is a reasonable tradeoff for the functionality Jetpack provides. You are using a service, similar to using any third-party analytics or backup tool.
The consideration worth making: do you use enough of Jetpack’s features to justify the ongoing connection and maintenance requirement? Jetpack is a large plugin with many features. Sites that use only one or two of them are carrying code for features they never activate.
What you can do today
- Check which Jetpack features you actually use. The plugin settings page lists them.
- If you only use one or two features, consider whether a smaller, focused plugin could replace them.
- Make sure Jetpack is set to update automatically. Automattic patches quickly, and auto-update means you benefit immediately.
- Review what data Jetpack collects in your context. If you have privacy-sensitive customers, understanding what data passes to third-party servers is worth doing.
- Check that all your other plugins are current too. Jetpack is one part of a larger picture.
Why this keeps happening
Jetpack is genuinely well-maintained. The broader point is that every plugin, no matter how professional its team, is software with potential vulnerabilities. In 2025, 91 percent of new WordPress vulnerabilities came from plugins. Jetpack is part of that ecosystem even if it sits at the responsible end of the spectrum.
Across a site with 20 to 30 plugins, even if each one has a good track record, the aggregate risk is real. Roughly 13,000 WordPress sites are hacked every day. Most of those owners had reasonable plugins installed.
Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free. If you are wondering how many plugins your site actually needs, this article breaks it down.
Find out what is wrong in 60 seconds
Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.
Quick answers
Is Jetpack safe to use on a WordPress site?
Jetpack is maintained by Automattic, the company behind WordPress.com, and is one of the most professionally supported plugins available. It has had vulnerabilities over the years and requires updates like any software. The external server connection it uses is by design, not a flaw.
Does Jetpack send my site's data to Automattic's servers?
Yes, by design. Jetpack routes certain features, including its security scanning and some performance features, through WordPress.com infrastructure. This is documented and intentional. You are trusting Automattic with some of your site's data.
Has Jetpack had security vulnerabilities?
Yes. Like every active plugin, Jetpack has had security issues discovered and patched over its history. Because Automattic maintains it, patches tend to arrive quickly and sometimes deploy automatically.
Do I need Jetpack on my WordPress site?
Many of the features Jetpack provides, backups, security scanning, performance tools, are also available through other plugins or built into certain hosting plans. Whether you need Jetpack depends on what features you actually use.
Sixty seconds. Zero jargon.
See what's actually wrong with your site: speed, plugins, and every way in.
Check my site free