Why WordPress Is the Most Targeted CMS for Automated Attacks

WordPress is the most targeted CMS for automated attacks. Not because it is the worst software, but because it is the most predictable. Attackers build one playbook and run it against millions of sites at once. WordPress, with its consistent structure and enormous market share, is the most efficient target in the history of the web.

What makes a target efficient for automated attacks?

An automated attack does not work like a human attacker who researches a specific victim. It works like a script running against a list of sites, looking for known patterns.

For that kind of attack, efficiency comes from two things: how many potential targets exist, and how predictable those targets are.

WordPress has both. It powers roughly 43 percent of all websites on the internet. That is an enormous concentration of targets. And every WordPress installation, no matter where it is hosted or what it sells or how many visitors it gets, has the same structure.

The login page is always at a predictable path. The plugin directory follows a standard structure. The WordPress admin is always in the same place. Theme and plugin files follow consistent naming patterns.

An attacker builds one tool. That tool works on 43 percent of the internet.

What is the predictability problem?

Predictability is what makes automation possible. If every website were structured differently, automated scanning would not work. The attacker would need to understand each site individually. That does not scale.

WordPress’s consistency, which is one of its genuine strengths for developers, is what makes it a reliable target for automated attacks. The same documentation that helps developers build on WordPress also helps attackers understand what to look for.

In 2025, researchers found 11,334 new WordPress vulnerabilities. Ninety-one percent came from plugins. When a plugin vulnerability is disclosed, attackers can build a scanner for it within hours and run it against every WordPress site that has that plugin installed.

Your site does not need to be interesting to be targeted. It just needs to be running WordPress.

Is this a security failure by WordPress?

No. WordPress is maintained by a large team and responds to vulnerabilities quickly when they are found in core. The core security record for WordPress is reasonably good.

The problem is the plugin ecosystem. WordPress core depends on tens of thousands of third-party plugins, each maintained by different authors at different levels of diligence. The combined vulnerability surface of 20 to 30 plugins per site, multiplied across millions of sites, is enormous and impossible for any central team to control.

The predictability problem is structural. It is the consequence of massive scale and a consistent architecture. It is not a flaw in the software. It is a consequence of how the platform grew.

What does this mean for a small business owner?

It means your site is being probed constantly, regardless of your business size, your industry, or your traffic. The bots are not interested in your business. They are interested in your platform.

Roughly 13,000 WordPress sites are hacked every day. The average small business hack recovery costs about $14,500. Most of those hacked sites were running outdated plugins, not because the owners were careless, but because keeping up with the update pace is genuinely difficult.

For a look at how often login pages are attacked, read how many times is your WordPress login page attacked every day. For more on the bot scanning picture, read why bots are scanning your WordPress site around the clock.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.