Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
WordPress security in 2026 is less a question of whether the core software is inherently unsafe than whether site owners operate the controls needed around it. In WP Tavern Jukebox #237, host Nathan Wrigley and Melapress founder Robert Abela connect the findings of the 2026 WordPress Security Survey with a faster AI-assisted contest between attackers and defenders. The practical message is clear: secure accounts, record what happens after login, train users, and rehearse recovery instead of relying on a firewall or a single security plugin.
What episode #237 covers
Robert Abela describes 25 years in IT security, including work with antivirus and web-security scanner companies, and says he founded Melapress about a decade ago. His company concentrates on post-login controls for WordPress: activity logging, stronger authentication, two-factor authentication (2FA), and passkeys.
The conversation uses Melapress’s 2026 WordPress Security Survey to examine how prepared site operators really are, then considers how generative AI changes vulnerability discovery, plugin supply chains, and the speed of incident response. The episode is aimed at owners and professionals running ecommerce, membership, news, agency, enterprise, and brochure sites, whose consequences from an attack differ substantially.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Abela also points to a graph shared by John Blackbourn showing the volume of issues reported through the HackerOne WordPress vulnerability program. “But it is worrying, yes,” he says, describing the number of reported issues as “insane.” That observation is about the scale of reported vulnerabilities, not proof that WordPress core is automatically insecure.
#1 Best Overall
What the 2026 survey actually found
The contemporaneous survey summary contains 219 cleaned responses from agencies, developers, designers, enterprise teams, and product owners. Its results show a gap between concern and day-to-day security operations.
| Measure | Result | How to interpret it |
|---|---|---|
| Respondents reporting at least one security incident in the previous year | 67.7% | This is the share of survey respondents, not the percentage of all WordPress sites that were hacked. |
| Average concern about WordPress security | 7.85 out of 10 | Security is a high concern among the surveyed professionals. |
| Organizations providing security training for users | 27.9% | Most respondents did not report a formal user-training program. |
| Organizations using logs | About 37% | The transcript gives an approximate figure rather than a more precise percentage. |
Incidents can mean very different things depending on the site. Downtime, defacement, lost data, damaged reputation, and legal or compliance exposure are all cited risks. A compromised membership database or store has a different impact from a temporary defacement on a brochure site, but both require a way to detect unauthorized changes and restore a known-good state.
Why WordPress carries a security reputation problem
The episode separates WordPress core from the larger ecosystem. WordPress is widely used, supports a huge range of plugins and themes, and lets people launch sites without necessarily having the experience to maintain them securely. That combination creates many opportunities for weak passwords, abandoned extensions, unsafe configuration, and delayed updates.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutePopularity also increases attention from vulnerability researchers and criminals. A report about a plugin flaw, a compromised update path, or a misconfigured host can affect many installations at once. It is therefore too broad to conclude that every WordPress site is unsafe, just as it is unsafe to assume that a current core version makes the entire installation secure.
How AI changes the threat model
Abela presents AI as neutral technology that accelerates both sides. Attackers can ask new models to inspect code, identify suspicious paths, or scale reconnaissance. Defenders can use models to scan their own code, triage findings, and improve detection. “The same way attackers can use AI to find issues. We are doing it ourselves as well,” he says, noting that new models are likely to be used to scan code on both sides.
That is an accelerating contest, not a claim that an AI system independently decides to attack. Human choices still determine what code is deployed, what permissions an integration receives, and how quickly a finding is fixed.
AI-connected WordPress features
Melapress programming on AI connections in WordPress core and the Abilities API highlights a less obvious risk: a site may expose new capabilities when it connects to an external AI provider. Review which actions an integration can perform, which data it can send, how credentials are stored, and whether access can be revoked. Treat the integration as part of the site’s supply chain rather than as a harmless add-on.
Plugin and update supply chains
Another discussion of AI-assisted hunting describes patterns such as plugin backdoors, expired domains being taken over, redirected update infrastructure, and manipulated version numbers. These examples show why provenance matters. A plugin that appears to have a normal update may still deserve scrutiny if its publisher, domain, download path, or release history has changed unexpectedly.
A practical WordPress security program
Prevention, detection, and recovery are complementary layers. None replaces the others.
1. Protect privileged accounts
- Require 2FA or passkeys for administrators and other users who can install extensions, edit code, change settings, or manage billing.
- Remove dormant accounts and give contributors the least privilege needed for their work.
- Use unique passwords and keep recovery channels current so a locked-out administrator does not resort to unsafe shortcuts.
Passwords alone leave the most valuable account exposed to phishing and credential reuse. Passkeys can reduce those risks when the WordPress setup and users’ devices support them; 2FA remains an important alternative or additional control.
2. Turn on activity logging and review it
Logging should answer who did what, when, and from which account or session. At minimum, record successful and failed logins, privilege changes, new users, password and 2FA changes, plugin and theme installation or updates, settings changes, and content or code edits. Send logs somewhere an attacker cannot silently rewrite, restrict access to them, and define who reviews alerts and how quickly.
3. Train the people who operate the site
Training should cover phishing, password managers, 2FA or passkey enrollment, safe handling of administrator invitations, recognizing unexpected update prompts, and the procedure for reporting a suspected compromise. Write the process down and repeat it when staff, agencies, or contractors change.
4. Build and test recovery
- Keep independent backups of the database and uploaded files, with retention that matches the site’s business needs.
- Protect backup credentials and test restoring to a clean environment; a backup that has never been restored is an assumption, not a recovery plan.
- Document contacts, hosting access, registrar access, plugin vendors, legal or compliance contacts, and the decision-maker who can take the site offline.
5. Govern plugins, themes, and integrations
Maintain an inventory of every extension and integration, its owner, purpose, permissions, update source, and replacement plan. Remove unused components. Before installing or renewing one, check whether the publisher still maintains it, whether its domain and update path are consistent, and whether it requests capabilities unrelated to its stated purpose.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when an incident is suspected
- Preserve evidence. Note the time, affected accounts, visible changes, alerts, and relevant log entries before cleaning anything.
- Contain access. Disable or isolate compromised accounts, revoke suspicious sessions and application credentials, and restrict administrative access without destroying logs.
- Assess scope. Check administrator changes, new users, plugin and theme files, update history, database modifications, and connected services.
- Eradicate the cause. Remove unauthorized code, replace compromised credentials, update or remove vulnerable components, and verify the integrity of the hosting environment.
- Recover carefully. Restore from a known-good backup when appropriate, monitor the site and logs, and confirm that authentication and permissions work as intended.
- Notify as required. Follow contractual, legal, regulatory, customer, and payment-provider obligations based on the data and services involved.
- Learn from the event. Record the entry point, detection time, actions taken, and control changes so the next response is faster.
Priorities by site type and team size
| Situation | First priorities |
|---|---|
| Small brochure site | Administrator 2FA or passkeys, automatic updates with review, off-site backups, and a written restore checklist. |
| Membership or ecommerce site | Everything above plus strict role separation, detailed audit logs, tested restores, payment and personal-data response procedures, and rapid alert review. |
| Agency managing many sites | Standardize account policy, plugin inventory, logging, backup checks, incident contacts, and client-specific recovery ownership across every installation. |
| Enterprise or regulated operation | Centralized identity and logs where possible, formal change control, supplier due diligence, documented evidence retention, and rehearsed legal and compliance escalation. |
The useful answer to “How secure is WordPress in 2026?”
WordPress security depends less on a label attached to the core project than on the operational discipline surrounding each installation. The survey indicates that incidents are common among respondents and that basic controls are not universal. AI raises the speed of vulnerability discovery, but it also gives defenders better ways to inspect code and respond. Site owners who combine hardened authentication, post-login visibility, user training, supply-chain governance, and tested recovery are better positioned than those who install one protective tool and stop there.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
