Your WordPress plugins are the way in
Most small business websites on WordPress run a dozen plugins or more: one for the contact form, one for the photo gallery, one for the cookie banner, one for search rankings, and so on. Each plugin is a small program written by someone else, updated on its own schedule, and sitting inside your website. That is where the trouble starts.
What the numbers say
Patchstack, a company that tracks WordPress security, counted 11,334 new vulnerabilities across the WordPress world in 2025, 42% more than the year before. A vulnerability is a hole someone has found that could let an attacker in.
Of those, 91% were in plugins and the other 9% in themes. Only 6 were in WordPress itself, and Patchstack rated those low priority. WordPress is looked after by a large team. The add-ons that make it useful are not, so the holes are in them.
The same pattern is true of Concrete5, Joomla, Drupal or similar: a core system, plus add-ons from other people, each one a way in.
Why that lands on a small business
A hole is only dangerous on a site that has not been fixed. Fixing it means someone noticing that an update is out, applying it, and checking the site still works. With a dozen plugins, that is a regular job, and it falls to whoever looks after your site, whether that is a retainer you pay every month or nobody in particular.
Attacks like this are mostly automated. A program looks for sites running a plugin with a known hole, and it does not matter how big or small the business behind the site is. You are not chosen. You are found, because the version of a plugin on your site has a hole someone has published.
What a static site does not have
A static site is a folder of finished pages. There is nothing running when someone visits, and that removes the things the holes are in:
- No plugins. Nothing to fall out of date, and nothing for a hole to be in.
- No database. Nothing for an attacker to read or change.
- No admin login. No page to guess passwords on, and no account to be taken over.
- No code that builds each page. Every page already exists, so there is nothing to trick into running something it should not.
That is why a Stillsite site has no patching to do. There are no updates to wait for or apply, because nothing on the site is being updated. You can see how the pieces compare in Traditional versus static websites.
What this does not mean
A static site is not beyond attack. What is left to protect is the domain and the hosting account, which Stillsite protects with two-factor sign-in, and your own passwords and email, which are yours. The contact form still needs something behind it to send the message, and it is a small separate service with a bot check in front, looked after for you rather than a plugin on your site.
The difference is how much there is to look after. A traditional site has a long list. A static site has a short one.
If you run WordPress now
Whichever way you go, it is worth five minutes:
- Open the plugins page and see how many are waiting for an update.
- Remove the ones you no longer use. A plugin switched off can still be a way in; a plugin deleted cannot.
- Turn on automatic updates for the rest, if your site allows it.
- Ask whoever looks after the site who is watching for new holes, and how they would tell you.
If the answers are “too many”, “I don’t know” and “nobody”, that is the cost of the way the site is built, not a fault of yours. Send us the address and we will tell you what moving to a static site involves.
Source: The State of WordPress Security in 2026, Patchstack.