Security guide
WordPress vs a Custom Website: Is Moving Safer?
Moving to a custom website is safer for one specific reason the evidence supports: most WordPress vulnerabilities are in plugins, and a custom build has no plugin marketplace running on your server. In 2025, Patchstack counted 11,334 new WordPress ecosystem vulnerabilities, 91% in plugins, 9% in themes and only 6 in core. A custom site is not automatically secure, though: it trades plugin risk for your own code and dependencies, and it still needs maintenance.
By Web Your Vyavsay team · Published
Drafted with AI assistance. Claims are checked against the sources listed below and reviewed by our team.
Statistics are from Patchstack’s own report; links are at the end. We build custom sites, so we say plainly where WordPress is the better choice.
Is WordPress itself insecure?
Mostly no. WordPress core is rarely where the vulnerabilities are. Of the 11,334 new vulnerabilities Patchstack recorded across the WordPress ecosystem in 2025, 91% were in plugins and 9% in themes. Core had six, all low priority. Patchstack’s earlier 2021 report put core at 0.58% of the total.
Why do WordPress sites get hacked so often?
Because of the plugin ecosystem and how fast attackers move, not because core is weak. Patchstack’s 2025 figures point to four causes:
- Unpatched plugins: 46% of vulnerabilities had no developer fix at the time they were disclosed.
- Speed: about half of high-impact vulnerabilities were exploited within 24 hours, and the median time to mass exploitation for heavily exploited ones was 5 hours.
- Access-control flaws: broken access control was the most exploited category.
- Sites left unpatched: attackers keep targeting older vulnerabilities on sites that are not kept up to date.
The total also keeps growing: 11,334 new vulnerabilities in 2025, up 42% on 2024.
Does CVE-2026-87902 mean WordPress core is unsafe?
It is the exception, not the pattern. CVE-2026-87902 is a flaw in WordPress core itself, fixed on September 22, 2026, and exploited within hours. Core flaws of this size are unusual, and a patched site is not unsafe because of it. See what to do about CVE-2026-87902.
Is a custom-built website more secure than WordPress?
It can be, mainly because it removes the biggest source of WordPress vulnerabilities, but it is not secure by default. Here is the honest comparison:
| WordPress | Custom build | |
|---|---|---|
| Third-party plugin code | The main source of vulnerabilities (91% in 2025) | No plugin marketplace on your server |
| Mass automated scanning | A known target for scanners that probe every WordPress site | No known plugin or core versions for scanners to match |
| Server-side runtime on public pages | PHP runs for visitors | Pages are prerendered; no PHP |
| Your own code and dependencies | Theme and custom code | Custom code plus npm packages: a smaller but real risk that needs updates |
| Review by others | Core and popular plugins are widely reviewed | Reviewed only by the team that builds and maintains it |
Will moving platforms stop my site being hacked?
No, not on its own. Moving removes plugin and platform risk. It does not fix weak passwords, a poorly secured host, unpatched dependencies, or bugs in new code. If those are the real problem on your current site, they will follow you to the new one.
Should I move away from WordPress?
Move if most of the left column is true for you. Stay and harden if most of the right is.
| Consider moving | Stay and harden | |
|---|---|---|
| Plugins | Many, covering login, forms, membership, payments | A few well-maintained ones |
| Updates | No one owns them; sites sit unpatched | Someone patches within days |
| Login and access | You need MFA, SSO or custom roles | Standard roles are enough |
| Editing | Content changes rarely | Staff edit pages daily |
What are the middle options?
- Harden WordPress: fewer plugins, a reputable managed host, prompt updates, backups and a web application firewall.
- Go headless: keep WordPress for editing and serve the public site from a separate front end, which removes the public PHP layer but keeps the admin to protect.
- Export a static version: suits sites that rarely change.
- Move to a custom build: best when you also need custom login, roles or workflows. See our WordPress migration service below.
What do we do differently?
We build custom sites and systems with prerendered pages and no plugin layer, with login and access designed in: JWT with refresh-token rotation, role-based access, MFA and SSO, with tokens signed and encrypted in our client projects. We also keep dependencies updated after launch, because a custom site is only as safe as its upkeep. If a patched WordPress site fits you, we will tell you to keep it.
How a WordPress to Next.js migration works · How to choose a development company