A Website With Nothing to Break Into

These are real incidents from this year, all in software that runs on millions of WordPress sites.

UpdraftPlus (backup plugin, 3 million+ sites), June 2026. A critical flaw, rated 9.8 out of 10, let anyone take admin control of a site without a username or password. Attacks began three days before a fix was released. One large host alone found more than 128,000 sites still running the vulnerable version and force-updated them nine days after attacks started.

Fluent Forms Pro (form plugin), August 2026. The plugin maker's own update server was compromised. For about five hours it delivered a version with a hidden backdoor built in, also rated 9.8 out of 10. Site owners who did exactly the right thing, updating promptly, were the ones who got hacked.

PHP2Shell (the language WordPress runs on), October 2026. Two critical flaws in PHP itself let attackers take over a web server with a single request, no login required. Attackers were using them four days before the fix was published, and CISA and the NSA both issued urgent patch warnings.

Independent WordPress security firm Patchstack reported for 2025:

• 11,334 new vulnerabilities in the WordPress ecosystem, up 42% on the year before
• 91% were in plugins; only 6 were in WordPress itself
• 46% had no fix available on the day they became public
• Heavily targeted flaws were attacked within a median of 5 hours
• Hosting company firewalls blocked only 26% of attacks

The lesson: on WordPress, staying safe depends on dozens of separate companies all writing secure code, and on you updating faster than attackers move. Sometimes, as with Fluent Forms Pro, even that isn't enough.

We compared a typical WordPress site (WordPress, PHP, 10 plugins and a theme) with one of our static sites, counting only security flaws published January to October 2026.

A static site has nothing for these flaws to attack, so its true count is zero. To be conservative, we gave our sites one imaginary flaw per year anyway. WordPress still comes out at about 27 flaws in ten months, and that is counting just PHP and two plugins. Add the other eight plugins and the gap only grows.

The framework we build with, Astro, has had around 20 published security issues in the past two years. Every one of them affects only server-run features or the developer's own computer. None affect a fully static site like ours.

On a typical WordPress site the contact form is a plugin that runs on your web server, stores every enquiry in your site's database and has to be kept patched. One hole in a form plugin can expose every entry or hand over the whole site.

We built our own forms system to remove that risk. Your form is hosted on our secure platform and your website simply shows it. Every entry is checked for spam and bots, stored encrypted and emailed to your team. Your form can't be used to send mail to strangers in your name, and only the right people on your team can see entries.

No, and anyone who promises that isn't being straight with you. Nothing connected to the internet is unbreakable. Even NASA has been hacked.

What we can promise is this: we have removed the doors attackers actually use. Every major WordPress compromise this year came through code running on the website itself: a plugin, a form, the PHP language underneath it all. Our sites don't have that code, so those attacks have nothing to land on.

For what remains, we take every reasonable measure:

• The accounts behind your site (hosting, code and domain) are protected with strong, unique passwords and two-factor login, with access limited to the people who need it.
• Every change is reviewed and versioned, so anything that goes wrong can be rolled back in minutes.
• The tools we build with are kept current and checked for known security issues before they reach your site.
• Your forms run on our own platform, with automated security tests on every change.

Because a static site has so little that can go out of date, it stays secure for years, not just until the next plugin update. Security is built in from the start, not bolted on afterward.

Figures as of October 2026.

• Wordfence: UpdraftPlus authentication bypass (June 2026)
• SiteGround: UpdraftPlus vulnerability patched
• WP Content: Fluent Forms Pro supply chain attack
• Wordfence: Fluent Forms vulnerability listings
• Datadog Security Labs: PHP2Shell
• CISA: critical vulnerabilities in PHP
• Patchstack: State of WordPress Security in 2026
• OpenCVE: Astro security issues