If you own a business website, there is a good chance it runs on WordPress. It powers a huge share of the web, and for years it was the easy answer for small businesses. In 2026, it also became one of the clearest examples of why how a website is built matters as much as how it looks.
This post explains, in plain terms, how most websites get hacked, what happened this year and why a different way of building websites, static sites, takes most of that risk off the table.
How most websites get hacked
A typical WordPress site is not one piece of software. It is a stack of them: the PHP language on the server, WordPress itself, a theme and usually ten or more plugins for forms, backups, sliders, SEO and so on. Every time someone visits a page, that whole stack wakes up, reads from a database and builds the page on the spot.
That is convenient, but it means a lot of code is running and reachable from the internet all the time. If any one piece has a flaw, an attacker can use it. And the site owner is relying on dozens of separate companies to write secure code, and on themselves to install every fix faster than attackers can move.
2026: a bad year for WordPress
This year showed how often that goes wrong:
- A backup plugin on 3 million+ sites (June). A critical flaw, rated 9.8 out of 10, let anyone take admin control of a site with no username or password. Attacks started three days before a fix was released, and one large host still found more than 128,000 sites running the vulnerable version over a week later.
- A popular form plugin (August). The plugin maker’s own update server was hacked, and for about five hours it delivered an update with a hidden backdoor. The site owners who updated promptly, exactly as they were told to, were the ones who got hacked.
- PHP itself (October). Two critical flaws in the language WordPress runs on let attackers take over a web server with a single request. Attackers were using them days before a fix existed, and US government security agencies issued urgent warnings.
The bigger numbers tell the same story. Independent security firm Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on the year before. 91% were in plugins, 46% had no fix on the day they went public, and heavily targeted flaws were attacked within a median of five hours.
What a static website does differently
A static website is built ahead of time. Instead of assembling each page when someone visits, every page is turned into a finished file before it ever goes live. When a visitor arrives, the server simply hands them that file, the same way it would hand over an image.
That one change removes most of what attackers go after:
- No server code running for visitors. There is nothing to trick into misbehaving.
- No database on the website. There are no stored records to steal or corrupt.
- No admin login on the domain. There is no password to guess and no login page to hammer.
- No plugins. Nothing to patch every week, and no third-party update that can arrive infected.
Served from a global network like Cloudflare’s, a static site is also fast everywhere and sits behind large-scale protection against traffic floods.
But what about forms?
Forms are where many sites leak. On WordPress, the contact form is usually a plugin running on your server and saving every enquiry in your site’s database. A good static setup moves forms off the website entirely: the form is hosted on a separate, secured service, entries are checked for spam and stored encrypted, and your website just displays it. Nothing on the site itself is left holding customer data.
Can a static site never be hacked?
No, and anyone who promises that isn’t being straight with you. Nothing connected to the internet is unbreakable. The accounts behind a website (hosting, domain, code) still need strong, unique passwords and two-factor login, and changes still need to be reviewed and versioned so mistakes can be rolled back.
The difference is that the doors attackers actually used this year, plugins, forms and the server language underneath, are not there to begin with. Instead of patching holes faster than attackers find them, a static site simply doesn’t have those holes.
The bottom line
If your website runs on plugins, its safety depends on everyone who wrote them, and on you updating in time. A static website takes that weight off your plate: faster pages, nothing to patch and very little for an attacker to aim at.
We rebuild business websites this way at IdeaSwell. For the full comparison, including the numbers behind “at least 27 times more exposure” and every source, see our page on website security.
