WordPress

WordPress at a glance

WordPress powers a very large share of the web — from blogs to business sites. The project ships regular releases with automatic background updates for security and minor versions; as the most-attacked CMS, staying current is non-negotiable.

For admins the core is usually the easy part (auto-updates handle most security releases). The real risk lives in plugins and themes: they are the dominant attack vector, so keep them minimal, current, and from reputable sources, and remove what you don't use. Enable auto-updates where safe, but test major core and plugin updates on a staging copy first, and back up before larger changes. Harden logins (strong credentials, two-factor, limited attempts) since brute-forcing is constant. Keep the underlying PHP supported. Subscribe to security advisories for your active plugins.