Penetration Test Reveals: How Secure Is Your WordPress Website Really?

WordPress is by far the most popular content management system in the world. It runs more than 40 percent of all websites on the internet. That huge reach makes WordPress a favorite target for cybercriminals. In our penetration tests, we often find critical flaws in WordPress sites. This happens even at firms that think their website is well secured. This article shows the most common flaws and how you can protect your WordPress site.

Why WordPress Is a Popular Attack Target

WordPress's popularity is both a blessing and a curse. On one hand, users get a vast range of themes and plugins, an active community, and regular updates. On the other hand, this reach is what makes WordPress so attractive to attackers. A single working exploit can hit millions of websites. Attack bots scan the internet for weak WordPress sites around the clock. And since the code is open source, attackers can study it to find flaws.

The Most Common Flaws We Find in Our Penetration Tests

1. Outdated Core Version, Plugins, and Themes

This is by far the most common issue in our WordPress pentests. Old software has known flaws, and public exploits for them often exist. Third-party plugins are the biggest risk, because they are often kept up to date less carefully than the WordPress core. In a typical WordPress site, we find three to five plugins on average with known, unpatched security flaws.

2. Weak Authentication

Simple usernames like "admin" with weak passwords are still common. Without rate limiting or account lockout, attackers can run brute force attacks on the WordPress login page. Everyone knows the default login URL /wp-admin, and attack bots target it on their own. Missing two-factor authentication makes the problem worse.

3. XML-RPC Abuse

Many WordPress sites have the XML-RPC interface (xmlrpc.php) turned on, even though most of them don't need it. Attackers can abuse it for:

• amplified brute force attacks,
• DDoS amplification attacks,
• SSRF (Server-Side Request Forgery) attacks.

The system.multicall method is a special risk. It lets attackers bundle hundreds of password guesses into a single HTTP request.

4. Missing Security Headers

In almost every WordPress pentest, key HTTP security headers are missing. These include Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security. The headers add one more layer of protection against Cross-Site Scripting (XSS), clickjacking, and other client-side attacks. And they take very little effort to set up.

5. Information Disclosure

By default, WordPress gives away a lot of details that help attackers plan a targeted attack:

• the WordPress version in the HTML source code,
• a list of installed plugins and their versions,
• user enumeration through the REST API,
• the WordPress core readme.html,
• detailed PHP error messages in production.

Each of these details helps an attacker sharpen the attack.

Concrete Protective Measures

Basic Hardening

• Regular updates: turn on automatic updates for the WordPress core. Set up a process to update plugins and themes on time.
• Strong authentication: require complex passwords, use 2FA, and limit login attempts. Think about renaming the login URL.
• As few plugins as possible: fully remove plugins you don't need. Each extra plugin makes the attack surface larger.
• File permissions: set them correctly. Use 644 for files and 755 for directories. wp-config.php should be 400 or 440.

Advanced Measures

• Web Application Firewall (WAF): a WAF filters harmful traffic. It blocks known attack patterns before they reach WordPress.
• Content Security Policy: use a strict CSP to stop XSS and other injection attacks.
• Change the database prefix: the default prefix wp_ makes SQL injection attacks easier. Use your own prefix.
• Restrict the REST API: allow only logged-in users to access the WordPress REST API. This stops user enumeration.
• Monitoring and logging: set up security monitoring that spots odd activity. Examples are unusual login attempts, file changes, and new plugin installs.

Conclusion

WordPress can run securely. For that, the basics (updates, authentication, few plugins) and extra measures (WAF, CSP, monitoring) must come together. A professional penetration test finds the weak spots of your own site. It ranks them by real business risk. Work through them step by step and shorten the time from finding to fix. Then you stop being easy prey for bots that never stop scanning.