The hidden cost of WordPress (in)security

WordPress security gets talked about in the abstract ("keep it updated", "install a security plugin") until one day it stops being abstract. Let's put numbers on what it really costs, because it's the line on the bill nobody puts in the spreadsheet until it arrives.

Why WordPress is a target

It's not that WordPress is badly built. It's that it's everywhere — four out of every ten websites in the world — and that makes it the favourite target. Attackers aren't after you specifically: they launch bots that probe millions of sites looking for an outdated plugin, a weak password, an old version. If your site is one of them, they get in. And the surface is huge: the core, the theme, and every one of the plugins you've installed along the way.

The bill for a hack

• Cleanup: from €150 and a lost afternoon (or several) to remove the malware and close the hole.
• Downtime: every hour with the site down or showing spam is business and trust walking out the door.
• Rankings: if Google detects that your site is spreading malware, it flags it as unsafe and pulls you out of the results. Recovering from that takes weeks or months.
• Data and reputation: if there was customer data involved, you're in GDPR territory and facing a very awkward conversation.
• The second time: if the door isn't closed properly, it happens again.

The cost you do see: keeping it safe

And here's the unfair part: even if you don't get hacked, security is already costing you. It costs the hours (yours or whoever maintains the site) spent updating core, theme and plugins without anything breaking. It costs the premium security plugin. It costs the fear of updating. It's a continuous tax for having an attack surface that needs watching.

WordPress security isn't "install a plugin and forget about it". It's perpetual maintenance: the moment you stop updating, the countdown starts. That's why so many small-business sites end up hacked: nobody has time to be the sysadmin WordPress needs.

How a static site removes the problem

Here's the good part. A static site in Next.js has no server to attack: no PHP running, no exposed database, no public login panel, no plugins to update. It serves HTML files from the edge. The attack surface that's so costly to watch in WordPress simply disappears. It's not that it's "more secure": it takes almost everything that can break out of the equation.

Added to the rest of the bill — we covered it in what your WordPress really costs — (in)security is one of the most solid reasons to stop maintaining and start rebuilding.

Is your WordPress up to date, or have you been putting off updates for months? In the free audit we look at your exposure and tell you what you'd gain by getting rid of it. No scaremongering, just data.