WordPress Security: Your Firm’s Least-Guarded Front Door

By Spencer McLennan · Published August 6, 2024 · Updated July 2026

Why the website is target number one

Roughly 42% of all websites run on WordPress.¹ That dominance is exactly what makes it the most thoroughly studied attack surface on the internet. Every weakness that surfaces in the WordPress ecosystem gets indexed, published, and folded into automated tooling within days — tooling that then scans the entire web looking for sites that haven't caught up yet.

Nobody is sitting at a keyboard deciding to target your firm specifically. Bots are knocking on every door on the street, continuously, checking which ones are unlocked. Yours is on the same street.

The counterintuitive part: the danger usually isn't "WordPress"

Here is the finding that reframes the problem.

In 2024, 7,966 new vulnerabilities were disclosed across the WordPress ecosystem — about 22 per day, and a 34% jump over the year before. Of those, 96% were in plugins and 4% were in themes. Seven were in WordPress core itself, and none posed a widespread threat.²

The 2025 numbers went the same direction, harder: 11,334 new vulnerabilities, a 42% increase, still overwhelmingly plugin-driven, with six low-priority issues in core.³

Read that again with your own site in mind. The risk almost never lives in WordPress. It lives in the add-ons — the contact-form plugin, the page builder, the SEO tool, the slider, the appointment scheduler, the analytics connector. The things a previous web person installed once, for a reason nobody remembers, and never updated.

Two more numbers make this concrete. Roughly 43% of 2024's WordPress vulnerabilities could be exploited without any login at all — no credentials, no insider, just a request from the open internet.⁴ And 46% of vulnerabilities in Patchstack's 2025 analysis were not fixed by the developer before the flaw was made public³ — meaning that for a meaningful share of these issues, the exploit is public knowledge while the patch does not yet exist.

An abandoned plugin isn't dormant. It's a standing, published invitation.

What a compromised site actually costs a firm

A hacked website sounds like an IT embarrassment. For a law firm it's a confidentiality problem, because a site is rarely the destination — it's the foothold.

What an adversary does with it:

• Harvests credentials from your login page, then tries those same credentials everywhere else your people log in (that's Chapter 2).
• Redirects your prospective clients to a lookalike site, or serves them malware — meaning the harm lands on the people who trusted your firm enough to click (that's Chapter 8).
• Sends mail as you. A compromised site on your domain is a credible launchpad for phishing aimed at your own staff, your clients, and opposing counsel.
• Pivots inward toward anything the site touches: the hosting account, the DNS records, the CRM the intake form feeds, the mailbox that receives it.

The profession's own numbers say this isn't hypothetical. In the ABA's 2023 Legal Technology Survey, 29% of responding firms reported having experienced a security breach — and another 19% said they didn't know whether they had.⁵

What actually fixes this

In priority order, because not all of this is equally urgent:

1. Update on a schedule, not on a scare. Core, plugins, and themes, on a defined cadence, with a staging check so an update never takes the site down. Given how fast disclosure-to-exploit moves, quarterly is no longer a cadence — it's a gap.

2. Delete what you don't use. Every deactivated-but-installed plugin is still code sitting on your server. If a plugin is abandoned by its developer, it will never be patched — that's not a maintenance item, it's a removal item.

3. Put a firewall in front of it. A web application firewall (or virtual patching) is what covers the window between "the flaw is public" and "the developer ships a fix" — the window that, on the numbers above, is open nearly half the time.³

4. Harden the front door. No admin username. Multi-factor authentication on every administrative login. Rate-limit login attempts so credential-stuffing runs die on arrival.

5. Back up somewhere else. Off-site, versioned, and — this is the part people skip — actually restored once to confirm the backup works. An untested backup is a hypothesis.

6. Watch it. Monitoring is how you avoid being in that 19% who don't know. Detection is a named part of the reasonableness standard, not an extra.⁹

How we can help

Everything on that list is recurring, invisible, and unbillable to your clients. It is exactly the work that doesn't get done — not because firms don't care, but because it never becomes urgent until the day it becomes an emergency.

That's the entire reason this service exists. We maintain law firm websites: managed updates, plugin inventory and removal, firewall and monitoring, hardened logins, tested backups. Not a project. A standing arrangement, so that "reasonable efforts" is something your firm can actually document rather than something it hopes was true.

Your firm's WordPress security checklist

• Core, plugins, and themes updated on a defined schedule
• Unused and abandoned plugins removed, not just deactivated
• Web application firewall or virtual patching in place
• MFA on every administrative login; no default admin account
• Login attempts rate-limited
• Off-site backups running — and restored at least once to prove they work
• Monitoring in place, so you know if the site gets downed or changed

Spencer McLennan is the founder and lead webmaster of LegalWebmasters, and has handled websites, hosting, and security for law firms and professional practices across the United States and Canada since 2007. He holds an MBA, a PCM from the American Marketing Association, and is a graduate student in intelligence studies. He writes the Law Firm Cybersecurity and Law Firm SEO & Design guides. Connect on LinkedIn.