WordPress

WordPress security — why it's targeted and the minimum defenses

WordPress has the largest share, so it's statistically the biggest target. The entry points are less the core than plugin/theme vulnerabilities, skipped updates, weak/reused admins, and exposed admin surfaces (wp-admin/xmlrpc/REST enumeration). Defenses: automate core+plugin updates, delete unused plugins/themes, strong password + 2FA for admins, limit admin exposure and login attempts, tamper detection plus offline backups.