It is almost never WordPress itself
The core is not usually the weak point. The add-ons are. In 2025, 11,334 new weaknesses were found across the WordPress ecosystem, a 42% rise on the year before. Of those, 91% were in plugins, and 46% had no fix available by the time they became public knowledge (Patchstack, State of WordPress Security in 2026).
The number that matters to a business owner
Read that last one again: in nearly half of cases there was nothing to install even if you were watching closely.
How sites end up this way is ordinary enough. Each plugin was added to solve one thing: a form, a gallery, a booking calendar, a pop-up somebody wanted in 2019. Nobody removed any of them. Now twenty-odd pieces of other people's code run on your site, and each is maintained by a stranger who may have moved on.
What we look at when we take one of these on
- Which add-ons are doing something your business still needs.
- Which are duplicates of each other.
- Which are abandoned by whoever wrote them.
- Which could be replaced by a few lines inside your own build instead.
Most sites finish a rescue with a fraction of what they started with, because a rebuilt site does in its own code what a pile of add-ons was doing badly. Fewer strangers in your website is both safer and calmer.