> ## Documentation Index
> Fetch the complete documentation index at: https://insights.expirio.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Website Security
See the [Security checklist](/security-checklist)
When was the last time you thought about your website's security?
If you're like most marketers, the honest answer is: the last time something broke. As Josh puts it in our video — security is like insurance. Easy to ignore, boring even, until there's water leaking through your neighbor's ceiling. Then it's the only thing you care about.
Here's the uncomfortable part: if you're in marketing, the website is probably *yours*. Not IT's, not the agency's — yours. You inherited it along with the CMS logins, the plugins someone installed in 2021, and a vague sense that "the agency handles that." Nobody trained you for this. Yet when the site goes down, gets defaced, or starts ranking for casino keywords, it's your traffic, your leads, and your name in the Monday meeting.
So let's look at what's actually happening out there — and then give you a checklist you can complete in one afternoon, no technical skills required.
### The state of web security, in numbers
**Attackers are faster than your update routine.** When a new vulnerability is published, the median time before someone exploits it is **5 hours** (Patchstack, 2026). Attackers start scanning for it within about 15 minutes. If your site gets updated "once a month, when someone remembers," you're not in the race.
**The problem isn't WordPress — it's everything bolted onto it.** In 2025 alone, researchers logged **11,334 new vulnerabilities** in the WordPress ecosystem. Only six were in WordPress core. **91% were in plugins** — someone else's code, maintained on someone else's schedule, exactly as Josh says in the video. Worse: **46% of those vulnerabilities had no fix available** at the moment they became public. And this isn't theoretical neglect — roughly **7 in 10 public WordPress sites** aren't running a supported version of the core software (Censys, 2026). Sites with 20+ plugins are 3× more likely to be infected. So the real question isn't "is WordPress secure?" It's the one from the video: *who updates your plugins? Whose name is on that?*
**"Nobody would target our little custom CMS" is a myth.** Your agency-built CMS isn't flying under the radar, because there is no radar to fly under. Attacks aren't personal — they're automated. A newly exposed website is discovered by malicious scanners within **3 minutes** (Orca Security). Over **half of all web traffic is bots**, and 37% of *all* internet traffic is malicious bots (Imperva, 2025). The difference is that WordPress flaws get found and patched by a global community. Your custom CMS has no security advisories, no patch channel, and — statistically — has never been tested: only about a third of EU companies run any security testing at all (Eurostat). Security through obscurity is such a known trap that it has an official weakness ID (CWE-656).
**Most break-ins use the front door.** Forget Hollywood hacking: **88% of web application breaches involve stolen credentials** (Verizon DBIR, 2025). And once inside, attackers make themselves at home — **55% of hacked sites** were found with an admin account the owner never created (Sucuri). Meanwhile, ex-employees and former agencies quietly keep their access for years.
**When it goes wrong, recovery is where companies fail.** 92% of businesses say they have backups. **31% can't actually restore them** when it matters (At-Bay insurance claims data). Only 27% of website professionals have any breach recovery plan. And the stakes are European-regulation real: British Airways was fined **£20M** after code was injected into its own website. Ticketmaster paid £1.25M for a compromised chatbot on its payment page. 23andMe paid £2.31M for allowing credential stuffing without mandatory 2FA. With NIS2 now covering companies from 50 employees up in many sectors, "we didn't know" is no longer a strategy — 59% of European SMEs were hit by a cyber-attack in the last 12 months (Hiscox, 2025).
None of this means your website is doomed. It means your website needs an *owner*. Let's find out how yours is doing.