Yes, by design. A WordPress site runs PHP, a database, an admin login and plugins on a public server, and in 2025 Patchstack counted 11,334 new WordPress ecosystem vulnerabilities, 91% of them in plugins. A static site is published as finished files with no runtime, database, login or plugins, so those attack paths don't exist. WordPress can be run securely, but the patching never ends.
Why plugins are the weak point
Patchstack's report on 2025 found 11,334 new vulnerabilities across the WordPress ecosystem: 91% in plugins, 9% in themes, and only 6 in WordPress core. 46% weren't fixed in time for public disclosure, so they became public while the affected plugin was still unpatched. Weighted by how heavily flaws were attacked, the median time from disclosure to the first exploit was 5 hours.
That's the real cost of WordPress security: not that it can't be done, but that someone has to watch every plugin on every site, every week, and update fast.
What a static site removes
- No PHP or other code running when a visitor loads a page
- No database to inject into or leak
- No admin login page to guess at
- No plugins, so no plugin vulnerabilities
- Every deploy rebuilt from source, so a tampered file can't persist
What's still your job
A static site removes the application risk, not every risk. Keep two-factor login on your domain registrar, your DNS and the hosting and repository accounts, decide where sensitive form data like résumés should go, and know who holds each account. The IT checklist covers each one.
When WordPress still makes sense
If many people publish every day, or the site depends on WordPress-only tools your team relies on, WordPress with a strict update routine and a care plan may fit better. For a typical business site that changes a few times a month, a static site is the lower-risk and lower-effort choice.
Source: Patchstack, State of WordPress Security in 2026, checked September 25, 2026.
Related questions
Is WordPress itself insecure?
WordPress core is well maintained: Patchstack counted only 6 core vulnerabilities in 2025, all low priority. The risk is the ecosystem around it, the plugins and themes a typical site depends on, and how quickly each one gets updated.
Does a static site need a firewall?
There's no application on a static site for a web application firewall to protect. If your IT team wants a firewall layer and request logs anyway, Cloudflare can sit in front of the site.