Every week, ThreatSpot scans thousands of WordPress sites — checking SSL/TLS configuration, security headers, cookie security, version exposure, and known vulnerable plugins. Instead of keeping that data private, we publish it as a live, public benchmark: the WordPress Security Index.
Here's what the data actually shows.
The average site is a C
The global index score — the average security score across all scans in the last 30 days — sits in the C range. That's not a failing grade, but it's not a good one either.
What's striking is why sites lose points. The most common issues in our dataset are:
- Missing or weak security headers
- Permissive Content Security Policies
- Exposed server version banners
- Cookies without
SecureorHttpOnlyflags - Outdated plugins with known CVEs
None of these require nation-state resources to exploit. They're the kind of misconfigurations that automated scanners (and attackers) find in seconds.
The gap between "passing" and "secure"
A C average means most sites clear the bar on the basics — HTTPS works, TLS is configured, no obvious mixed content. But security is cumulative. A site that passes every individual check can still be one outdated plugin away from compromise.
In our data, the sites that score highest aren't the ones running the most security plugins. They're the ones with:
- Strict, well-tuned CSPs
- All cookies flagged
SecureandHttpOnly - No version disclosure in headers or HTML
- Plugin inventories that stay current
What this means for your site
The good news: the most common issues are fixable in minutes. The bad news: most site owners don't know they have them.
You can check where your site lands right now — the live index shows the current score, grade distribution, and trending CVEs, and a free scan will benchmark your site against the global average.
Methodology
The index is the average score of all scans performed in the trailing 30-day window. Each site is scored 0–100 across SSL/TLS, headers, CSP, cookies, mixed content, version exposure, and vulnerable plugins (cross-referenced with NVD, CISA KEV, and EPSS). All data is anonymized and aggregated — we never publish individual site domains.
The data is live and continuously updated. See the full index or embed it on your own site.