What 339,471 real-world scans tell us about the security posture of WordPress sites — and what it means for yours.
The average WordPress site in our dataset scores 48/100 (F) — a passing grade, but far from secure. Across 84,008 scans in the last 30 days, 84,008 scans found at least one security issue.
The most common problems aren't exotic zero-days — they're basic hygiene failures: missing security headers, permissive Content Security Policies, exposed server banners, and outdated plugins with known CVEs. The good news: most of these are fixable in minutes.
| Security Check | Pass Rate | Status |
|---|---|---|
| SSL/TLS Configuration | 5.9% |
|
| Security Headers | 0.3% |
|
| CSP Policy | 0.0% |
|
| Cookie Security | 81.5% |
|
| Mixed Content | 62.9% |
|
| Server Banner | 1.3% |
|
| Version Exposure | 64.8% |
|
| TLS Protocols | 94.9% |
|
| Issue | Count | % of Scans |
|---|---|---|
| Unknown | 62497 | 74.4% |
| # | Industry | Avg Score | Scans |
|---|---|---|---|
| 1 | Manufacturing | 48.8 | 4579 |
| 2 | Retail | 46.3 | 6698 |
| 3 | Dental | 46.3 | 11845 |
| 4 | Insurance | 45.9 | 829 |
| 5 | Security | 45.1 | 527 |
| 6 | Agriculture | 45.1 | 1450 |
| 7 | Fitness | 44.9 | 1199 |
| 8 | Towing | 44.5 | 71 |
| 9 | Hvac | 44.4 | 1784 |
| 10 | Education | 44.2 | 3541 |
| 11 | Healthcare | 44.1 | 5549 |
| 12 | Entertainment | 43.7 | 4394 |
| 13 | Painting | 43.6 | 453 |
| 14 | Pet_Services | 43.5 | 708 |
| 15 | Moving_Storage | 43.4 | 620 |
The ThreatSpot WordPress Security Index is the average security score across all scans performed in the last 30 days. Each site is scored 0–100 based on SSL/TLS configuration, security headers, cookie security, server version disclosure, mixed content, and known vulnerable plugins (cross-referenced with NVD, CISA KEV, and EPSS data). All data is anonymized and aggregated — no individual site domains are exposed. Statistics are only published when minimum sample sizes are met.
Run a free scan and see your score vs the global average.
Scan My Site Free