What 504,281 real-world scans tell us about the security posture of WordPress sites — and what it means for yours.
The average WordPress site in our dataset scores 49/100 (D). Across 56,988 scans in the last 30 days, 56,988 scans found at least one security issue.
The most common problems aren't exotic zero-days — they're basic hygiene failures: missing security headers, permissive Content Security Policies, exposed server banners, and outdated plugins with known CVEs. The good news: most of these are fixable in minutes.
| Security Check | Pass Rate | Status |
|---|---|---|
| SSL/TLS Configuration | 6.5% |
|
| Security Headers | 0.3% |
|
| CSP Policy | 0.0% |
|
| Cookie Security | 82.6% |
|
| Mixed Content | 66.0% |
|
| Server Banner | 1.3% |
|
| Version Exposure | 64.0% |
|
| TLS Protocols | 94.9% |
|
| Issue | Count | % of Scans |
|---|---|---|
| Security Header | 27854 | 48.9% |
| Server Banner | 4943 | 8.7% |
| Ssl Expiration | 4628 | 8.1% |
| Email Security Dmarc | 4335 | 7.6% |
| Performance | 3942 | 6.9% |
| Robots Txt Leakage | 2191 | 3.8% |
| Sitemap | 2038 | 3.6% |
| Http To Https Redirect | 2013 | 3.5% |
| Mixed Content | 1781 | 3.1% |
| Js Library Vulnerability | 1108 | 1.9% |
| # | Industry | Avg Score | Scans |
|---|---|---|---|
| 1 | Junk_Removal | 60.0 | 11 |
| 2 | Insurance | 55.4 | 285 |
| 3 | Home_Improvement | 54.7 | 233 |
| 4 | Cleaning | 54.5 | 228 |
| 5 | Manufacturing | 54.3 | 3502 |
| 6 | Government | 53.8 | 673 |
| 7 | Restoration | 53.8 | 88 |
| 8 | Professional_Services | 53.8 | 1738 |
| 9 | Real_Estate | 53.7 | 974 |
| 10 | Garage_Doors | 53.7 | 17 |
| 11 | Construction | 53.4 | 1090 |
| 12 | Moving_Storage | 53.4 | 291 |
| 13 | Flooring | 53.2 | 88 |
| 14 | Security | 53.2 | 277 |
| 15 | Finance | 53.1 | 955 |
The ThreatSpot WordPress Security Index is the average security score across all scans performed in the last 30 days. Each site is scored 0–100 based on SSL/TLS configuration, security headers, cookie security, server version disclosure, mixed content, and known vulnerable plugins (cross-referenced with NVD, CISA KEV, and EPSS data). All data is anonymized and aggregated — no individual site domains are exposed. Statistics are only published when minimum sample sizes are met.
Run a free scan and see your score vs the global average.
Scan My Site Free