How does your site compare?

Benchmark your website against 349,457 real-world WordPress sites (504,281 total scans). Free, instant, no credit card.

Non-invasive read-only analysis · Results in ~60 seconds

WordPress Security Index

Live security benchmark from 349,457 real-world WordPress sites across 504,281 security scans, continuously analyzed by ThreatSpot.

Average Grade

49/100

Websites Scanned

349,457

504,281 total scans

30-Day Change

▲ +2.0

index points, month over month

Scans Today

live data

Updated November 05, 2026 · —

Sites Scanned Today

Issues Found Today

Avg Score Today

Critical Issues Today

Grade Distribution

0.7%

376

2.5%

1276

39.4%

19866

32.7%

16480

24.6%

12375

Category Pass Rates

Check	Pass Rate
SSL/TLS Config	6.5%
Security Headers	0.3%
CSP Policy	0.0%
Cookie Security	82.6%
Mixed Content	66.3%
Server Banner	1.3%
Version Exposure	64.0%
TLS Protocols	94.9%

What the data tells us

HTTPS isn’t the problem anymore. Hardening is.

94.9% of sites pass our TLS protocol checks, but only 0.0% pass the CSP benchmark.

Latest Plugin Vulnerabilities 8

Simple CAPTCHA with Cloudflare Turnstile

CVE-2026-93900

Affected: ≤1.44.3 · Fixed in 1.44.3

200K+ installs

Import and export users and customers

CVE-2026-120554

Affected: ≤2.5.11 · Fixed in 2.5.11

70K+ installs

Slim Jetpack

CVE-2026-115498

Affected: ≤2.7.0 · Fixed in 2.7.0

2K+ installs

AI Alt Text Generator

CVE-2026-120578

Affected: ≤2.7.0 · Fixed in 2.7.0

2K+ installs

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

CVE-2026-120574

Affected: ≤4.9.5 · Fixed in 4.9.5

80K+ installs

JetFormBuilder — Dynamic Blocks Form Builder

CVE-2026-120561

Affected: ≤3.6.2 · Fixed in 3.6.2

80K+ installs

Advanced Shipment Tracking for WooCommerce

CVE-2026-120558

Affected: ≤3.9 · Fixed in 3.9

70K+ installs

News Kit Addons For Elementor

CVE-2026-120524

Affected: ≤1.4.8 · Fixed in 1.4.8

3K+ installs

Trending WordPress CVEs EPSS + KEV

CVE-2026-86596 s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

EPSS: 0.7%

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927...

Is your site affected? Scan free

15.7

CVE-2026-76010 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

EPSS: 0.6%

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Exec...

Is your site affected? Scan free

15.6

CVE-2026-120554 Import and export users and customers

EPSS: 0.5%

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up ...

Is your site affected? Scan free

15.5

CVE-2026-102435 Ultra Addons for Contact Form 7

EPSS: 0.5%

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient fi...

Is your site affected? Scan free

15.5

CVE-2026-115498 Slim Jetpack

EPSS: 0.4%

The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website ...

Is your site affected? Scan free

15.4

CVE-2026-111464 WP Fastest Cache – WordPress Cache Plugin

EPSS: 0.4%

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc...

Is your site affected? Scan free

15.4

CVE-2026-120318 Product Gallery Slider, Additional Variation Images for WooCommerce

EPSS: 0.4%

Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorizati...

Is your site affected? Scan free

15.4

CVE-2026-120114 Debug Log Manager Tool

EPSS: 0.4%

The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site ...

Is your site affected? Scan free

15.4

CVE-2026-109197 WP Directory Kit

EPSS: 0.4%

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all vers...

Is your site affected? Scan free

15.4

CVE-2026-119096 Uncanny Toolkit for LearnDash

EPSS: 0.4%

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and inc...

Is your site affected? Scan free

15.4

Top Security Issues (Last 7 days)

Issue	Count	Critical	% of Scans
Security Header	27793	0	49.7%
Server Banner	4939	0	8.8%
Ssl Expiration	4634	646	8.3%
Email Security Dmarc	4352	0	7.8%
Performance	3945	0	7.0%
Robots Txt Leakage	2223	0	4.0%
Sitemap	2007	0	3.6%
Http To Https Redirect	1965	0	3.5%
Mixed Content	1795	1765	3.2%
Js Library Vulnerability	1098	777	2.0%

Fastest-Growing Issue

Security Headers

+13.3% week over week

This week: 799 occurrences · Last week: 705

How does your site compare?

Run a free security scan to see your score vs the global average.

Run a Free Scan

Industry Security Rankings (90-day average, min 5 scans per sector)

#	Industry	Avg Score	Scans
1	Junk Removal	60.0	11
2	Insurance	55.4	284
3	Home Improvement	54.7	233
4	Cleaning	54.4	223
5	Manufacturing	54.3	3346
6	Flooring	54.1	85
7	Government	53.8	671
8	Restoration	53.8	88
9	Professional Services	53.8	1735
10	Real Estate	53.7	973
11	Garage Doors	53.7	17
12	Construction	53.5	1083
13	Moving & Storage	53.4	288
14	Security	53.1	274
15	Finance	53.1	954

Methodology & Data Privacy

The ThreatSpot WordPress Security Index is the average security score across all scans performed in the last 30 days. Each site is scored 0–100 based on:

SSL/TLS configuration — valid certificate, HSTS, modern TLS version
Security headers — CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
Cookie security — Secure flag, SameSite, HttpOnly
Server version disclosure — whether version info is exposed
Mixed content — HTTP resources on HTTPS pages
Known vulnerable plugins — cross-referenced with NVD, CISA KEV, and EPSS data

Privacy-first: All data is anonymized and aggregated. No individual site domains, URLs, or identifying information are exposed on this dashboard. Statistics are only published when minimum sample sizes are met to prevent re-identification. The sample focuses on small-business WordPress sites.

Get the monthly WordPress Security Index report

One email a month: the latest index score, trending CVEs, and the fastest-growing issues — straight from our scan telemetry. No spam, unsubscribe anytime.

Embed the live index on your site

Free badge + widget for blogs, agencies, and hosting companies. Copy-paste HTML, Markdown, or WordPress snippet.

Get Embed Code