A 2026 WordPress security survey finds 78 percent of users worried and 68 percent hit by an incident in the past year, with recovery planning lagging well behind the anxiety.
WordPress users report high levels of security anxiety and low levels of preparation, according to findings from the 2026 WordPress Security Survey by Melapress discussed on the WP Tavern podcast with guest Robert Abela. The episode, published October 14, 2026, covered both the survey results and the growing role of AI in the threat landscape.
What the survey found
The numbers are blunt. Seventy-eight percent of survey participants said they worry about security, and nearly 68 percent reported experiencing at least one security incident in the last year. Those two figures sit close enough together that the worry looks less like anxiety and more like pattern recognition.
The more interesting finding is what happens after the worry. The conversation focused on the gap between how concerned WordPress users say they are and how little preventative action they take. Recovery plans and team training came up as areas where intention doesn’t translate into practice. Users are aware of the risk. They are not, by and large, building the structures that would limit the damage when something goes wrong.
Abela also addressed AI threats during the discussion, framing them as part of the same battle rather than a separate category of problem.
The gap isn’t ignorance, it’s prioritization
A 68 percent incident rate is not a niche problem. If roughly two out of three WordPress users have dealt with a security event in a single year, then security is not an edge case you handle when you have spare time. It’s a recurring operational cost that most site owners are paying reactively instead of proactively.
My read on why the gap persists: recovery plans and training are the least satisfying work in WordPress security. Installing a firewall plugin or enabling two-factor authentication gives you a visible checkbox. Writing a documented incident response procedure, deciding who gets paged at 2 a.m., and running your team through a tabletop exercise gives you nothing visible at all. It only pays off during the worst week of your year. That asymmetry explains a lot of the survey results. People aren’t skipping preparation because they don’t understand the risk. They’re skipping it because the reward is invisible until it isn’t.
There’s a second factor worth naming. WordPress security advice tends to arrive as a list of plugins, and plugin installation feels like completion. It isn’t. A stack of security plugins with no recovery plan means you’ve optimized for prevention and left the response side entirely to improvisation. The survey data suggests that’s where most of the market sits.
Why AI threats change the calculus
AI’s effect on WordPress security isn’t a new class of vulnerability so much as a change in the economics of attacking. Anything that lowers the cost of scanning, probing, and generating plausible-looking attacks shifts the ratio of attackers to defenders. Defenders who were already behind on basics now face a larger volume of attempts against the same unpatched surface.
This matters for how you read the survey. If the threat volume is increasing while preparation stays flat, the 68 percent incident figure is a floor, not a ceiling. The gap between concern and action doesn’t stay stable under those conditions. It widens.
What to watch next
The useful question coming out of this survey isn’t whether WordPress users are worried. They clearly are. It’s whether anything moves the preparation numbers. Watch for whether Melapress or others publish follow-up data on recovery plan adoption specifically, since that’s the metric that would show whether the conversation is changing behavior or just adding to the anxiety.
For site owners and the agencies managing WordPress installs, the practical takeaway is narrow and unglamorous. The survey suggests most of your peers have already had an incident this year. If you don’t have a written answer to “what happens in the first hour after we discover a compromise,” you’re in the majority, and the majority is not a comfortable place to be. Training and a recovery plan won’t show up on any dashboard. They’re also the difference between a bad day and a lost client.
Source: wptavern.com