Most WordPress pros still lack a breach recovery plan
Melapress survey of 319 WordPress professionals finds most have faced incidents but fewer than 30% maintain a breach recovery plan.
A Melapress survey of 319 WordPress agency staff, developers, designers, and site owners found that most respondents had dealt with at least one known security incident, yet fewer than three in ten have a breach recovery plan. Downtime was the most common impact, reported by 68.4% of affected respondents who described consequences. Incidents were most often discovered when someone noticed the site behaving strangely, and logging tools, hosting provider alerts, and malware scanners were the most effective detection controls. When a search engine warning surfaced an incident, 46% involved lost search rankings versus 14.5% of incidents found other ways.
- Melapress surveyed 319 WordPress professionals on incident history and recovery readiness.
- Fewer than 30% of respondents maintain a breach recovery plan despite widespread incident experience.
- 68.4% of affected respondents reported downtime as the primary incident impact.
- Incidents caught via search engine warnings showed lost rankings in 46% of cases.
- Researchers recommend creating and testing recovery plans and training content editors.
Full article366 words · extracted from helpnetsecurity.com · click to collapse
Melapress, a maker of WordPress security plugins, surveyed 319 WordPress professionals and found that most had dealt with at least one known security incident. The respondents build and run WordPress sites for a living: agency staff, developers, designers, site owners and administrators.
Across the whole group, fewer than three in ten have a breach recovery plan. A recovery plan settles in advance who responds, where the clean backups are, and who needs to be told. Without one, those calls get made in the middle of an incident. Downtime was the most common result of an incident, reported by 68.4% of respondents who had been hit and described the impact.
Someone else often spots the problem
Among respondents who had an incident, the most common way they found out was that someone noticed the site behaving strangely. That someone might be a visitor, a customer, a colleague or an administrator, and by the time any of them notices, the problem may already be disrupting the site. Logging tools were the monitoring control that caught incidents most often, and hosting provider alerts and malware scanners caught incidents for others.
Late discovery tends to show up in the damage. When a search engine warning helped surface an incident, 46% of those incidents involved lost search rankings, compared with 14.5% of incidents found other ways. The warning probably does not cause the harm. Incidents that last long enough or do enough damage to catch a search engine’s eye have likely progressed further by the time they are found.
One ecommerce site owner found out through Google Search Console that traffic had cratered after a hack. “Unfortunately, the rankings never fully recovered,” the owner said.
Where to start
Researchers recommend creating the recovery plan before it is needed and testing it: who isolates the damaged systems, who restores the site, and who tells customers. A backup that has never been restored is an assumption until the day someone tries it.
Melapress also treats training as a core control, since content editors and administrators make choices that affect a site’s security too. The person who owns a site should know who receives security alerts, even when an agency or freelancer handles security.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/18/wordpress-security-survey-recovery-plan/