Website Hacking Statistics: How Often Do Websites Get Attacked?
Compiled from Patchstack’s 2026 State of WordPress Security report, Verizon’s 2026 Data Breach Investigations Report, and IBM’s 2026 Cost of a Data Breach report — how often websites are attacked, what’s actually being exploited, who gets hit hardest, and how each number has changed over time.
📋 What’s in this page
Key Attack Statistics at a Glance
Attack-frequency figures vary depending on what’s being measured — disclosed vulnerabilities, confirmed breaches, or insured losses. Below are the most current figures from each original report.
The WordPress Vulnerability Landscape
WordPress powers a large share of the web, which makes its plugin ecosystem — not WordPress itself — the dominant attack surface. The number of new vulnerabilities Patchstack records has risen every year since 2021, from 1,382 to 11,334.
New WordPress-ecosystem vulnerabilities per year
Vulnerabilities added to Patchstack’s database each year (plugins, themes and core).
Source: Patchstack, State of WordPress Security reports (2022 edition for 2021–2022; 2024, 2025 and 2026 editions for 2023–2025).Free to reuse with attribution and a link to paidhosting.com
The growth is not only in volume. Patchstack counted 1,966 high-severity vulnerabilities in 2025 (17% of the total), and the number of highly exploitable vulnerabilities rose 113% year over year. Premium and freemium plugins and themes produced 29% of valid reports, and 76% of those were rated high or medium priority — so paying for a plugin does not make it safer.
What kind of vulnerability is most common
Cross-site scripting (XSS) remains by far the most frequently disclosed vulnerability class in the WordPress ecosystem, followed by broken access control and CSRF — all common in third-party plugins rather than in core WordPress code. Broken access control was the most exploited type in 2025.
In Patchstack’s tests of hosting-level defenses, traditional defenses blocked only 12% of attacks on WordPress-specific vulnerabilities, and only 26% of total attacks in a second test. Generic web application firewalls can’t see which plugin versions a site runs, so attacks on plugin-specific logic flaws get through. Keeping plugins updated and removing unused ones does more for most sites than a firewall alone.
How Fast Vulnerabilities Get Exploited
The window between a vulnerability becoming public and attackers using it is now measured in hours, while patching still takes weeks.
That combination — exploitation within hours, patching that takes weeks, and almost half of flaws with no fix at all on disclosure day — is why unmaintained plugins are consistently the most common entry point into a compromised WordPress site.
How Breaches Start: 2025 vs. 2026
Verizon’s 2026 report analyzed more than 31,000 security incidents, over 22,000 of them confirmed data breaches. For the first time in the report’s 19-year history, exploited vulnerabilities overtook stolen credentials as the most common way attackers got in; credential abuse, the previous leader, fell to 13% of breaches.
| Share of breaches | 2025 DBIR | 2026 DBIR |
|---|---|---|
| Started with an exploited vulnerability | 20% | 31% |
| Involved ransomware | 44% | 48% |
| Involved a third party (vendor, partner or supplier) | 30% | 48% |
| Involved the human element | 60% | 62% |
Source: Verizon, 2026 Data Breach Investigations Report (reporting period: November 2024–October 2025); 2025 figures are the prior-year values Verizon reports for comparison.
Small Businesses Take the Hardest Hit
Smaller organizations are not attacked because they are valuable targets — they are hit because automated attacks find whatever is easiest to compromise, and the damage weighs more heavily on a smaller budget.
Small and medium businesses
- Ransomware was present in 88% of SMB breaches, vs. 39% at large organizations (2025 DBIR)
- The median insured breach loss for an SMB is about $38,000 — but losses can reach up to 7% of total revenue
- Ransomware accounted for 39% of SMB cyber-insurance claims, and business email compromise for 19%
All organizations
- Ransomware was involved in 48% of all breaches in the 2026 DBIR, up from 44%
- The median ransom paid was $139,875
- 69% of ransomware victims did not pay at all
Sources: Verizon, 2025 DBIR SMB snapshot; Verizon, 2026 Breach Impact Study (insured cyber claims); Verizon, 2026 Data Breach Investigations Report.
How Long Breaches Go Unnoticed — and What They Cost
For most breached organizations, the compromise itself is only half the problem — the other half is how long it goes unnoticed, and what it costs once it’s found.
Global average cost of a data breach (USD millions)
Average total cost per breach, as reported in each year’s IBM study.
Source: IBM, Cost of a Data Breach Report 2026 (Figure 1).Free to reuse with attribution and a link to paidhosting.com
| Report year | Days to identify | Days to contain | Total days |
|---|---|---|---|
| 2019 | 206 | 73 | 279 |
| 2020 | 207 | 73 | 280 |
| 2021 | 212 | 75 | 287 |
| 2022 | 207 | 70 | 277 |
| 2023 | 204 | 73 | 277 |
| 2024 | 194 | 64 | 258 |
| 2025 | 181 | 60 | 241 |
| 2026 | 183 | 64 | 247 |
Source: IBM, Cost of a Data Breach Report 2026 (mean time to identify and contain a breach, by report year).
What This Means for Your Website
None of this data suggests hosting a website is uniquely dangerous — it suggests that most successful attacks are opportunistic, automated, and aimed at whatever is easiest to compromise, not specifically at you. A five-hour weighted median time to first exploit means the sites that get hit are disproportionately the ones running outdated plugins, not the ones targeted by name.
The practical takeaway tracks closely with the data above: plugin hygiene matters more than almost anything else. Removing unused plugins, keeping active ones updated, and not treating a generic firewall as a substitute for patching addresses the overwhelming majority of the attack surface described here.
Sources & Methodology
Vulnerability and exploitation-speed figures come from Patchstack’s State of WordPress Security reports, based on its own vulnerability database and disclosure program; the vulnerability-type breakdown comes from Patchstack’s live 2025 database statistics (checked October 2026). Breach figures come from Verizon’s 2026 Data Breach Investigations Report, which covers November 2024–October 2025; small-business figures come from Verizon’s 2025 DBIR SMB snapshot and its 2026 Breach Impact Study, which analyzes insured cyber claims. Breach-cost and detection-time figures come from IBM’s 2026 Cost of a Data Breach report (602 organizations, breaches from March 2025 to February 2026). Each figure is taken from the original report, not from secondary roundups. This page is reviewed and updated as newer annual reports are published.
- Patchstack — State of WordPress Security in 2026, 2025, 2024 and 2022; WordPress Vulnerability Database, 2025 statistics
- Verizon — 2026 Data Breach Investigations Report (DBIR) and Executive Summary
- Verizon — 2026 Breach Impact Study; 2025 DBIR SMB snapshot
- IBM — Cost of a Data Breach Report 2026
Cite this analysis
https://www.paidhosting.com/website-hacking-statistics/
Findings on this page may be reproduced with attribution and a link back to this page. Press and data inquiries: [email protected]