What Will WordPress Security Look Like in 2025?

I was thinking wether to leave this as the last security weekly, but I recon that by releasing this in the middle of the holidays will most likely not get the attention it deserves.

So, taking into account all of the data and what has happened during 2024, let’s do what never should be done – predict the future. Just keep in mind that this is my personal opinion and an “educated guess”.

Increased volume of cyber attacks

Cyber attacks are mostly motivated by money or politics, so when the global economy is shaky then cyber crime is always at its peak. Past couple of years have been extremely turbulent, and this does not seem to end in 2025.

What makes matters some what worse is the general availability of GenAI tools which are more frequently being used to generate new malware types to avoid signature based scanners and to automate vulnerability scanning and exploitation.

As of writing this post, we already see the number of security vulnerabilities found in WordPress ecosystem increased in 2024 compared to 2023 by 21%. This growth is directly connected to the number of new opportunities hackers get to launch new wide-scale attacks.

Top threats to look out for:

• New security vulnerabilities found in plugins/components
  • Put extra attention to abandoned software.
  • Hackers can mass-exploit vulnerabilities faster than ever.
• Info-stealers, session hijacking & leaked passwords
  • Unfortunately relatively difficult issue to resolve and relies a lot on end-user cyber hygiene.
• Phishing and scams
  • Humans remain the weakest link. AI makes scamming & phishing easier than ever.
• Malware is becoming harder to detect
  • GenAI is being used to generate new malware for every infection. Signatures and patterns are losing their effectiveness.

Change of wind in security workflows

With the increased number of threats and new regulations pushing more and more to the WordPress ecosystem, many changes need to be applied to the core workflows and development practices.

Something that will start getting wider adoption in 2025 are SBOM reports which are connected to many regulations which touch the software supply chain security issue.

This requires work from both web developers building websites and from developers building plugins. Covering the software supply chain security and vulnerability management are becoming mandatory through many regulations such as Cyber Resilience Act and certifications such as SOC2 and PCI.

This will be taking some time as it will be moving from the top to bottom where enterprise/public sector customers will be asking for those things from their agencies/devs, and agencies will start asking them from plugin developers whose software they use in their projects.

Increased security awareness

With the volume of cyber crime going up and all regulators pushing every stakeholder to adapt more mature security practices – the security awareness within the entire ecosystem will increase.

This is great news, but will also mean that companies who explore to get a WordPress website will be having security concerns early on in the process. Developers and agencies need to address security proactively.

Hosting companies are already well aware of this and if agencies and freelancers don’t put enough attention to this – then a lot of money from the agency economy will move through maintenance services to the hosting segment.