We Used to Spend Four Hours a Quarter on Website Security. Now It’s Four Hours a Week. WordPress Did That.

I want to talk about something that’s been bothering me for the better part of a year.

At 2 Fish Company, we exist to help our clients grow through smart marketing, exceptional creative, and strategies that move the needle. That’s the job. That’s what gets us out of bed.

So when I look at our team’s hours over the last six months and see a significant share of them going toward website security work — not SEO, not AEO, not GEO, not creative, not strategy — security — I have a problem with that. And when I trace that problem back to its source, I keep landing in the same place.

WordPress.

Let me be direct about something most agencies won’t say out loud: WordPress has become a liability, not a tool. A liability. And the platform’s biggest beneficiaries have a financial interest in making sure you never fully understand that.

What Changed — Because Something Clearly Did

We didn’t always feel this way. For years, WordPress was the right answer for almost everything: flexible, well-supported, with a great plugin ecosystem and excellent SEO capabilities. We built on it. We recommended it. We stood behind it.

Then something shifted — fast.

The attack landscape changed in 2024 and 2025 in a non-incremental way. It was a leap change. According to the World Economic Forum’s Global Cybersecurity Outlook 2026, the frequency of cyberattacks has doubled since the COVID-19 pandemic. Patchstack’s 2026 State of WordPress Security report documented 11,334 new vulnerabilities in the WordPress ecosystem in 2025 alone — a 42% increase over 2024. Highly exploitable vulnerabilities increased by 113% year-over-year. Wordfence data shows that brute-force attacks on WordPress sites surged by 60%, with AI-powered botnets driving a 45% jump in attack volume since early 2025.

And the median time from a vulnerability’s disclosure to attackers actively mass-exploiting it is now five hours.

Five hours. The idea that keeping plugins updated as a meaningful defense is essentially over.

Cloudflare alone mitigated 8.3 million DDoS attacks in Q3 2025 — up 40% year-over-year. Barracuda’s 2026 botnet landscape analysis documents how botnets have become an industrialized criminal infrastructure — not a single attacker at a keyboard, but networks of millions of compromised devices rented out to anyone who wants to run credential stuffing or brute-force campaigns at scale.

Guardz’s SMB Threat Report documented nearly twice as many weekly security incidents against small businesses in the first half of 2025 as in 2024. The clients we serve — nonprofits, restaurants, local businesses — are not too small to be ignored. They are exactly the soft-target profile attackers love.

We saw this in our own portfolio. Clients who’d been running smoothly for years suddenly required constant attention — credential stuffing, bot enumeration, brute-force attempts, SQL injection probing. The hardening work we’ve done — Cloudflare, 2FA, login URL changes, firewall rules, security plugins — is real and has helped. But it’s damage mitigation. It’s not a solution. And every hour we spend on it is an hour we’re not spending making our clients more money.

The Part Nobody Wants to Say About WP Engine

We’re a WP Engine shop. We’ve been for years. Their platform is genuinely good — better performance, support, and infrastructure than most alternatives. We’re not walking away from that relationship without careful thought.

But here’s the thing I keep coming back to: WP Engine profits from the security crisis.

As WordPress sites are increasingly attacked, agencies need more managed hosting. Clients need more security add-ons. Platform vendors sell more layers of protection. The company that profits from the problem is selling you the solution to the problem, a dynamic worth noting.

To be clear — I don’t think WP Engine is acting in bad faith. They’re building real tools to help mitigate real threats. But they’re also not going to tell you that the architecture underlying WordPress is the real problem, because that architecture is their business model. That conversation is better held with someone whose incentives are aligned with yours.

The Architecture Problem No Security Plugin Can Fix

Here’s the uncomfortable truth. The WordPress security hardening we’ve been doing —it’s good, necessary hardening — doesn’t fix the structural issue. WordPress runs PHP on the server-side for every page request. Plugins execute with full database and server access. Its 40%+ market share makes it the single most valuable target for automated attacks at scale.

The Patchstack report found that 91% of WordPress vulnerabilities are plugin-related, and 46% of those had no patch available at the time of public disclosure. You can’t meaningfully use WordPress without plugins, so you can’t meaningfully eliminate the attack surface.

The platforms least likely to be attacked aren’t the ones with the best security plugins. They’re the ones where the attack surface doesn’t exist — because no PHP is executing, no database is queried on page load, and no plugin ecosystem to exploit.

Webflow, for instance, publishes static HTML/CSS/JS files served via a CDN. There’s nothing to SQL-inject. There’s nothing to brute-force. There’s no plugin update cycle to fall behind on. The attack vector that’s consuming our team’s hours simply isn’t there. Duda operates on a similar managed SaaS model — and was built specifically for agencies managing multiple client sites — which is no accident.

We haven’t built much on either platform yet, but that’s changing.

One Man. One Bad Day. The Whole House of Cards.

Here’s a dimension of the WordPress problem that doesn’t get enough attention outside the developer community — and that every business owner on the platform should understand.

Matt Mullenweg is the co-founder of WordPress. He’s also the CEO of Automattic, the company behind WordPress.com. He controls WordPress.org — the open-source project, the plugin and theme repositories, and the WordPress Foundation. That’s the commercial entity and the open-source infrastructure, both controlled by one person, with no meaningful checks on either.

In September 2024, the world witnessed what it looks like when it goes wrong.

Mullenweg published a post calling WP Engine — our hosting platform of choice and one of the most significant WordPress businesses on the planet — “a cancer to WordPress.” He then banned WP Engine and all of its customers from accessing WordPress.org — cutting off their ability to update plugins and themes. Overnight. By fiat. With no process, no warning, and no recourse.

Then came the Advanced Custom Fields situation — and this story requires accuracy because the details matter.

After banning WP Engine from WordPress.org — which cut off the Advanced Custom Fields team’s ability to maintain their plugin — Mullenweg used that manufactured gap to justify invoking WordPress.org’s plugin guidelines and “forking” ACF into a new plugin called Secure Custom Fields. This wasn’t a simple code fork. Rather than creating a new standalone plugin, he took over ACF’s existing plugin listing on WordPress.org, renamed it, and pushed it as an auto-update to over two million active installations — meaning site owners unknowingly had an unapproved version installed over their existing plugin.

The ACF team called it “maliciously being used to update millions of existing installations with code that is unapproved and untrusted.” The WordPress.org security team member who confirmed the takeover later said he hadn’t known it was coming. The sequence is worth reading twice: first, block the team from maintaining their plugin, then use the resulting security gap to justify taking it.

A federal court ordered the plugin returned to WP Engine. Automattic complied. ACF is back where it belongs.

But the precedent stands. The mechanism is in the guidelines. The repository can be used as a weapon. And one person controls whether it is used.

Text messages allegedly show Mullenweg demanding 8% of WP Engine’s annual revenues — roughly $32 million — in exchange for altering his public statements about the company. WP Engine sued Automattic and Mullenweg for extortion, interference with operations, abuse of power, and business harm. A federal court allowed most of those claims, including intentional interference, unfair competition, and defamation, to proceed. A class action lawsuit followed, accusing Mullenweg and Automattic of deliberately abusing their power and control over the WordPress ecosystem. And here’s the part that should give every WordPress site owner pause: Mullenweg himself said the conflict he initiated could eventually lead to the closure of WordPress.org. The man who controls the infrastructure on which 40% of the internet runs casually acknowledged he might shut it down.

One person. Unchecked authority. A demonstrated willingness to use it. That’s not a security problem you can patch.

We want to be careful here. We don’t know how this legal battle will ultimately resolve. We’re not lawyers, and this isn’t legal advice. We’re a marketing agency that spent years building client businesses on a platform now revealed to have a single point of governance failure — one person with unchecked authority over the entire ecosystem who has already shown a willingness to wield that authority as a weapon.

We’d rather not risk our clients’ businesses on that.

Where This Money Should Be Going

Let’s talk about the actual cost.

Security maintenance isn’t just an agency overhead problem. Someone’s paying for those hours. In most cases, it’s the client — either directly through maintenance retainers or indirectly through marketing work that doesn’t get done because we’re patching vulnerabilities instead.

I would rather spend every dollar of a client’s marketing budget on SEO, AEO, and GEO work that gets them found — in traditional search results, in AI-generated answers, and in the agentic search systems reshaping how customers find businesses right now. On creative that makes people stop scrolling. On campaigns that generate a measurable pipeline. Not on playing whack-a-mole with automated bots attacking a platform we chose, partly because it was convenient.

That’s a values misalignment I’m no longer willing to accept.

The Three-Year Plan

So here’s where we land. This isn’t a panicked move. It’s a deliberate, phased pivot toward platforms that don’t treat security as a recurring-revenue opportunity.

Phase 1 — Starting now: New builds, new standard.

The next new client build we take on will be evaluated for Webflow first. The architecture is right, the creative flexibility is real — Webflow’s security model is structurally different in a way that matters — and the security overhead drops to near zero. We’re going to learn it properly by building on it. For agency-scale efficiency and multi-site management, we’re also evaluating Duda, whose white-label dashboard and client permission tools are built for exactly how we work.

For clients where the plugin ecosystem is genuinely necessary — such as complex e-commerce and heavy custom functionality — WordPress and WP Engine remain the answer. That’s a real use case. We’re not pretending otherwise.

Phase 2 — Q4 2026: The highest-risk migrations.

We’ll identify the sites in our portfolio with the worst security burden and present migrations to clients as security and performance upgrades that free up budget for work that grows their business.

Phase 3 — 2027 to 2028: The portfolio flip.

As existing clients enter their natural redesign cycles, WordPress won’t be the automatic default. It’ll be the exception. The platform conversation will begin with every new engagement, and the answer will increasingly point to platforms like Webflow or Duda — platforms where security is a utility, not a project.

Why I’m Writing This

Partly to think out loud. Partly because I think other agencies are in the same spot, and nobody’s saying it clearly.

The WordPress-as-default era isn’t over. But for agencies like ours — where the value we create comes from strategy, creative, and marketing performance, not from IT work — the calculus has shifted. The security tax has become too high. The opportunity cost is too real.

We built 2 Fish Company to help clients grow. Every hour we spend on security maintenance is an hour we don’t spend on growth. Something had to change.

So we’re changing it.

One More Thing

Webflow — if you’re reading this, we’d love to talk. We’re an agency actively pivoting our new-build standard toward your platform, and we’d rather do that with you than around you. Reach out. We’re not hard to find.

And Duda — the same goes for you.

---

If you’re a client of ours — or a business owner wondering what your maintenance budget is really paying for — this is a conversation worth having.

2 Fish Company is a full-service marketing agency in Holland, Michigan. If your website needs a marketing infrastructure audit — or you’re planning a build and want to do it right the first time — let’s talk.

SHARE IT!