Wordpress is a great platform if you use well rounded plugins, actively manage it, have it behind a Firewall, and run a security suite (like Wordfence.) But rea

Wordpress is a great platform if you use well rounded plugins, actively manage it, have it behind a Firewall, and run a security suite (like Wordfence.) But really, you should have any CMS install behind a Firewall. I really like Wordpress, it gets a lot of hate; but it's easy to develop on allowing for fast turn around, has the best editor of any CMS around for client happiness, and has a robust ecosystem. I'm in charge of around ~150 websites that run Wordpress, and I moved them all under an active management platform with always up to date plugins, themes and core. I inherited a lot of them with my new job, but I am slowly putting them all behind Cloudflare's firewall and setting up the appropriate page rules to keep them safe. I often scan them and compare them against the core to make sure there have been no changing of core files by a hack. I also have them on scheduled back-ups to private Azure blobs and have alerts set up with Azure's monitoring tools. It takes a while to set all of that up, but once it is set up your install is pretty safe against any sort of attack relative to other CMSs. Another great thing about WP is if it IS hacked, it's pretty easy to fix. Other CMSs getting hacked is quite the chore to hunt down, especially the other major PHP based CMSs. I'm looking at your Magento & Drupal. I think about what is best for turn around, has the best cost/benefit, and what makes clients happiest, and so far that is Wordpress is the answer 90% of the time. Until that changes, Wordpress will continue to run a huge chunk of the web. I do grant you that a lot of lazy developers and unmanaged/out-of-date installs from agencies, small businesses and individuals are hacked very often and are often turned into zombie sites. There's no doubt about that. But just taking some basic common sense security measures can do wonders and keep you and your clients safe(r) from attack.