which gives attackers huge attack surfaces because of WP's popularity. I'm guessing less than 5% of WP users probably sandbox and properly test their plugins be

which gives attackers huge attack surfaces because of WP's popularity. I'm guessing less than 5% of WP users probably sandbox and properly test their plugins before using them too. Just by not using WP, you effectively reduce the attack surface of your site or blog immensely. Just self hosting your blog or site would be significantly safer than using WP. Full disclosure: I've never liked WP from the start and probably never will for a myriad of reasons.