Is WordPress Safe for Your Parish Website? What the Data Says

Every day, Catholic parishes, schools, and dioceses handle deeply sensitive information: parishioner contact details, sacramental records, donation history, and financial transactions. 

The platform that hosts all of this isn’t just a software tool. It’s a custodian of trust. And its underlying architecture may be the single most important security decision your parish makes.

To see why, it helps to compare two very different approaches: eCatholic, a purpose-built platform managed end to end, and WordPress, the open-source CMS that powers more than 40% of the web through a sprawling ecosystem of third-party plugins.

The difference isn’t a matter of degree. It’s a matter of orders of magnitude.

The Numbers Tell the Story

Independent researchers (Patchstack, Wordfence, and Sucuri) track WordPress vulnerabilities closely. The 2025 data is sobering:

• 11,334 new WordPress security risks were discovered in 2025, a 42% jump over 2024, which was itself up 34% over 2023. The rate is accelerating, not slowing.
• 91% of them were found in plugins.
• The median time between when a WordPress user finds out about a security risk and the time hackers take full advantage is just 5 hours. Within 24 hours, 45% of users are under active attack; within a week, 70%.
• 46% of disclosed risks had no fix available at the time of disclosure, so even a diligent site owner can’t always close the gap.
• 64% of WordPress professionals have experienced at least one breach, yet only 27% have a recovery plan.

A typical WordPress site runs 20–30 plugins, each built by a different developer with different security practices. The math isn’t kind.

The Plugin Problem

WordPress core (maintained by the WordPress Foundation) is generally well-maintained. But core handles little more than basic text editing. Nearly everything a parish actually needs, including forms, online giving, event calendars, email, SEO, and page builders, comes from third-party plugins. That’s where the risk lives.

It gets worse. In a single year, 1,614 plugins were pulled from the WordPress.org repository for security issues, a 235% increase. These "zombie plugins" don’t uninstall themselves. They keep running on millions of sites with no patches and no maintenance, and most owners never realize they’re running abandoned code.

In the WordPress model, security is a shared responsibility spread across core, plugin authors, theme authors, the hosting provider, and the site owner. In practice, that last link, often a part-time communications coordinator, a volunteer, or a busy pastor, carries the ultimate burden.

The eCatholic Difference: Security by Design

eCatholic is a true Software-as-a-Service platform. Every line of code, from the website builder to church management tools, online giving, email, and live streaming, is built, tested, and maintained by a single engineering team. There is no plugin marketplace, no third-party extension API, and no mechanism for unvetted code to run inside the platform.

That one architectural choice eliminates the biggest security risk in the entire CMS ecosystem.

Underneath, the platform runs on Amazon Web Services behind Cloudflare’s global edge network, with a defense-in-depth design. Here’s what that looks like in practice:

Security updates deploy automatically and simultaneously across every customer site. No one at the parish has to click "update" or worry about plugin compatibility.

What This Means for Parish Staff

Securing a WordPress site to a professional standard is a real, ongoing job. It takes weekly plugin updates and log reviews, monthly core updates and account audits, quarterly security reviews, and annual penetration testing. If 64% of professionals have been breached, the outlook for part-time parish staff is considerably worse.

With eCatholic, that operational burden shifts from the parish to the platform. No updates to apply, no plugins to audit, no backups to verify, no SSL certificates to manage.

The Parish’s Job Gets Simpler

Your security responsibilities shrink to the essentials you can actually handle: strong passwords, multi-factor authentication, and sensible access control. The platform takes care of the rest.

The Real Cost of "Free"

It’s tempting to compare eCatholic’s subscription against "free" WordPress plus $10/month hosting. That comparison misses the true cost. A budget WordPress site can easily run into thousands of dollars a year in premium security plugins, backup services, malware removal, and staff time, and that’s before anything goes wrong.

The average data breach for a small organization costs between $25,000 and $200,000 once you account for forensics, legal counsel, regulatory notification, credit monitoring, and reputational damage. A single breach can cost more than years of subscription fees, and the odds of one are materially higher on a self-managed site. On cheap shared hosting, even a vulnerability in someone else’s site on the same server can put your parishioner data at risk.

The Bottom Line

WordPress is powerful and flexible, and it can be secured with enough expertise, budget, and constant vigilance. But its open plugin architecture creates an attack surface that demands active, expert management most parishes simply don’t have.

eCatholic takes the opposite path: security through constraint. One professionally maintained codebase, no third-party plugins, all infrastructure managed, all patching automatic. The trade-off is less flexibility in exchange for dramatically less risk, exactly the right trade for organizations whose mission is ministry, not IT.

When a parishioner entrusts their information to their church, they expect it to be protected. Your platform is your primary security control. Choose one that was built for the responsibility.

Sources

• Patchstack, State of WordPress Security (2025, 2026)

• Wordfence 2024 Annual WordPress Security Report

• Melapress WordPress Security Survey 2025

• WPScan Vulnerability Database; Sucuri / Patchstack joint report (2025)

• European Commission Cyber Resilience Act (2024).

Data current as of June 2026.