Definition
What is a website's attack surface?
A website's attack surface is the set of publicly exposed components a malicious person can try to exploit: database, login page, installed plugins, code executed on every visit. It grows with every piece of software running online. It is what draws intrusion attempts, more than the site's fame. A pre-built site reduces it to almost nothing.
Where the attack surface comes from
- The server and its database, which assemble pages on every visit and must be kept up to date.
- The admin login page and every account that has access to it.
- Plugins and themes, developed by third parties whose quality and lifespan vary.
- Third-party scripts (tracking, chat, testing) that extend the risk to vendors you sometimes do not know exist.
Each element is one more door. A plugin installed for a feature used twice a year remains a permanent risk for a small benefit.
Why a small site is targeted too
Most intrusion attempts are automated. Bots sweep the web looking for known software and versions with a published vulnerability. They do not pick a site for its reputation: they find it because it runs vulnerable software.
On WordPress, the security firm Wordfence recorded 8,223 distinct vulnerabilities published in 2024, almost all in plugins and themes rather than in the core software. Most compromises exploit vulnerabilities that have been known and patched for weeks.
How to reduce it
On a dynamic site, you reduce it by removing any plugin that is not used, checking that a plugin is still maintained before installing it, applying patches quickly and deleting unused administrator accounts.
On a pre-built site, most of it disappears: there is no database to protect and no public-facing server to keep up to date. What remains is access (hosting, domain, code repository) and the services connected to forms. Close to nil does not mean nil.
Suppose two fictional sites of the same size. The first runs on WordPress with 30 plugins, 6 of which are no longer updated by their author and 4 of which are no longer used. The second is a pre-built site with a form connected to a sending service.
The first exposes a server, a database, a login page and 30 third-party entry points. The second exposes ready-built files and a form. Removing the 4 unused plugins and replacing the 6 abandoned ones already shrinks the first site's surface.
We read the attack surface as a hidden cost of the architecture. On a classic WordPress site, security maintenance is a consequence of the technical choice, not vendor abuse: it has to be planned from the start, with regular updates and off-server backups.
It is one of the reasons we favour the pre-built site for business websites. We stay careful with our words: the surface there is close to nil, not absent. Access to the domain and hosting must stay in the company's name, and each added tool has to justify itself.
Not to be confused with
- Vulnerability
- A vulnerability is a specific flaw in a piece of software. The attack surface is the set of exposed components where such flaws can be found.
- Patched vulnerability
- A vulnerability patched by the vendor remains exploitable on your site until the patch is applied. The delay before applying it is the real window of risk.
Related concepts
- Pre-built site
- Content management system
- Website maintenance
- Total cost of website ownership
- Digital asset ownership
Further reading
- WordPress business websites: costs, maintenance and security
- Website design for visitors, search engines and AI
- Website pricing in Quebec in 2026: budgets and total costs
- Ad accounts and data: who owns your digital assets?
Related services
Frequently asked questions
My site is small: are attackers really interested in it?
Yes, because most attacks are automated. Bots look for software and plugins with a known vulnerability, without looking at the site's size or reputation. What exposes you is what runs on your site, not how well known you are.
How many WordPress plugins can I install safely?
There is no fixed limit. Every plugin adds a dependency and an attack surface. The right rule is to remove any plugin whose function is not actually used, and to check that a plugin is still maintained by its author before installing it.
