According to the latest data and statistics, here's how the major open-source CMS platforms compare in terms of security and vulnerability to hacking...
WordPress
WordPress has the highest rate of hacked websites among major CMS platforms.
- According to a 2019 report by Sucuri, WordPress accounted for 94% of infected websites among known CMS platforms.
- This high percentage is partly due to WordPress's immense popularity, making it a prime target for hackers.
- WordPress sites are often compromised due to vulnerabilities in third-party plugins and themes, rather than the core software itself.
- While these statistics are from 2019, they were still being cited in articles from 2022 and 2023, suggesting that no more recent comprehensive studies have been published.
Joomla
Joomla has a significantly lower rate of hacked websites compared to WordPress:
- The same Sucuri report showed Joomla accounted for only 2.5% of infected websites.
- Joomla's core is considered difficult to hack, but vulnerabilities in third-party extensions can still pose risks.
Drupal
Drupal has the lowest rate of hacked websites among these three major CMS platforms:
- Drupal accounted for just 1.28% of infected websites in the Sucuri report.
- It is widely regarded as the most secure of the three, which is why many government agencies and organizations with high security needs choose Drupal.
- Drupal takes a very serious approach to security, promptly publishing and patching vulnerabilities.
Security Considerations
While these statistics provide insight into the relative security of these CMS platforms, it's important to note:
- WordPress's high infection rate is partly due to its massive market share and popularity among non-technical users who may not follow security best practices.
- All open-source CMS platforms have inherent security risks due to their publicly available code.
- The security of any CMS installation depends heavily on proper configuration, regular updates, and careful selection of third-party extensions.
- Less popular CMS options like CMS Made Simple may have lower hack rates, but this could be due to lower adoption rather than superior security.