WordPress — Glossary

The longer version

A WordPress site is made of the core software, plugins, themes, uploaded media and a database. Administrators manage content through a web dashboard, and the software runs on a normal PHP runtime behind a web server such as nginx or Apache.

Its popularity and its plugin ecosystem make it a frequent target. Most real compromises come from outdated or vulnerable plugins and themes, stolen or weak passwords, and neglected sites rather than from the core software itself.

Good hygiene is mostly routine. Keep core, plugins and themes updated, delete components you do not use, limit administrator accounts, keep backups you have tested, and confirm that the PHP version serving the site is still supported.

Where we use “WordPress”

CybersecurityDoes Updating WordPress Fix PHP2Shell?
A WordPress update does not fix PHP2Shell, because the flaws sit in the PHP runtime that handles requests before WordPress runs. Here is how to check your build, what to ask your host, and which separate WordPress fixes still apply.
Nov 5, 2026

The longer version

Where we use “WordPress”

Get the Core in your inbox.