Melapress Survey Finds Most WordPress Pros Lack Incident Recovery Plans

Key points

• Melapress polled 319 WordPress practitioners on September 18, 2026.
• Fewer than 30% reported having a recovery plan.
• The survey focused on those who had handled security incidents.
• No CVE was involved; the issue is preparedness, not a specific bug.
• The gap increases downtime and data loss risk for WordPress sites.

Melapress, which develops security plugins for WordPress, released survey results on September 18, 2026. The company questioned 319 people who work with WordPress and had confronted security incidents. The most striking finding: fewer than three in ten of those respondents keep a written recovery plan. No CVE identifiers apply here; this is a readiness gap, not a software flaw.

The affected group is broad. It includes site owners, agencies, and independent developers who depend on plugins for protection. When an incident occurs, those without a recovery plan often improvise, which can extend downtime, complicate forensics, and raise the chance of permanent data loss. For K-12 districts and government offices running WordPress, the stakes include student privacy and service continuity.

Why does this matter? Security incidents are not rare, and the survey specifically targeted people who had already handled them. Yet recovery planning remains an afterthought. A missing plan can turn a manageable event into a costly crisis, straining IT teams and eroding trust. The vendor’s perspective may shape the framing, but the underlying preparedness deficit is consistent with wider industry observations.

Context: WordPress powers a large share of the web, and its plugin ecosystem is both a strength and a risk surface. Recovery planning is a core part of resilience, distinct from prevention. What to watch: whether Melapress or others publish follow-up data, whether training and tabletop exercises become standard, and whether regulators in education and government begin asking for documented recovery capabilities. Improvement will require sustained attention, not a one-time survey.

What to do now

1. Create a written incident recovery plan that names roles, lists critical assets, and defines restoration steps.
2. Test backups by restoring them in a staging environment; keep at least one immutable, offsite copy.
3. Run tabletop exercises with IT staff and relevant stakeholders to validate the plan.
4. Inventory every WordPress plugin and theme, and track which ones are essential for recovery.
5. Set recovery time and recovery point objectives, then measure against them after each drill or real event.
6. Establish monitoring that alerts on unexpected file changes, logins, or outbound traffic.
7. Review and update the plan after any incident, staffing change, or major plugin update.

Original source

Help Net Security