The Game Has Changed: Why Your Law Firm's Website Should Get Off WordPress

The game has changed. With AI, attackers can find holes in website software and turn them into working attacks faster than ever, and the software they aim at hardest is the kind a great many law firm websites run on. If your firm's site is on WordPress, or on any content management system (CMS) with a login page and a store of add-ons, start planning your way off it. In our opinion, the people who maintain these systems will not be able to patch fast enough to keep your site safe. Here is why we think that, and what we built instead.

What changed

Three things happened at once.

The holes multiplied. Patchstack, a company that tracks WordPress security, counted 11,334 new vulnerabilities in the WordPress world in 2025, 42% more than the year before. Almost none were in WordPress itself: the core software had six, all low priority. 91% were in plugins, the add-ons that give a site its forms, sliders, SEO settings and page builders, and the rest were in themes.

The attacks got fast. In the same report, the holes attackers went after hardest were under mass attack a median of five hours after they were made public. Five hours is less than a working day. It is less time than most firms take to read an email from their web vendor, let alone act on it.

The fixes fell behind. 46% of those vulnerabilities had no fix from the plugin's developer by the time they were made public. For nearly half, there was nothing to install yet, however careful the site's owner was.

AI is speeding all of it up. Google's Threat Intelligence Group reported in October 2026 that 141 vulnerabilities across all kinds of software were exploited in the first eight months of 2026, more than in all of 2025, and that attackers may be using AI tools to read security patches and announcements and turn them into working attacks faster. Patchstack's own outlook says attackers are being equipped with AI that is increasingly able to find and exploit vulnerabilities on its own.

Why patching can't keep up anymore

Here is the part that changed the math. A security fix is also a map. When a plugin's developer ships a patch, the change shows exactly where the hole was. Reading that change and writing an attack used to take a skilled person days or weeks, and that delay was most sites' real protection: there was time to update before anyone came knocking. AI does the reading now, and the delay is shrinking toward nothing.

Now count the people in the chain. Every plugin on your site is written by a different team, some by a single developer in their spare time, some no longer looked after at all. Each one has to learn about a hole, fix it, test the fix and release it. Then your site has to install it, and someone has to check the update didn't break the contact form. Every step is a person on a schedule. The attack is a machine that doesn't sleep, pointed at every site running that plugin at the same time.

That is why we don't think this is a WordPress problem alone. Any CMS built the usual way has the same shape: a login page anyone can find, an admin screen that can change everything once someone is in, add-ons written by strangers, and the same code running on thousands of sites, so one working attack pays off thousands of times. The maintainers aren't careless. The race has become one they can't win, and your website is what is at stake when they lose it.

What a break-in costs a law firm

Nobody is targeting your firm in particular. Automated attacks hit every site running the vulnerable code, and a law firm is one more address on the list. What they leave behind is personal, though:

• Spam pages for pills or gambling, published under your firm's name, that Google finds before you do.
• Visitors sent somewhere else, or shown Google's "This site may be hacked" note beside your name in search results.
• Your ads stopped, because Google won't send paid clicks to a compromised site.
• If your form plugin keeps a copy of every enquiry on the site, and many do, every one of them exposed: names, phone numbers and what happened to people on one of the worst days of their year.

A law firm sells trust. A hacked website spends it in public.

What we built: a law firm website with nothing to log in to

Every website we build now starts from one rule: don't defend a door you can remove.

• No login page, and no admin screen. There is no account on the site at all, so there is no password to guess, steal or phish, and no admin panel for anyone to reach. The site's own tests fail if a login address ever appears.
• No plugins. Every piece of code on the site is ours, kept small and doing one job. Nothing comes from a plugin store, and nothing depends on a stranger's spare time.
• Pages served as finished files. When someone visits, Cloudflare's network or the server hands over a ready-made page. Most visits never reach the site's software at all, and an attack needs software to talk to.
• One narrow door for changes. Changes come from two places only. Our Firm Hub publishes through a locked connection that needs the site's key and must come from the hub's own server, and it sends words and images, never code. Everything else is a change we make on our own computers, kept on record and released by us. Every piece of text that arrives is cleaned down to a short list of allowed formatting, and any script in it is stripped out.
• A list of what may run. The site tells every visitor's browser exactly which scripts are allowed, its own and a short named list such as Google Analytics, and the browser refuses everything else. There is no Google Tag Manager, because anyone with access to Tag Manager can put any script on a site, past every check.
• Enquiries locked. Each enquirer's name, email, phone and message are encrypted in the site's database and never written to a log, so a stolen copy of the database shows nothing readable.
• A server of its own, doors shut. Every firm's site runs on its own server behind Cloudflare, with the database closed to the outside world and only web traffic and our own maintenance connection let in.
• Backups nobody can erase. Every night the site is copied to separate storage that is locked for 30 days, so even someone holding the server's key can't delete the copies.
• Fixed once, fixed everywhere. The security core is one piece shared by every site. A fix is made once and goes to all of them, and we check the security notices for everything the sites depend on every day.

Before any site goes live, its code gets an independent security review.

Nothing is unhackable, so we removed the doors

Anyone who promises you an unhackable website is selling something. Software has bugs, ours included. What we can do is take away the ways in that most attacks use, and make the few that are left narrow, locked and tested.

Count the doors. A typical WordPress site offers a login page, an admin screen and every plugin it has installed, each one a separate lock made by a separate locksmith. Ours offers nothing to log in to, a contact form that checks every submission before it saves anything, and one connection that only our hub's server can use. Everything else on it can only be read.

If your firm's site runs on WordPress today

Don't panic, and don't rebuild in a rush; a rushed move is its own risk. Do these now:

1. Delete every plugin and theme you aren't using. A switched-off plugin still sits on the server.
2. Turn on automatic updates for the plugins you keep, and ask whoever looks after the site how fast a security update really gets installed.
3. Make sure every admin account uses two-step sign-in, and remove the accounts of people who have left.
4. Find out whether your contact form keeps a copy of every enquiry on the site. If it does, ask whether it needs to.
5. Check that a backup exists somewhere other than the server, and that someone has actually restored one.

Then plan the move on your own schedule rather than an attacker's. When we move a firm, every page and post comes across, and every old address is forwarded to its new one, so links and bookmarks keep working and search engines are told where each page went. That is how we build law firm websites now. If you'd like a straight read on what AI means for the rest of your firm's technology, that is what our AI consulting for law firms is for. And if the first question is cost, here is why nobody quotes a law firm website price on the first call.

Frequently asked questions

Is WordPress itself unsafe?

WordPress's core software is well looked after: Patchstack found six vulnerabilities in it in 2025, all low priority. The risk is everything around it, the plugins and themes where 11,334 holes turned up that year, and a login page anyone can find. A WordPress site is only as safe as its least looked-after plugin.

Won't automatic updates keep a WordPress site safe?

They help, and you should turn them on. But an update can only install a fix that exists, and in 2025 nearly half of WordPress vulnerabilities had no fix from the developer when they were made public. The most heavily attacked ones were under mass attack within hours, so even a site that updates every day can be caught in the gap.

Is a website with no CMS unhackable?

No, and nobody should promise you one that is. What it removes are the most common ways in: there is no login to steal, no admin screen to take over and no plugin to exploit. What is left is small, locked down and tested, and it gets an independent security review before it goes live.

How do we change our website if there is nothing to log in to?

You tell us in a line or two through the request form in your Firm Hub, and it is done. Blog posts and page updates are published through the hub's locked connection, and everything else is made and released by us. Nobody at the firm has a website password to lose.

Isn't custom code riskier than software thousands of people check?

It would be if it were large and did a lot. Ours is deliberately small and does one job, and its security rules are checked by tests that fail if a rule is ever broken. It is reviewed independently before any site launches, and it doesn't run on millions of other sites, so it isn't what one-size-fits-all attack tools are built for.