A free website platform is only free until someone has to keep it secure. For school districts, nonprofits, and municipalities, that someone is often a communications director or a single IT person who already has a full-time job.
WordPress powers a huge share of the web, and it earned that reach honestly: it's flexible, familiar, and cheap to start. But it runs on PHP and depends on a sprawling ecosystem of third-party plugins and themes. That combination creates an ongoing maintenance and security workload that many public-facing organizations don't budget for until something goes wrong.
Here's what that workload looks like in 2026, and why a dedicated, fully managed CMS vendor is a better fit for organizations whose websites carry public trust.
The Real Risk Lives In Plugins
To be fair to WordPress, its core software is well maintained. The problem is everything bolted onto it. According to Patchstack's 2026 annual report, 11,334 WordPress-ecosystem vulnerabilities were disclosed in 2025, and 91% of them were in plugins. Only 2 were in WordPress core. (source)
A typical site runs 20 to 30 plugins, often built by small or solo developers. Many of the most serious flaws can be exploited without logging in, and some are never patched at all. Even trusted premium plugins aren't immune: in 2025, a popular forms plugin had its official download server compromised.
Every plugin is a separate vendor, a separate update schedule, and a separate thing to watch.
The pace hasn't slowed in 2026:
- Week of March 4: 281 new vulnerabilities across plugins and themes, with 225 still unpatched at the time of the report. (SolidWP)
- Week of June 22–28: 201 vulnerabilities across 171 plugins and 9 themes. (Wordfence)
- Week of August 17–23: 263 vulnerabilities across 206 plugins and 17 themes. (Wordfence)
The PHP Upgrade Treadmill
Underneath WordPress is PHP, and PHP versions expire on a fixed schedule. Once a version reaches end of life, the PHP project stops releasing security fixes for it, and any vulnerability found afterward stays open for good.
In practice, many sites fall behind. As of late September 2026, WordPress.org's own statistics showed PHP 7.4, nearly four years past end of life, still running on 16.7% of reporting WordPress sites. (source) And with PHP 8.2 support ending this December, another large group of sites is about to join them.
Upgrading isn't a button press. Each PHP jump can break older plugins and themes, so every upgrade means testing, fixing, and sometimes replacing tools the site depends on. Many cyber insurance policies now expect current, supported software, which turns a technical chore into a compliance question.
PHP version | Security support ends |
|---|---|
7.4 | Ended November 2022 |
8.1 | Ended December 31, 2025 |
8.2 | December 31, 2026 |
8.3 | December 31, 2027 |
So who's watching your site?
With a self-managed WordPress site, the answer is usually "whoever has the admin password." That person is responsible for:
- Tracking weekly vulnerability disclosures across every installed plugin and theme
- Applying updates quickly, then checking that nothing broke
- Replacing plugins that are abandoned or never patched
- Coordinating PHP upgrades with a hosting provider before each version expires
- Figuring out which plugin broke when something stops working, then tracking down its developer for support
- Cleaning up and restoring the site if it's compromised
For a school district, a hacked homepage isn't just embarrassing. It's the place families go for closings, emergencies, and board notices. For a city or nonprofit, it's the front door to public services and donor trust. These organizations need a website that stays secure without depending on one overextended staff member.
What A Dedicated CMS Vendor Does Differently
Foxbright builds, hosts, and maintains its own proprietary CMS for K–12 school districts, nonprofits, and municipalities. Neither our websites nor our CMS use PHP. That design choice changes who carries the burden.
- No plugins required. Everything is built into our CMS natively. Every feature is designed, tested, and maintained by our own team, so there's no hunting for plugins, no juggling dozens of third-party developers, and no wondering which add-on will break after the next update.
- Platform upkeep is our job, not yours. Security updates and underlying technology upgrades happen on our side, across every client site, without your staff testing plugin compatibility.
- One accountable partner. With a plugin-heavy site, a problem means first figuring out which plugin caused it, then tracking down whoever built it, if they still offer support at all. With Foxbright, there's one support team to call, not an unknown number of plugin developers, and no finger-pointing between a theme author, a plugin developer, and a host.
- Built for the people who actually run these sites. Our CMS is designed for communications staff and administrators, not developers, so content updates don't require technical expertise.
No platform can promise zero risk. But removing plugins eliminates the source of 91% of WordPress vulnerabilities, and every line of code behind your site is owned, secured, and supported by one team that answers to you.
Questions To Ask About Your Current Website
Whether you're on WordPress or another platform, these questions will tell you where you stand:
- Which PHP version is our site running, and when does its security support end?
- How many plugins and themes are installed, and who is checking them for vulnerabilities each week?
- Who applies updates, and who tests that the site still works afterward?
- If our site were compromised tonight, who would we call, and how fast would they respond?
- Is any sensitive data stored in our website platform?
If the answer to any of them are "I'm not sure" or "probably me," it may be time for a different approach.
Foxbright has been helping schools, nonprofits, and local governments across the country run secure, easy-to-manage websites. Contact us to talk about what a fully managed CMS could take off your plate.
Foxbright — powerful websites and personal support for schools, municipalities, and nonprofits. Michigan-based and women-owned, partnering with communities for 20+ years.
As a Foxbright client, you can expect:
Why Your Website Platform Matters: WordPress, PHP, and the Hidden Cost of “Free” 
ADA Title II Web Compliance: The 2027 and 2028 Deadlines for Schools, Cities, and Townships 
How to Choose a School Website Provider: A Vendor Checklist for Districts Want to Learn More About Foxbright?
See the Difference for Yourself
Want a website that’s easy to use and backed by real people who care? Let’s talk about how Foxbright can support your organization's goals today, and for years to come.
