Just thought I would share these statistics out of interest.

I am migrating away from a VPS that I have had for years to a new (cheaper) provider.

I used Site Sucker Pro to download the one Wordpress site that I had active and converted it to an static site. The site was old and wasn't going to be updated, so I didn't need to worry much about keeping any Wordpress functionality. It also had a very old version of Elementor Pro that I no longer pay for.

The site had 8 pages and had the following plugins activated:

• Elementor
• Elementor Pro (not updated for over 2 years as no pro licence active)
• Google Site Kit
• Really Simple SSL
• Rank Math
• Shortpixel Image Optimiser
• Wordfence (free)
• WP Super Cache

The site was using the "Hello" theme from Elementor but also had the 2025 and 2024 themes as backup (for testing)

I took a backup of the site before I did anything and I was struck by the number of PHP and Javascript files across the entire site. Here are the stats:

• 7876 .php files
• 2954 .js files

And yes, I get that the majority of these PHP files are small, single functions that the devs have split down for ease of use.

But in my mind, this is quite a simple Wordpress site - not too many pages and I kept the number of plugins and themes to a minimum.

I have nothing against Wordpress at all and would choose to use it again, but the number of possible attack vectors feels huge!

No wonder people think Wordpress is such a security risk.