So Outside Technology Security CMS
AnQiCMS
Online Demonstration

The report shows that 90% of vulnerabilities come from plugins, which part of the site should be strengthened first.

📅 October 26, 2026 👁️ 0

The security report says that about 90% of newly discovered vulnerabilities come from plugins, and what the site needs to reinforce first may not be 'install fewer plugins', but rather the entry points that can be triggered externally: this 90% ratio describes the distribution of the attack surface, not the ranking of core quality. Reordering the reinforcement sequence according to the exposure surface will be more practical - first converge login and session, turn off backup upgrade operations of the entire site by default, then count the actual enabled extensions and integrations, and finally prepare for recovery capabilities by treating credential rotation and backup drills. Fewer plugins only means lower follow-up costs, and it does not itself constitute a defense line.

What do the ratio numbers mean

Patchstack's annual report for the WordPress ecosystem listed a set of numbers: 11,334 new vulnerabilities were added in one year, 91% of which were from plugins, 9% from themes, and only 6 from the core.This ratio is often described as 'the core is more secure, the plugin is more dangerous', but its more accurate meaning is the attack surface distribution: the vast majority of code that can be triggered externally comes from third-party extensions, not from the repeated penetration of the same core.Moving the conclusion directly to your own site will become a list of wrong actions - the real question is not 'Is my system one of those easily attacked', but 'How many triggerable entries did I give to the outside.'The same report also mentions that commercial plugins in some areas are required to establish a vulnerability disclosure mechanism, the extended reporting and repair chain will be more standardized, but standardization does not equal zero risk.

Reinforcement sequence according to exposure surface

的东西，thing that can be triggered externally, then arrange the internal components

exposed surface risk type Priority action
login and session credential forgery, brute force attempts converging entry, verification mechanism, flow control
background high-risk operations backup, upgrade, site switching triggered by mistake default off, explicitly enabled when needed
extension and integration Defect brought in by third-party code Check the list, delete disabled items
Data writing Injection, unauthorized modification Parameterization and field validation
Content and form Flooding, batch submission Sensitive word filtering and captcha

Whether it can be touched by outsiders is in front, not how much is filled.

High-risk capabilities are turned off by default

Almost all vulnerabilities come from plugins, and the corresponding strengthening approach is to strip the

Data is written to this line

The cause of injection-type issues is not usually 'being scanned', but rather the path of parameter concatenation is not guarded. Entries like list sorting, filtering conditions, which seem harmless, are equivalent to giving a part of SQL to the external party if the parameters are not validated before falling into the query.AnQiCMS has fixed two high-risk issues of list sorting parameter injection and site switching login credentials being forgeable in version v3.6.6. The official upgrade recommendation includes rotating the full-site signature key and changing the administrator password - fixing and credential rotation is a set of actions, only patching without changing credentials, the environment that has been taken over still open.The built-in JWT authentication, content sensitive word filtering and anti-capturing interference code cover several other types of risks and cannot replace parameter validation.

Not installing plugins does not equal safety

Sites with few extensions are just following a smaller surface, and the sources of risk also include runtime, template execution, file upload and residual backup. Counting is more important than cutting: list the current components actually in use, their maintenance status and recent updates; completely remove items that are disabled but not uninstalled; leave a fixed window for upgrades. Recovery capabilities should be placed last but must be practiced once, data backup should include static files, so that the entire system can be restored in case of problems, rather than just pulling back the database but missing images and attachments.

Common questions

Question: ninety percent come from plugins, is it safe to change a set of core systems?Not at all. The ratio refers to the distribution of the attack surface, any system that opens external writable and login entry points needs to be strengthened according to the exposed surface.

Question: If the small station does not have payment and membership, do we still need to manage high-risk operations?Backup and upgrade actions themselves are high-value targets, and after gaining control, they can change content and pollute the collection, the significance of default closure is here.

Question: Should the patch be applied immediately or wait a while?High-risk repairs are counted by hours, the median time for large-scale exploitation in the report is only a few hours; regular updates can leave a verification window, but there must be a fixed follow-up rhythm.

What is the legal requirement of the vulnerability disclosure mechanism for website administrators?It requires plugin manufacturers to have a reporting entry, so that you can find the official response channel when problems arise, rather than just waiting for forum messages.

Related articles

Website evaluation lists SEO and page speed as two indicators, which one should webmasters pay attention to?

The third-party website building tool evaluates the SEO capability and page speed by scoring them as two separate items. The reading method is not to copy the high-score items, but to determine the weight according to the scenario first. Page speed determines the effect of all optimization, and SEO capability determines whether it can be understood and indexed. When looking at the list, you need to distinguish between qualitative evaluation and reproducible indicators. For self-hosted sites, you also need to ask: Are these two items decided by the system or operations?

2026-10-26

llms.txt is called the site map of the AI era, and what does it manage compared to sitemap?

Two files do not solve the same thing: the site map is for address list, aimed at crawling discovery, emphasizing comprehensive coverage; llms.txt is for content description, aimed at understanding and reference, emphasizing selected entries and one-sentence explanations of responsibilities. Using llms.txt as a crawling switch or as a full link list will make it ineffective. The former is responsible for being discovered, and the latter is responsible for being understood. The configuration order is to have readable text first, followed by the description file.

2026-10-26

Statistics says that search references are looking at paragraphs, not the whole page, and the organization of content needs to be changed in which three places?

The object quoted is usually a text that can stand independently, rather than a whole page. According to this criterion, there are three changes to be made: the subtitle should be written as a question that the user would ask, the paragraph should be self-contained and not dependent on the previous text, and the conclusion should be brought forward to the first paragraph within one hundred and twenty words. This judgment comes from the summary of a third-party practice guide, not the official statistics of the search engine, and it is appropriate to organize content with it, but it is out of bounds to predict rankings.

2026-10-26

How can the script-rendered page allow the AI crawler to read the answers in the text?

Most AI scraping tools do not execute scripts after receiving the response HTML, and the text is injected by front-end scripts into the page, which is an empty shell in the extraction layer. To make the model read the answer, the core is to let the text appear in the initial response: server-side rendering, static output during construction, or writing key question and answer paragraphs directly into the page. The site description file solves the problem of content navigation, which cannot replace the rendering problem.

2026-10-26

Why can't robots prevent content from being taken if they only wrote to prohibit crawling?

The robots file is a request, not a gate: it only takes effect for those who voluntarily comply with the rules, and the collection script can be ignored directly. The content is taken in bulk, and what is missing is never this line Disallow, but rather access control, text value protection, and source verification. By treating the restriction of crawling and the protection of content as two separate issues, we can know where to strengthen at each level.

2026-10-26

The same article posted on the group is recognized as duplicate content, how should the standard writing style be established?

An article posted on multiple sites is deemed to be duplicated, and the problem usually does not lie in the writing style, but in the lack of a main version: who holds the original address, how to point back to the other copies, and how to handle the old address during the revision period. If any of the three things are missed, they will compete for weight. The standard writing style should be determined before publication, rather than补ing after the problem is discovered, and the logic of the in-site list page and parameter page is also the same.

2026-10-26

The statistics that 13,000 websites are hacked every day are saying who, and which layer the attack has entered.

The statistics show that about 13,000 sites are hacked every day, which refers to the existing risk of a large number of publicly available sites under batch scanning, not an occasional accident of a single site. What is more noteworthy is the level of attack entry: malicious code is injected into legitimate core, plugin, and theme files, bypassing the approach of finding problems by "abnormal files". The defense line should be shifted to change verification and recovery capabilities, rather than just focusing on login entries.

2026-10-26

How much does it cost to self-host a Go language system for five years, and where do the bills differ from PHP stacks?

The main difference in the five-year self-hosting gap is not in the software license, but in the host slot usage decided at runtime, and who bears the maintenance hours. Third-party accounting provides a set of references: under the same VPS slot, the hardware bill for five years is about several hundred dollars, while the complete five-year accounting for maintenance sites can reach $2,000 to $4,000. The memory and concurrency surplus affects the lowest running slot, which is where the stacks truly differ.

2026-10-26