There isn’t one, and anyone who tells you theirs is unhackable is selling something. What separates them is who does the security work. Wix, Squarespace, Shopify, Webflow and WordPress.com run the servers and do the updates for you. Self-hosted WordPress leaves that to you and your host. And a site with almost nothing running on it is a much smaller target, but it isn’t something you build yourself.
Which builder is safest for you?
- You need a proper online shop: Shopify. Taking card payments safely is its whole business.
- You want to build it yourself this weekend: Wix or Squarespace. Keep the apps to a minimum.
- You or your designer want full control of the look: Webflow.
- It’s mostly a blog you post to every week: WordPress, with someone keeping it updated.
- You want a site that brings in work and never needs thinking about: a site with almost nothing running on it, looked after by someone whose number you have.
The reasons are below.
Most break-ins go through software nobody updated
Most break-ins use a known hole in a plugin, a theme or the software underneath, on a site where nobody installed the fix. In 2025, Patchstack, which tracks WordPress security, counted 11,334 new holes across WordPress, its plugins and its themes, 42% more than the year before, and 46% had no fix available when they were made public (Patchstack). In October 2026, two holes in PHP, the software under WordPress, had governments in Europe and Canada taking websites offline as a precaution; Can AI hack websites? has the story and the question to send your host.
So the first thing to ask of any builder is who installs the fixes, and how fast.
Wix, Squarespace, Shopify and Webflow: they run the servers
On a hosted builder, the company runs the servers, patches its own platform and sets up HTTPS for you. There’s no software for you to update. All four are audited by outside firms and say so: Wix, Squarespace, Shopify and Webflow each publish a security page, and Wix and Shopify hold the top level of the card-payment standard. WordPress.com, the hosted version of WordPress, says updates, backups and SSL “are all handled automatically”.
What’s left for you is your own account: a strong password, two-step login switched on, so signing in also needs a code sent to your phone, and care with the apps you add from their marketplaces, which can have holes of their own.
Self-hosted WordPress: it depends on who’s looking after it
If you log in at an address ending in /wp-admin and pay a hosting company, this is you. WordPress itself is well looked after: of Patchstack’s 11,334 holes in 2025, only six were in WordPress, while 91% were in plugins and 9% in themes. The risk is everything bolted on, and the PHP underneath, which only your host can update.
A WordPress site is as safe as the person updating it. With a good host, few plugins, two-step login and someone who patches the same week, it’s fine. Left alone, it’s the kind of site that gets broken into through a plugin nobody updated. You shouldn’t have to become your own IT department to keep a website up. If that someone is you, and you’d rather it wasn’t, the other options are worth a look.
A much smaller target: a site with almost nothing running on it
Some websites have almost no software running on the server. The pages are built ahead of time and served as files, so there’s no PHP, no plugins, no database and no login page: very little for an attacker, or their AI, to get a grip on. The forms, the one part that has to do something, run as a small piece of code on Cloudflare. It isn’t a builder you can use yourself. Someone has to build the site and make the changes, which is why it usually comes as a service.
That’s how we build every site. The accounts around it still need looking after: your domain, your hosting and your email. Nothing online is ever impossible to break, but this is about as small a target as a website gets, and on our plans anything that breaks gets fixed within two working days, with Craig as the one person you ring.
What to look for, whichever builder you choose
- Who installs the fixes, and how fast. On a hosted builder, the company. On WordPress, you and your host. On a built-ahead-of-time site, there’s little to fix.
- How much is bolted on. Every plugin, app or widget is software that can have a hole. Fewer is safer.
- Two-step login, for the site, the domain, the hosting and your email.
- Backups, and who takes them. Hosted builders keep their own; on WordPress, ask your host.
- Payments handled by a payment company, never card numbers on your own site.
Find out how quick your site is
The free report doesn’t check security; your host or your builder is the one to ask about that. What it does show is how much a phone has to download to open your site, which is where the plugins and widgets show up. We run Google’s speed test and email you the score out of 100, with a plain-English note on what’s slowing it down, usually within five minutes. If it comes back fine, we’ll say so.