The attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server. A smaller attack surface means fewer places where a flaw can hide, which is why reducing it is one of the most effective security steps for a site owner and one of the cheapest.
What is an attack surface?
Open ports, logins, plugins, forms and server code all count as points of entry.
Think of a building. The attack surface is the number of doors, windows and vents someone could try. You cannot make a building with no entrances, but you can stop leaving back doors open that nobody uses. A website works the same way. Each feature that accepts input or runs code on a request is a possible entry point.
Security people split it into a few parts. The visible part is what anyone can reach from the internet: pages, forms, login screens and public files. The hidden part is what runs behind them: the PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. runtime, the web serverA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files., the database and every plugin loaded on each request.
More is not better
Every plugin adds code that runs on your server and that someone must keep updated. A plugin that is switched off but still installed can still hold a vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data.. A feature you added for a campaign three years ago and forgot is still part of your surface.
What it means for a PHP or WordPress site
A typical WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. site has a large surface by design. It has a login at a known address, a plugin system that loads third-party code and a database that the code queries on each visit. Add old WordPress pluginsA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. and an outdated PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing., and the number of places to watch grows quickly.
Some surface is easy to cut. Remove plugins you do not use, close accounts that are no longer needed and check whether the XML-RPCXML-RPC is an old WordPress feature that lets other apps post to your site without the normal login screen. Attackers often target it with login attempts. endpoint is something you need. Other parts are structural, which is where the choice between dynamic and static pages matters.
A concrete example
Compare two sites with the same pages. The first runs on PHP and a database: on every page view, code on the server builds the page. The second is a static websiteA static website is made of ready-made page files that the server hands over as they are, with no PHP code or database working behind the scenes.: the pages are made ahead of time and served as files, with no PHP and no database on the server when a page is viewed. A flaw in the PHP runtime or in a plugin can only matter to the first. That is what we mean when we say a static site has a smaller attack surface. It does not mean it cannot be attacked, since the host, the access to the files and any third-party scripts still count.
How to check and when to act
Start with a list: PHP version, CMSA content management system (CMS) is software that lets you edit the pages, texts and images of your website by logging in, without writing any code. version, plugins, themes, admin accounts and third-party scripts. The free PHP exposure check shows what your site reveals from the outside, which is the part an attacker sees first. Then ask of each item: do I use this, is it maintained and could the site work without it?
If the list is long and the site mostly shows content, the better move may be to move from WordPress to a static site so that most of the surface disappears. If you must keep the dynamic parts, update them on a schedule and drop what you can.
Frequently asked questions
What is included in the attack surface of a website?
Everything an outsider can reach or that runs on a request: login pages, forms, plugins, themes, the CMS, PHP, the web server, open ports and third-party scripts. The more there is, the more places a flaw can sit.
How do I make the attack surface smaller?
Remove what you do not use, update what you keep, limit logins and admin access, and ask whether each feature needs code that runs on the server.
Does a smaller attack surface make a site unhackable?
No. It lowers the chance that a flaw exists and limits the damage, but nothing is unhackable. The goal is fewer places for things to go wrong.
Is a static site really safer?
Usually it has a smaller attack surface, because no PHP and no database run on the server when a page is viewed. It still needs a safe host, safe access to the files and care with any third-party scripts.