{"id":301,"date":"2025-12-01T06:36:53","date_gmt":"2025-12-01T06:36:53","guid":{"rendered":"https:\/\/es-co.wordpress.org\/about\/security\/"},"modified":"2025-12-01T06:36:53","modified_gmt":"2025-12-01T06:36:53","slug":"security","status":"publish","type":"page","link":"https:\/\/es-co.wordpress.org\/about\/security\/","title":{"rendered":"Seguridad"},"content":{"rendered":"\n
We take the security of the WordPress project and the ecosystem seriously. With over 20 years of history<\/a> and powering more than 43% of the web, we’re committed to ensuring security for all, from solo bloggers to enterprise organizations.<\/p>\n\n\n\n WordPress encourages responsible disclosure of vulnerabilities in WordPress core, in plugins and themes available on WordPress.org, or in the wider WordPress ecosystem.<\/p>\n\n\n\n If you believe you have found a vulnerability in WordPress, please keep it confidential and report it to the WordPress Security Team<\/a>.<\/p>\n\n\n\n If you believe you have found a vulnerability in a WordPress plugin or theme available on WordPress.org, please keep it confidential.<\/p>\n\n\n\n The WordPress project is committed to providing a stable, secure, trusted platform for more than 43% of the web. The core WordPress software development lifecycle<\/a> includes code review throughout the process, with open-source contributions reviewed by trusted committers.<\/p>\n\n\n\n The WordPress Security Team works to identify and resolve security issues across the WordPress core software, harden the software against threats such as the OWASP Top Ten<\/a>, and provide guidance<\/a> across the ecosystem.<\/p>\n\n\n\n In addition to more than 50 trusted experts, including lead developers, security researchers, and key contributors to every component of WordPress, sponsored members of the Security Team<\/a> dedicate time to identifying and addressing concerns in the software and ecosystem.<\/p>\n\n\n\n To address responsibly-disclosed security vulnerabilities, the Security Team works to develop fixes, create robust test cases, and release those fixes in bugfix releases<\/a>. While only the latest version of WordPress is officially supported, the Security Team also backports fixes to older versions as a courtesy<\/a>, to ensure older sites receive critical security fixes via auto-updates.<\/p>\n\n\n\n The Security Team also works directly with significant web hosting operators and security ecosystem providers to detect and mitigate threats to WordPress-based sites, including coordinating release rollouts and developing web application firewall (WAF) mitigations.<\/p>\n\n\n\n Learn more about the WordPress project’s security stance in our whitepaper<\/a>.<\/p>\n\n\n\n The Security guide in the Common APIs handbook<\/a> is your go-to guide for secure development principles.<\/p>\n\n\n\n If you believe you’ve identified a security problem in your own plugin, the WordPress plugins team is here to support you.<\/p>\n\n\n\n Find out more about how to address security issues in your plugin.<\/a><\/p>\n<\/div>\n\n\n\n The Security guide in the Common APIs handbook<\/a> is your go-to guide for secure development principles.<\/p>\n\n\n\n If you believe you’ve identified a security problem in your own theme, the WordPress theme review team is here to support you.<\/p>\n\n\n\n\n
Our process<\/h2>\n\n\n\n
Plugin Developers<\/h2>\n\n\n\n
Theme Developers<\/h2>\n\n\n\n