A survey from Melapress, a maker of WordPress security plugins, asked 319 WordPress professionals about their experience with security incidents. The group included agency staff, developers, designers, and site owners.
Most respondents said they had dealt with at least one known security incident. At the same time, most also said they do not have a breach recovery plan. The finding suggests that hands-on experience with breaches has not translated into formal preparation for the next one.
The survey report does not specify the types of incidents or the reasons why recovery plans are missing. Because it is a single survey, the results should be read as a snapshot of this particular group rather than a definitive measure of the wider WordPress community.