When browsing the landing pages of major WordPress hosting providers, prospective customers are routinely greeted by prominent assurances of "secure hosting." These promises often suggest that users can entirely offload their safety concerns to the infrastructure provider, eliminating the need for third-party security plugins or external hardening measures. However, a comprehensive real-world penetration testing study conducted by WordPress security firm Patchstack challenges these long-standing marketing claims, revealing a significant gap between promotional hype and actual technical protection.
Maciek Palmowski, a Growth Team Engineer at Patchstack based in Poland, recently unpacked the methodology and sobering results of this research during a presentation at WordCamp Europe in Krakow. Speaking with Nathan Wrigley on the WP Tavern Jukebox Podcast, Palmowski discussed how his team set out to rigorously test the security guarantees made by multiple hosting providers using standardized methodologies and independent validation.
The research initiative was originally sparked by an inquiry from WordPress co-creator Matt Mullenweg, who questioned whether hosting companies were already inherently taking care of site security. While security professionals suspected the answer was negative, empirical proof across a broad spectrum of hosting environments was previously limited to anecdotal observations. To move past assumptions, Palmowski and his colleagues designed a straightforward, real-world test: they installed a series of known vulnerable plugins and attempted to execute standard attacks against multiple hosts to see if the infrastructure would block them.
Putting Hosting Providers to the Test
The testing parameters were intentionally rigorous and relied entirely on documented vulnerabilities. Patchstack utilized a curated selection of more than 30 known plugins featuring a diverse mix of vulnerability types, including components integrated with WooCommerce. Crucially, every selected plugin had a verified proof of concept derived directly from vulnerabilities reported through Patchstack’s industry bug bounty program, meaning the attack vectors and mechanics were fully understood.
To give hosting providers every possible advantage, the research team manually enabled all available security features offered within each hosting environment. Despite these efforts, the initial beta run yielded a startling discovery: approximately 80% of the attacks successfully bypassed the hosting layers. Surprised by the high failure rate, Patchstack expanded the scope for a secondary, more comprehensive test involving a larger group of hosting providers and an extended library of plugins.
The subsequent findings confirmed the initial trend, with the vast majority of WordPress-specific attacks still successfully breaching the perimeter. While hosting environments generally performed well against generic PHP-level threats—such as standard file uploads and path traversal issues—they failed miserably when confronted with WordPress-specific application layer vulnerabilities.
One of the most revealing discoveries during the testing process was that even hosting companies utilizing identical underlying security tools—such as specific web application firewalls or third-party vendor integrations prominently displayed via corporate logos—produced drastically different security outcomes. This variation demonstrated to the research team that effective security is not merely about deploying a specific set of tools, but rather how those tools are configured, maintained, and operationalized. Some hosts maintained more aggressive configurations that offered better protection at the expense of potential false positives, while others permitted malicious traffic to pass through unchecked.
The Swiss Cheese Layer Model of Security
In light of these findings, Palmowski emphasizes a foundational philosophy that security professionals have long championed: security is never a single-button solution or a standalone plugin; it is an ongoing process built upon multiple overlapping defenses. Patchstack refers to this paradigm as the "Swiss cheese layer model."
Under this framework, every individual security layer—whether it is server-level firewall protection, a WordPress security plugin, or regular software updates—will inevitably contain microscopic holes or vulnerabilities. Because no single layer is infallible, administrators must implement multiple defenses stacked on top of one another. When the first generic layer filters out baseline attacks, subsequent layers designed specifically for the WordPress application environment can intercept more targeted threats.
However, because zero-day vulnerabilities, weak passwords, and custom code flaws will inevitably slip past technical safeguards, organizations must also prepare for the worst-case scenario. This includes establishing clear, pre-planned operational procedures for incident response, breach communication, legal compliance under regulations like GDPR, and reliable data recovery strategies before an attack occurs rather than scrambling after a breach has taken place.
The research also highlights the alarming speed at which threat actors leverage newly disclosed vulnerabilities. According to Patchstack’s broader State of WordPress Security data, malicious actors frequently begin exploiting published vulnerabilities within a mere five hours of disclosure. Compounding this challenge is the fact that roughly half of all plugin vendors fail to issue patches within the standard 30-day responsible disclosure window. When software maintainers leave bugs unpatched and threat actors automate attacks within hours, relying solely on weekly update schedules leaves sites dangerously exposed.
Navigating Messaging and the Rise of AI
The pervasive use of absolute terms like "secure hosting" complicates consumer decision-making. Much like ambiguous health claims on food packaging, the term lacks a standardized, industry-wide definition, leaving companies free to market relative infrastructure hardening as absolute protection. Palmowski notes that while managed hosts understandably market convenience—allowing site owners to focus on content creation and commerce rather than server administration—blanket assurances of complete safety can create a dangerous false sense of security for end users.
For site owners looking to navigate this landscape, Palmowski advises adopting a healthy degree of skepticism toward sweeping marketing claims. When evaluating hosting providers, administrators should ask targeted, intelligent questions rather than accepting generic assurances. Specifically, buyers should inquire whether the host’s security stack includes WordPress-aware protections rather than relying exclusively on general web application firewalls that lack context regarding the underlying content management system. Furthermore, looking for hosts that integrate closely with established WordPress security ecosystems, such as official Patchstack hosting partnerships, can serve as a positive indicator that a provider takes application-specific threats seriously.
As the industry looks ahead, the integration of artificial intelligence into both offensive and defensive cybersecurity operations introduces new complexities. With automated agents capable of discovering vulnerabilities, mapping attack surfaces, and executing exploits at unprecedented speeds, the window for human reaction continues to shrink. Despite these escalating technological challenges, Palmowski maintains that WordPress core remains fundamentally secure, with the vast majority of security incidents stemming from the decentralized plugin ecosystem rather than the underlying software architecture.
Ultimately, the research serves as a reminder that robust security requires continuous vigilance, intelligent questioning of hosting capabilities, and the implementation of multi-layered defenses that acknowledge the realities of the modern threat landscape.
