The promise of "secure hosting" is a cornerstone of the modern WordPress ecosystem. Go to almost any managed hosting provider’s landing page, and you will find prominent assurances that your site is safe, shielded, and continuously monitored. Yet, according to comprehensive new research, there is a yawning chasm between marketing rhetoric and technical reality.
In a recent appearance on the Jukebox Podcast from WP Tavern, Nathan Wrigley sat down with Maciek Palmowski, Growth Team Engineer at Patchstack, to discuss his explosive WordCamp Europe presentation: "Testing the Promise: Does Secure Hosting Deliver?"
The findings are sobering. When put to the test with real-world penetration testing, the majority of WordPress-specific attacks still slip past the defenses of leading hosting providers.
Main Facts: The "Secure Hosting" Illusion
The core takeaway from Palmowski’s research is stark: generic security infrastructure—such as standard Web Application Firewalls (WAFs) and basic PHP hardening—is no longer enough to protect a dynamic content management system like WordPress.
Key insights from the investigation include:
- The Reality Gap: In standardized penetration tests across multiple popular hosting environments, roughly 70% to 80% of WordPress-specific attacks successfully bypassed host-level security measures.
- The Tools vs. Execution Paradox: Researchers discovered that even hosting companies utilizing identical third-party security tools (such as specific WAF solutions) produced wildly different security outcomes. The effectiveness of a tool depends heavily on its backend configuration.
- The "Healthy Chocolate" Analogy: Terms like "secure hosting" often function much like the word "healthy" on food packaging—vaguely defined, heavily marketed, and frequently misleading.
- The Patch Lag: Data from Patchstack’s wider ecosystem research indicates that vulnerabilities are actively exploited within a median window of just five hours after public disclosure. Furthermore, nearly 50% of vulnerable plugins remain unpatched by their developers 30 days after notification.
Chronology: How the Research Unfolded
The impetus for this investigation did not stem from a theoretical exercise, but rather from a high-level industry challenge.
Phase 1: The Initial Trigger
The project began following the publication of Patchstack’s annual State of WordPress Security report. Highlighting the data on social media, the team received a direct inquiry from WordPress co-creator Matt Mullenweg, who asked a fundamental question: "Aren’t hosting companies taking care of this already?"
While Palmowski and his colleagues suspected the answer was negative, they lacked broad, empirical proof. Previous assumptions were largely based on anecdotal evidence.
Phase 2: The Beta Run
To find out, Patchstack designed a simple, pragmatic test: they installed a series of known vulnerable plugins onto various hosting platforms and attempted to execute standard attacks.
The initial beta run focused on a limited selection of hosts and plugins. The result shocked the research team: 80% of the simulated attacks succeeded. Fearing testing errors due to the staggering failure rate, the team expanded and standardized the methodology for a much larger, rigorous study.
Phase 3: Scaling the Test
The final study—the basis of Palmowski’s conference presentations in Palermo and Krakow—scaled up significantly. Researchers deployed over 30 known plugin vulnerabilities (featuring diverse attack vectors, including WooCommerce integrations) across a wide array of hosting environments. All tests utilized verified proof-of-concept exploits discovered via Patchstack’s bug bounty program. Every available security setting on each host was deliberately enabled to give providers every advantage.
Supporting Data: By the Numbers
To contextualize the findings, Palmowski highlighted several critical data points regarding the velocity of modern cyberattacks and the responsiveness of the plugin ecosystem:
- 80% Attack Success Rate: During initial testing, the vast majority of WordPress-specific exploits successfully bypassed the default security layers of tested hosts.
- 5-Hour Exploitation Window: Automated botnets and malicious actors begin leveraging newly published vulnerabilities within an average of five hours. Traditional advice to "update your site weekly" is dangerously obsolete.
- 50% Non-Compliance Rate: Of all vulnerabilities reported to plugin vendors through structured bug bounty channels, 50% remain unpatched at the time of public disclosure due to unresponsive developers.
- Generic vs. Specific Defenses: Hosts generally performed well against broad, generic PHP attacks (such as unauthorized file uploads or path traversal). However, they failed miserably against attacks requiring contextual understanding of WordPress structures.
Official Responses and Industry Accountability
Following the completion of the tests, Patchstack contacted the participating hosting companies, sharing detailed breakdown reports of which attacks were blocked and which succeeded.
The reactions varied wildly:
- The Proactive Responders: Some hosting providers immediately took the data to heart, analyzing their configurations and patching vulnerabilities in their edge logic where possible.
- The Complacent Hosts: Conversely, a notable subset of providers took little to no action upon receiving empirical evidence of vulnerabilities in their environments.
When asked why Patchstack chose to anonymize the hosting providers in their public presentations, Palmowski explained that naming specific companies often creates a dangerous false sense of security. Users of non-listed hosts might assume they are safe simply because their provider wasn’t named, ignoring the systemic nature of the issue.
Implications: The Swiss Cheese Model and the Threat of AI
As the industry moves deeper into 2026, the implications of these findings point toward a fundamental shift in how web professionals must view hosting, security, and risk management.
Embracing the "Swiss Cheese" Security Model
Palmowski advocates for abandoning the illusion of a single, impenetrable security perimeter. Security must instead rely on the Swiss Cheese Model: every defensive layer (hosting infrastructure, WAFs, WordPress-aware security plugins, and file integrity monitors) will inherently possess microscopic holes. By overlapping multiple distinct layers, you reduce the probability that an attack can pass all the way through.
The Emerging AI Threat Multiplier
The conversation also addressed the compounding threat of Artificial Intelligence. Threat actors increasingly deploy AI agents to scan, discover, and exploit vulnerabilities at speeds entirely untamable by human response times. When AI compresses the time-to-exploitation from days down to minutes, static hosting security features become increasingly ceremonial.
How to Question Your Host
For agency owners, developers, and end-users navigating this landscape, Palmowski advises moving past generic marketing claims. Instead of asking if a host is "secure," buyers should ask targeted, technical questions:
- "Does your security stack include components that are specifically WordPress-aware, or do you rely solely on generic web application firewalls?"
- "What is your protocol when a zero-day vulnerability or an unpatched plugin exploit targets our specific hosting environment?"
Ultimately, security is not a feature you buy by checking a box on a hosting tier; it is an ongoing, multi-layered operational process.
