The promise of "secure hosting" is a cornerstone of the modern WordPress ecosystem. Walk into any major web hosting provider’s landing page, and you are almost guaranteed to find bold claims near the top of the fold: "Worry-free security," "Enterprise-grade protection," or "No extra security plugins needed."
However, a groundbreaking independent research project conducted by Patchstack and presented at WordCamp Europe in Kraków by Growth Team Engineer Maciek Palmowski suggests a sobering reality. According to comprehensive real-world penetration testing, there is a yawning chasm between marketing hype and actual security protection. When put to the test against known vulnerabilities, the majority of WordPress-specific attacks still slip right through.
Main Facts: The Reality Behind the Claims
The impetus for this deep dive into hosting security came from an unexpected source. Following the publication of a routine State of WordPress Security report, Patchstack’s findings sparked a public query from WordPress co-creator Matt Mullenweg, who asked a fundamental question: Aren’t hosting companies taking care of this already?
While industry insiders suspected the answer was a qualified "no," concrete empirical evidence was lacking. To find out, Palmowski and his team devised a straightforward, real-world methodology: they installed a curated list of 30 known, vulnerable WordPress plugins across multiple hosting providers, enabled every available security setting offered by those hosts, and ran standardized penetration tests.
The results were startling. During initial beta runs, 80% of attacks successfully bypassed hosting defenses. A subsequent broader study across a larger array of hosts and plugins yielded similarly alarming numbers, with the vast majority of WordPress-specific exploits punching straight through the purported safety nets.
Chronology: How the Research Unfolded
The research project was structured in phases to ensure accuracy, eliminate anomalies, and challenge initial assumptions:
- The Catalyst: Following public discussions regarding who bears the burden of website security, Patchstack moved from anecdotal observations to empirical testing.
- The Beta Run (Phase One): A preliminary test involving a small group of hosting providers and a limited selection of plugins. The finding—that 80% of attacks went through—was so initially shocking that researchers suspected an error in their own testing methodology.
- The Full Scale Study (Phase Two): Bolstered by the beta results, researchers expanded the test parameters to include a much wider selection of hosting providers and more than 30 distinct, real-world plugin vulnerabilities.
- Independent Validation: The tests utilized standard methodologies, leveraging proof-of-concept vectors derived directly from Patchstack’s extensive bug bounty program.
- Vendor Notification and Follow-Up: After completing the test, researchers reached out to the evaluated hosting providers to disclose which vulnerabilities slipped through. A subsequent secondary test was conducted to analyze how—or if—these companies responded to the security gaps.
Supporting Data: Understanding the Testing Metrics
To truly grasp the implications of Palmowski’s research, one must look at the specific data points that emerged from the testing environment:
- 30+ Known Vulnerabilities: Every plugin used in the test possessed a publicly documented vulnerability with a proven attack vector previously reported through Patchstack’s bug bounty program. These included diverse vulnerability types, spanning core utility tools to complex WooCommerce extensions.
- The "Same Tool, Different Result" Paradox: One of the most counter-intuitive findings was that hosting companies utilizing identical backend security tooling (such as shared partnerships with major Web Application Firewall providers like Cloudflare) produced drastically different security outcomes.
- Generic vs. WordPress-Specific Success: While most hosts performed reasonably well against generic PHP threats—such as basic file uploads and path reversals—they failed miserably when faced with WordPress-specific application layer attacks.
- The 5-Hour Threat Window: Data from broader Patchstack telemetry indicates that once a plugin vulnerability is publicly disclosed, malicious actors begin leveraging it in the wild within an average of just five hours.
- The Patching Deficit: Perhaps most alarming is that out of all vulnerabilities discovered in a given annual period, roughly 50% remain unpatched by the original plugin vendors at the time of public disclosure.
Official Responses and Accountability
When presented with data showing that their security walls had failed, the hosting companies exhibited starkly divergent behaviors.
According to Palmowski, some providers acted immediately. They treated the report as a valuable learning opportunity, adjusted their configurations, tightened their layers, and significantly improved their defenses. For these companies, the penetration test served as a wake-up call that enhanced their overall infrastructure.
Conversely, a segment of the hosting market took no action whatsoever, adopting a passive "this is fine" attitude. Palmowski stresses that making mistakes in software engineering and security is a human reality; no platform is infallible. However, the true metric of a responsible company lies in how it reacts to vulnerability disclosures. Ignoring empirical evidence of a failure is, from a security standpoint, the most dangerous path a host can take.
Why Host Names Were Withheld
Despite the severity of the findings, Patchstack chose not to publicly name individual hosting companies in their report. This decision was deliberate, rooted in two primary concerns:
- False Sense of Security: If a user checks a list and discovers their host is absent, they might incorrectly assume their site is entirely safe. In reality, similar vulnerabilities were observed across nearly all tested platforms.
- Focus on Behavior Over Shaming: The goal of the research was not to launch a public relations hit-piece against specific brands, but rather to educate the wider web development community on systemic weaknesses and encourage a cultural shift toward proactive defense.
Implications: The Swiss Cheese Model and the Threat of AI
As the industry moves deeper into 2026, the traditional paradigms of web security are undergoing a radical transformation. Palmowski argues that developers, agencies, and site owners must shift away from naive expectations of bulletproof security and embrace a multi-layered defensive strategy.
The Swiss Cheese Model of Defense
In security architecture, perfection is a myth. Every single defensive layer—from server firewalls and hosting configurations to application-level security plugins and strong passwords—will inherently have holes.
The goal is to stack these defenses so that the holes do not align. If a generic web application firewall fails, a WordPress-aware security layer should catch the exploit. If that layer fails, proper user permissions and two-factor authentication can block unauthorized entry. And if the worst finally happens, robust, tested, and isolated backups ensure business continuity.
Navigating the AI Threat Landscape
Artificial Intelligence has fundamentally altered the threat matrix. Automated AI agents can now discover attack surfaces, analyze code, and scale exploits at speeds that completely outpace human intervention. When a zero-day or newly disclosed vulnerability is published, automated scripts weaponized by AI can probe thousands of sites within minutes.
Because half of all vulnerable plugins are left unpatched by their developers, relying on a weekly core update schedule is no longer an effective security strategy.
How to Question Your Hosting Provider
In light of these findings, Palmowski advises buyers to approach marketing claims with healthy skepticism. When interviewing prospective hosting companies, clients should bypass generic inquiries and ask pointed, intelligent questions:
- “Does your security stack include features that are specifically WordPress-aware, or do you rely solely on generic web application firewalls?”
- “Can you demonstrate how your infrastructure handles application-layer exploits versus generic PHP server threats?”
Ultimately, securing a WordPress website requires treating security not as a static checkbox feature sold by a hosting provider, but as an ongoing, active process of mitigation, monitoring, and structural defense.
