The landscape of WordPress hosting is saturated with bold, reassuring promises. A quick scan of top hosting provider landing pages reveals an endless stream of confident assertions: "Secure Hosting," "Fully Managed Protection," and assurances that users "don’t need any additional security plugins." But how much of this marketing hype holds up against real-world cyber threats?
This critical question was put to the test by Maciek Palmowski, a Growth Team Engineer at Patchstack, who examined the claims of secure hosting through a rigorous lens. Speaking on the WP Tavern Jukebox Podcast with host Nathan Wrigley at WordCamp Europe in Kraków, Palmowski unveiled sobering findings from Patchstack’s latest penetration testing research. The results highlight a startling disconnect between the security safeguards promised by hosting companies and the reality of how WordPress-specific attacks succeed.
Main Facts: The Illusion of "Secure Hosting"
At the core of Palmowski’s research is a simple yet alarming revelation: generic security solutions provided by hosts fail to stop the vast majority of WordPress-specific attacks.
To test these claims, Patchstack designed a standardized methodology. Rather than relying on theoretical vulnerabilities or anecdotal evidence, the team deployed 30 known plugin vulnerabilities—each backed by verified proofs-of-concept (PoCs) originating from their bug bounty program—across multiple managed hosting environments. Independent observers validated the results to ensure absolute objectivity.
The findings shattered industry assumptions:
- High Failure Rates: In both their initial beta run (which showed an 80% success rate for incoming attacks) and subsequent larger-scale tests, the majority of WordPress-specific attacks successfully bypassed host-level defenses.
- The Tool Trap: Testing revealed that even hosts employing identical security tooling achieved drastically different outcomes. This proved that effective security is not merely about what tools are deployed, but how they are configured and managed.
- Generic vs. Specific Defenses: Most hosting providers performed adequately against generic, baseline PHP threats (such as file uploads and path traversal). However, they failed miserably when confronted with attacks tailored specifically to the WordPress ecosystem.
Chronology: How the Research Unfolded
The genesis of Patchstack’s investigation did not stem from a premeditated academic study; it was sparked by a challenge from the WordPress community itself.
- The Catalyst: Following the publication of Patchstack’s annual State of WordPress Security report, WordPress co-founder Matt Mullenweg raised a pointed question on social media: “Isn’t hosting companies taking care of this already?”
- The Initial Beta Run: Prompted by this inquiry, Patchstack initiated a preliminary test across a handful of hosting providers using a smaller selection of vulnerable plugins. Expecting minor vulnerabilities, the team was stunned when 80% of test attacks bypassed the hosts’ defenses.
- Scaling Up: Recognizing the severity of the initial findings, Patchstack expanded the scope. They executed a more comprehensive, second-round study featuring an expanded set of hosting providers and over 30 diverse, well-known plugin vulnerabilities.
- Conference Debuts: Palmowski first previewed the data at the Checkout Summit in Palermo before officially presenting his talk—titled "Testing the Promise: Does Secure Hosting Deliver?"—at WordCamp Europe in Kraków.
- Post-Test Disclosures: Following the completion of the tests, Patchstack contacted the participating hosting companies to share granular details of which attacks succeeded and which were blocked. While some providers immediately took corrective action, others ignored the reports entirely.
Supporting Data: The Metrics of Modern WordPress Security
Palmowski’s research sheds light on deeper systemic vulnerabilities within the broader WordPress ecosystem, moving far beyond hosting environments to examine developer accountability and the speed of modern cyberattacks.
The "Five-Hour" Exploitation Window
A common piece of security advice given to site owners is to update their software on a weekly basis. Palmowski’s data proves this guidance is dangerously outdated. According to Patchstack’s telemetry, vulnerabilities are actively leveraged by bad actors within an average of just five hours of public disclosure.
The Patching Deficit
Compounding the speed of modern exploits is a shocking reluctance among some plugin developers to fix code flaws. Statistics from Patchstack’s bug bounty and threat research indicate that:
- 50% of discovered vulnerabilities remain unpatched by plugin vendors at the time the security advisory is published.
- Many developers fail to respond within the standard 30-day disclosure window, leaving millions of active installations sitting ducks for automated attacks.
The "Swiss Cheese" Security Model
Given that no single line of defense is foolproof, Palmowski advocates for the Swiss Cheese Model of Security. Every individual layer of defense—from server-level firewalls and host configurations to web application firewalls (WAFs) and security plugins—inevitably contains "holes."
Because every layer will fail at some point, administrators must implement multiple overlapping defenses. Furthermore, teams must establish robust internal procedures before an incident occurs, factoring in legal obligations, incident response plans, and GDPR compliance, rather than scrambling after a breach.
Official Responses: Marketing Claims vs. Reality
The dissonance between hosting advertisements and technical reality raises significant ethical questions regarding how managed hosting is sold.
Managed WordPress hosts frequently market their services as all-encompassing sanctuaries. Landing pages routinely claim that users can abandon third-party security tools entirely because the infrastructure has "got their back."
When Palmowski and his team shared their penetration test results with the tested hosts, two distinct corporate reactions emerged:
- Proactive Remediation: A subset of hosting providers analyzed the telemetry data, acknowledged the blind spots in their configurations, and aggressively tightened their security layers to patch the discovered gaps.
- Complacency: Conversely, a notable portion of companies took no action whatsoever upon receiving detailed reports of structural vulnerabilities.
Palmowski deliberately withheld the names of the specific hosts tested, noting that public shaming could trigger dangerous false securities. Consumers might incorrectly assume that because a specific brand was omitted from a public blacklist, their sites were entirely safe. In reality, the testing revealed that foundational security gaps are an industry-wide phenomenon.
Implications: What This Means for WordPress Users in 2026
As the cybersecurity landscape evolves, the intersection of artificial intelligence and automated threats is accelerating the frequency and sophistication of attacks. AI agents can now discover attack surfaces, craft payloads, and execute exploits in a fraction of the second, shrinking attack windows even further.
How to Evaluate Hosting Providers Wisely
For site owners, agencies, and developers navigating this complex environment, Palmowski advises abandoning blind trust in marketing buzzwords like "secure hosting." Instead, users should ask targeted, intelligent questions:
- Is the security stack WordPress-aware? If a host attempts to reassure you purely by referencing generic web application firewalls (WAFs) or network-level filters, it is a red flag. True WordPress security requires tools that understand the specific plugin architecture, database structures, and execution flows of the CMS.
- Are they ecosystem partners? Look for hosting companies that actively collaborate with recognized security entities in the space—such as maintaining direct integrations with Patchstack or similar specialized security frameworks.
- What are their incident procedures? Understand what happens when a zero-day vulnerability hits your site. Does the host provide real-time virtual patching, or do they leave the burden entirely on the end user?
The Burden of Responsibility
Ultimately, WordPress remains a secure core software platform; its vulnerabilities are overwhelmingly a byproduct of its immense popularity and the sheer volume of third-party plugins installed across millions of sites.
However, the hosting industry must reckon with its own marketing narratives. As long as hosting providers lean into absolute guarantees of safety to drive sales, independent researchers like Maciek Palmowski will continue to hold them accountable to the sobering reality of the web: security is never a single button; it is an ongoing, multi-layered process.
