# Security Controls Are Configurations Not Purchases ## Claim Buying a security tool determines almost nothing about protection, because the outcome is set by how the tool is configured and operated, not by which product was bought. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds wherever a control has meaningful configuration surface — WAFs, scanners, identity providers, CSPs, hosting security stacks. - Breaks for controls with no configuration surface, such as a signed-package verification step that either validates or doesn't. - Does not claim tool quality is irrelevant, only that it's not the dominant variable when hosts already using comparable tooling produce different outcomes. ## Evidence Maciek Palmowski's penetration-testing beta found hosts with identical or comparable security products still failed at very different rates — roughly 80% of test attacks passed through hosts marketing "secure hosting." > [!quote] > it's not about the tools that you are using, it's how you are using them **Corroborating evidence, vendor-side admission (added 2026-09-05):** Sucuri's own "how to choose a security plugin" guide independently states the process side of this claim from the seller's chair: "Many of these issues are not about WordPress code quality, but about how the site is managed. This is important when choosing tools, since a plugin cannot fix problems with your processes." A vendor naming that its own product category cannot fix the majority of real compromise causes is a concession against interest, and it lands on the same principle — the tool doesn't set the outcome, the operation does. > [!quote] ID:rw_01m1s3h636csf5z85k9y6yc047 > Many of these issues are not about WordPress code quality, but about how the site is managed. This is important when choosing tools, since a plugin cannot fix problems with your processes. ## Links - [[3. Resources/Permanent Notes/Generic Hosting Security Cannot See WordPress-Specific Attack Semantics]] — because extends; that note names one specific configuration failure (generic vs. WordPress-aware rules), this note states the general principle it's an instance of. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — because applies-in; directly usable as a procurement evaluation criterion. ## Tests / falsifiers - Compare attack pass-through rates across hosts using the same security product with documented, audited configurations. If pass-through rates converge once configuration is held constant, the claim is supported; if they still diverge, some other factor dominates. - Find a security control with genuine configuration surface where outcomes are uniform regardless of configuration — that would refute the general claim. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Literature Notes/227 – Maciek Palmowski on Testing Secure WordPress Hosting]] — reports the 80% pass-through finding and the configuration-vs-tooling explanation. - [[3. Resources/Readwise/Full Document Contents/Articles/WordPress Security Plugins How to Choose the Right One]] — Sucuri vendor guide; the "a plugin cannot fix problems with your processes" concession corroborates this claim from the seller's side. Sucuri is GoDaddy-owned; disclose if citing publicly.