# Infra-only defences miss most WordPress attacks - Based on Patchstack pentest showing 26% of vulnerability attacks blocked. - Themes: WordPress Security; Virtual Patching <!-- atomicity: 1 idea ✓ --> ## Links - [[3. Resources/Permanent Notes/Defense in Depth Concedes Perfect Safety Is Impossible and Optimizes for Narrow Costly Monitored Failure]] — evidence-for: a 26% infrastructure block rate shows why security needs independent application, runtime, and recovery layers rather than one perimeter control - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — applies-in: the MOC lists this note under Connected Permanent Notes (synthesis 2026-07-21 — run 25). ## Source - [[3. Resources/Readwise/Articles/State of WordPress Security in 2026]]