---
title: Assume breach
canonical: https://wpsecurityninja.com/dictionary/assume-breach/
---
# Assume breach

Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.

Last updated: 2026-08-26

Also called: assume-breach

## Related terms

- [Defense in depth](https://wpsecurityninja.com/dictionary/defense-in-depth/): Defense in depth stacks multiple controls so one missed update or weak password is less likely to end in disaster.
- [Event logging](https://wpsecurityninja.com/dictionary/event-logging/): Event logging records security-relevant actions so you can see what changed and when.
- [Backdoor](https://wpsecurityninja.com/dictionary/backdoor/): A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- [Incident response](https://wpsecurityninja.com/dictionary/incident-response/): Incident response is the structured process of detecting, containing, cleaning, and learning from a security incident.
- [WordPress salts](https://wpsecurityninja.com/dictionary/wordpress-salts/): WordPress salts are secret keys in wp-config.php that help secure cookies, nonces, and related cryptographic operations.

## Why it matters for WordPress

Perfect prevention fails eventually: a zero-day plugin hole, a phished editor, a vendor compromise. Teams that only “lock the door” freeze when something slips through. Assume breach means you can still answer what changed, restore cleanly, and hunt persistence.

## How it shows up in practice

- A staging restore drill you actually ran last quarter
- An events log that answers “who created that admin?”
- Password and salt rotation as routine after incidents, not panic theater
- A named person (or agency) who owns malware cleanup

## What to do

1. Practice a restore on staging before you need production heroics.
2. Keep event logging and file integrity checks on.
3. Write a one-page incident checklist while everyone is calm.
4. After any compromise, hunt persistence. Do not only delete the weird file.