---
title: Defense in depth
canonical: https://wpsecurityninja.com/dictionary/defense-in-depth/
---
# Defense in depth

Defense in depth stacks multiple controls so one missed update or weak password is less likely to end in disaster.

## Why it matters for WordPress

There is no single “secure plugin” checkbox. Updates, backups, 2FA, a WAF, monitoring, and least privilege each catch different failures. Layers turn brittle security into something that survives a bad week.

## How it shows up in practice

- A stuffed password that still fails because 2FA is on
- An exploit probe blocked by a WAF while you patch the plugin
- Odd admin activity in the events log before visitors see spam redirects
- A tested backup that lets you rebuild when cleanup takes too long

## What to do

1. Pick a small stack you will actually maintain.
2. Prefer boring controls that work together over one exotic gadget.
3. Test restores; an untested backup is not a layer.
4. Review the stack yearly as the site and team change.