---
title: Defense in depth
canonical: https://wpsecurityninja.com/dictionary/defense-in-depth/
---
# Defense in depth

Defense in depth stacks multiple controls so one missed update or weak password is less likely to end in disaster.

Last updated: 2026-08-26

Also called: defence in depth, layered security

## Related terms

- [Security theater](https://wpsecurityninja.com/dictionary/security-theater/): Security theater is activity that feels protective but does not meaningfully reduce real risk.
- [Assume breach](https://wpsecurityninja.com/dictionary/assume-breach/): Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.
- [Security hardening](https://wpsecurityninja.com/dictionary/security-hardening/): Hardening is the set of configuration and process changes that make a site harder to abuse.
- [Two-factor authentication (2FA)](https://wpsecurityninja.com/dictionary/two-factor-authentication/): Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.

## Why it matters for WordPress

There is no single “secure plugin” checkbox. Updates, backups, 2FA, a WAF, monitoring, and least privilege each catch different failures. Layers turn brittle security into something that survives a bad week.

## How it shows up in practice

- A stuffed password that still fails because 2FA is on
- An exploit probe blocked by a WAF while you patch the plugin
- Odd admin activity in the events log before visitors see spam redirects
- A tested backup that lets you rebuild when cleanup takes too long

## What to do

1. Pick a small stack you will actually maintain.
2. Prefer boring controls that work together over one exotic gadget.
3. Test restores; an untested backup is not a layer.
4. Review the stack yearly as the site and team change.