Mentality Dictionary
Defense in depth
Definition
Defense in depth stacks multiple controls so one missed update or weak password is less likely to end in disaster.
Also called: defence in depth, layered security
Why it matters for WordPress
There is no single “secure plugin” checkbox. Updates, backups, 2FA, a WAF, monitoring, and least privilege each catch different failures. Layers turn brittle security into something that survives a bad week.
How it shows up in practice
- A stuffed password that still fails because 2FA is on
- An exploit probe blocked by a WAF while you patch the plugin
- Odd admin activity in the events log before visitors see spam redirects
- A tested backup that lets you rebuild when cleanup takes too long
What to do
- Pick a small stack you will actually maintain.
- Prefer boring controls that work together over one exotic gadget.
- Test restores; an untested backup is not a layer.
- Review the stack yearly as the site and team change.
Related terms
Nearby ideas in the dictionary
- Security theater Security theater is activity that feels protective but does not meaningfully reduce real risk.
- Assume breach Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.
- Security hardening Hardening is the set of configuration and process changes that make a site harder to abuse.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
