---
title: Security theater
canonical: https://wpsecurityninja.com/dictionary/security-theater/
---
# Security theater

Security theater is activity that feels protective but does not meaningfully reduce real risk.

## Why it matters for WordPress

Renaming `wp-login.php`, hiding the generator meta tag, or stacking five overlapping “security” plugins can feel productive while admin passwords stay weak and backups stay untested. Attackers automate the boring holes. They do not need your version string.

## How it shows up in practice

- Obscurity tricks treated as the whole strategy
- Alert fatigue from noisy tools nobody reviews
- Checklists that skip restores, 2FA, and updates
- A “hardened” site that still runs an abandoned plugin with a public CVE

## What to do

1. Rank controls by how often they stop real incidents.
2. Drop overlapping plugins that fight each other.
3. Keep obscurity as optional garnish, not the meal.
4. Measure success by fewer incidents and faster recovery, not badge count.