Mentality Dictionary
Security theater
Definition
Security theater is activity that feels protective but does not meaningfully reduce real risk.
Also called: security theatre
Why it matters for WordPress
Renaming wp-login.php, hiding the generator meta tag, or stacking five overlapping “security” plugins can feel productive while admin passwords stay weak and backups stay untested. Attackers automate the boring holes. They do not need your version string.
How it shows up in practice
- Obscurity tricks treated as the whole strategy
- Alert fatigue from noisy tools nobody reviews
- Checklists that skip restores, 2FA, and updates
- A “hardened” site that still runs an abandoned plugin with a public CVE
What to do
- Rank controls by how often they stop real incidents.
- Drop overlapping plugins that fight each other.
- Keep obscurity as optional garnish, not the meal.
- Measure success by fewer incidents and faster recovery, not badge count.
Related terms
Nearby ideas in the dictionary
- Defense in depth Defense in depth stacks multiple controls so one missed update or weak password is less likely to end in disaster.
- Security hardening Hardening is the set of configuration and process changes that make a site harder to abuse.
- Assume breach Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.
- Login protection Login protection is the set of controls that harden the WordPress login against bots and credential attacks.
