Mentality Dictionary
Security theater
Definition
Security theater is activity that feels protective but does not meaningfully reduce real risk.
Also called: security theatre
Why it matters for WordPress
Renaming wp-login.php, hiding the version number, or installing five overlapping “security” plugins can feel productive while admin passwords stay weak and backups stay untested.
How it shows up in practice
- Obscurity tricks treated as the whole strategy
- Alert fatigue from noisy tools nobody reviews
- Checklists that skip restores, 2FA, and updates
What to do
- Rank controls by how often they stop real incidents.
- Drop overlapping plugins that fight each other.
- Keep obscurity as optional garnish, not the meal.
- Measure success by fewer incidents and faster recovery, not by badge count.
Related terms
Nearby ideas in the dictionary
- Defense in depth Defense in depth stacks multiple controls so one missed update or weak password is less likely to end in disaster.
- Security hardening Hardening is the set of configuration and process changes that make a site harder to abuse.
- Assume breach Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.