---
title: Zero trust
canonical: https://wpsecurityninja.com/dictionary/zero-trust/
---
# Zero trust

Zero trust treats every request as untrusted until verified, and limits what any one identity can reach.

## Why it matters for WordPress

“We are on the office VPN so we are safe” does not match remote teams and cloud hosts. For WordPress, zero trust looks like strong identity checks, least privilege, and less surprise when a laptop or freelancer account goes missing.

## How it shows up in practice

- 2FA on every Administrator and Editor
- Separate staging credentials from production
- No shared “the agency login” with a sticky-note password
- Hosting panels and deploy keys locked down like production admin

## What to do

1. Verify users (password plus 2FA), not just IP allowlists.
2. Split duties: deploy keys are not content editor accounts.
3. Expire access when freelancers leave a project.
4. Prefer short-lived tokens for integrations over immortal application passwords when you can.