Mentality Dictionary
Zero trust
Definition
Zero trust treats every request as untrusted until verified, and limits what any one identity can reach.
Also called: zero-trust
Why it matters for WordPress
Classic “we are on the office VPN so we are safe” thinking does not match remote teams and cloud hosts. For WordPress, zero trust shows up as strong identity checks, least privilege, and least surprise when a laptop is stolen.
How it shows up in practice
- 2FA on admin accounts
- Separate staging credentials
- No shared “admin / admin” style accounts
- Hosting panels and deploy keys locked down like production
What to do
- Verify users (password + 2FA), not just IP allowlists.
- Split duties: deploy keys ≠ content editor accounts.
- Expire access when freelancers leave.
- Prefer short-lived tokens for integrations over immortal application passwords when you can.
Related terms
Nearby ideas in the dictionary
- Least privilege Least privilege means each user and integration gets only the access required for their job, nothing more.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Assume breach Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.