Mentality Dictionary
Zero trust
Definition
Zero trust treats every request as untrusted until verified, and limits what any one identity can reach.
Also called: zero-trust
Why it matters for WordPress
“We are on the office VPN so we are safe” does not match remote teams and cloud hosts. For WordPress, zero trust looks like strong identity checks, least privilege, and less surprise when a laptop or freelancer account goes missing.
How it shows up in practice
- 2FA on every Administrator and Editor
- Separate staging credentials from production
- No shared “the agency login” with a sticky-note password
- Hosting panels and deploy keys locked down like production admin
What to do
- Verify users (password plus 2FA), not just IP allowlists.
- Split duties: deploy keys are not content editor accounts.
- Expire access when freelancers leave a project.
- Prefer short-lived tokens for integrations over immortal application passwords when you can.
Related terms
Nearby ideas in the dictionary
- Least privilege Least privilege means each user and integration gets only the access required for their job, nothing more.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Assume breach Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.
- Application passwords Application passwords are per-app credentials WordPress can issue so integrations authenticate without using your main password.
