WordPress security starts below WordPress.
Strong passwords and security plugins protect WordPress. They can’t protect the PHP runtime it sits on — and in October 2026, PHP2Shell showed what happens when that layer breaks. Here’s what to fix today, and how Presscomet removes that layer entirely.
Updated Oct 23, 2026
Five layers. Most guides only cover two.
A WordPress site is only as safe as its weakest layer. Security plugins and good passwords handle the middle; the layers above and below belong to whoever runs your server.
- 1
The PHP runtime
The program that runs WordPress on every request. Bugs here — like PHP2Shell — affect every site on the server, before WordPress loads.
Who patches it: Your host (or you, on a VPS)
- 2
Plugins and themes
Each active plugin is more PHP running on every request, from a different author with a different update schedule.
Who patches it: You
- 3
Logins
Password guessing against wp-login.php and xmlrpc.php, and stolen or reused passwords.
Who patches it: You
- 4
The database server
A MySQL or MariaDB server that has to be configured, patched and kept off the public internet.
Who patches it: Your host or you
- 5
The server itself
Operating system, web server, SSH and control panel. Usually the host’s job on managed plans.
Who patches it: Your host
What Presscomet removes — and what it doesn’t.
Presscomet is the WordPress admin, block editor, themes and REST API rebuilt without PHP or MySQL. Your editors see the same wp-admin. Underneath, several of those layers are simply gone.
| Attack surface | Classic WordPress | Presscomet |
|---|---|---|
| PHP runtime bugs (PHP2Shell) | Patched by your host or you | Not present — no PHP runtime |
| PHP plugin vulnerabilities | Every active plugin runs on each request | PHP plugins don’t run; 19 common jobs are built in |
| xmlrpc.php brute force | On by default | No xmlrpc.php endpoint |
| Login guessing | Needs a plugin | Login limiting and 2FA built in |
| Database server | MySQL / MariaDB to secure | One SQLite file, no network port |
| Public page requests | PHP + MySQL on every cache miss | Static HTML from the cache, or static export with no server |
| Still your job | Updates, passwords, 2FA, backups | Updates, passwords, 2FA, backups |
Classic WordPress
- Web server (Apache / Nginx / LiteSpeed)
- PHP runtime ← PHP2Shell lives here
- WordPress core + every active plugin
- MySQL / MariaDB
PHP-free stack
- CDN / web server
- Static HTML from the cache (most requests stop here)
- Node.js app — admin, editor, API
- SQLite file
Honest limits: Presscomet runs on Node.js and its own code, which will have security advisories of their own and need updating. It doesn’t include a web application firewall or malware scanner, and it doesn’t run WooCommerce. Compare everything on Presscomet vs WordPress.
Security guides
- PHP2Shell and WordPress: are you affected, and how do you fix it?
Two critical bugs in PHP itself put almost every WordPress site on an affected runtime until the host patches it. Here’s what happened in plain English, a checker that tells you whether you’re affected, and step-by-step fixes for every kind of hosting.
16 min read → - WordPress security checklist 2026 (interactive, scored)
Thirty minutes, twenty-seven checks, one score. Items are weighted by how much risk they actually remove, so you fix the things that matter first — starting with the one most checklists forget: the PHP runtime underneath WordPress.
12 min read → - WordPress hacked? A step-by-step recovery checklist
Redirects to spam sites, admin users you never created, a warning from Google or a suspension notice from your host. Here’s the order to do things in, so you clean the site once and it stays clean.
14 min read → - Is your WordPress host patched for PHP2Shell? What to ask (with an email template)
On most WordPress sites you can’t patch PHP yourself — your host has to. Here’s who is responsible on each kind of hosting, the four questions that get you a real answer, and a ready-to-send email.
8 min read → - How to check and update your PHP version in WordPress (2026)
Your PHP version decides whether your WordPress site still gets security fixes. Here’s how to find it in under a minute, what’s still supported, and a safe way to upgrade without breaking anything.
11 min read → - Can you run WordPress without PHP?
WordPress itself is PHP, so the honest answer is “not WordPress core”. But you can run a WordPress site without PHP serving your visitors. There are four real ways to do it, each with a different trade-off. Here they are side by side, with a quick quiz to find yours.
11 min read →
WordPress security, answered.
Is WordPress secure?
WordPress core is maintained by a large, experienced security team and is updated quickly. Most compromised WordPress sites are breached through an outdated plugin or theme, a stolen password, or the server underneath — and PHP2Shell showed that the PHP runtime itself is part of that picture.
Does a security plugin protect against PHP vulnerabilities?
Not reliably. Security plugins run inside PHP after a request has been parsed. PHP2Shell’s most dangerous attack path can run before WordPress loads, so only updating PHP (or a firewall in front of the server) helps.
Is Presscomet more secure than WordPress?
It has a smaller attack surface in specific ways: no PHP runtime, no PHP plugins, no xmlrpc.php, no MySQL server, and public pages served as static HTML from a cache. It is not invulnerable — it runs on Node.js and its own code, which need updates like any software — so you still need updates, strong passwords, two-factor login and backups.
Does Presscomet have a firewall or malware scanner?
Its bundled Security plugin covers login attempt limiting with lockouts, authenticator-app two-factor login with backup codes, a login activity log, author-enumeration blocking and security headers. It does not include a web application firewall or malware scanner; put a CDN/WAF in front if you need one.
What is the fastest way to secure a WordPress site today?
Make sure PHP is on a fixed version (8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor-patched build), update WordPress, plugins and themes, turn on two-factor login for every administrator, delete plugins you don’t use, and confirm you have recent off-site backups you have actually restored once.
Same WordPress.
No PHP to patch.
Check your site from the browser, then move it with the wizard. Free, open source, and your live site is never touched.
Free · Open source · Export to WXR whenever you like