Every WordPress site on Kinsta is now protected by Patchstack, automatically and at no extra cost. In its first weeks, that protection blocked more than 1.5 million exploitation attempts across more than 68,000 Kinsta sites.
Kinsta calls it Vulnerability Protection, and it ships with every hosting plan.
What Kinsta launched
Kinsta Vulnerability Protection, powered by Patchstack, is included in every Kinsta plan. There’s nothing for customers to install, configure or monitor. Kinsta identifies which known vulnerabilities affect each site and applies Patchstack’s protection rules automatically.
It adds a layer to the security Kinsta already ships on every plan: isolated containers, Cloudflare-powered DDoS protection and a managed firewall at the edge, and Bot Protection, which launched in June.
Kinsta CEO Jon Penland framed the decision around a problem every WordPress professional knows. The ecosystem has long asked site owners to carry security themselves, but vulnerabilities now get disclosed faster than any one person can track. “We identify which ones affect a customer’s site and apply protection automatically, so customers don’t have to chase them,” Penland said.
Why this matters now
46% of WordPress vulnerabilities disclosed in 2025 had no vendor fix at the time of disclosure. For nearly half of last year’s disclosures, there was no update to install.
That sits on top of a fast-growing problem. According to our State of WordPress Security in 2026 report:
- 11,334 new WordPress vulnerabilities were found in 2025, up 42% year over year
- High-severity vulnerabilities in 2025 outnumbered the previous two years combined
- Plugins accounted for 91% of all vulnerabilities
- Heavily targeted plugin flaws are mass-exploited in a median of 5 hours
AI is compressing that timeline further. Attackers now find and weaponize vulnerabilities faster than site owners, agencies or support teams can read the advisories. Even when a fix exists, it still has to reach the update button, get tested and get deployed. Five hours doesn’t leave room for any of that.
Updating remains essential. But updates only close a vulnerability once the vendor ships a fix and the site applies it. The window before that is where sites get compromised, and it’s the window Vulnerability Protection closes.
How it works
Vulnerability Protection runs on Patchstack’s RapidMitigate technology. It works in three steps:
- Identify. Kinsta continuously checks the plugins, themes and WordPress version on each site against Patchstack’s vulnerability database.
- Mitigate. When a site runs an affected version, Patchstack’s RapidMitigate rule goes to that site – and only that site – at the WordPress application layer.
- Hold the line. The rule blocks exploit attempts without changing any plugin or theme code. Once the vulnerable plugin is updated or deleted, the rule is automatically removed.
The intelligence behind it comes from Patchstack’s own research, a private bug bounty program and direct disclosures from plugin developers. Patchstack is the largest vulnerability disclosing organization of all time, and maintains 14,000+ mitigation rules.
“Fast mitigation is non-negotiable for businesses of any size,” said Oliver Sild, CEO of Patchstack.
What it means for agencies and site owners
Agencies are Kinsta’s core customers, and the benefit scales with the portfolio. An agency with 200 client sites gets 200 sites of protection without tracking a single vulnerability.
In practice, that changes three things:
- No more 2am emergency updates. A protected site can wait for a fix to be tested on staging before it goes live.
- Abandoned plugins stop being a ticking clock. Known vulnerabilities in plugins that never get patched are mitigated while you plan a replacement.
- Nothing new to manage. No dashboard to watch, no vulnerability feed to read, no plugin to install.
Site owners still need to keep software updated, since mitigation closes the window and updates fix the root cause. The difference is that the gap between disclosure and update no longer leaves the site exposed.
Protected before it’s a problem
1.5 million blocked exploitation attempts in a few weeks is what it looks like when a host closes the vulnerability window for its customers instead of leaving it to them. We’re proud to power that for Kinsta, and we think every WordPress site deserves the same.
Run a hosting company and want to offer this to your customers? Talk to our partnerships team.
