Kinsta has made Patchstack’s virtual patching part of every WordPress plan, at no extra cost. If a site runs a plugin, theme or WordPress version with a known vulnerability, the protection can block attempts to exploit it, even before the developer releases a fix. According to the host’s November 10 announcement, in the first weeks Patchstack blocked more than 1.5 million exploitation attempts across more than 68,000 sites.

Vulnerable plugins and themes were already flagged in the MyKinsta dashboard, and the new layer, called Vulnerability Protection, adds blocking. New sites created on or after October 8 have it enabled, and a gradual rollout to existing sites began on October 14.

Daniel Pataki, the company’s CTO, framed the move as a change in what hosts take on: “Application-level issues have traditionally not been addressed by hosts, but we believe stability and security of a site is essential and lets a business focus on growth.” The announcement contrasts this with providers that monitor for vulnerabilities and send notifications but “charge extra to mitigate them.”

Rules Only for the Software a Site Runs

Vulnerability Protection is built on RapidMitigate, Patchstack’s mitigation technology. Each site’s WordPress core version, plugins and themes are checked against Patchstack’s vulnerability database. When a site runs an affected version, a rule is applied to that site only, at the WordPress application layer, without modifying plugin or theme code. According to Patchstack, the rule is removed automatically once the vulnerable plugin is updated or deleted.

Kinsta’s documentation separates two layers. The host’s platform security, including the Cloudflare firewall and Bot Protection, filters out requests from known malicious sources, attack traffic and bots, often before they reach the server. Vulnerability Protection knows which versions of WordPress core, plugins and themes a site runs, so it can block requests that target their known flaws, even from a source that passes network-level checks.

CISA Lists a Fourth WordPress Core Flaw Since July. WordPress Rates This One Low

Coverage Depends on Patchstack’s Rules

The protection is meant for the window while a fix is unavailable or not yet applied. Patchstack’s State of WordPress Security in 2026 report found that 46% of vulnerabilities in 2025 did not receive a fix from the developer in time for public disclosure. The same report counted 11,334 new WordPress vulnerabilities that year and rated 4,124 of them, or 36%, serious enough to require RapidMitigate rules. For low-severity issues, it recommends an update instead. Kinsta’s product page notes that coverage depends on the mitigation rules available and that the protection “does not mean every possible vulnerability is covered.”

The documentation is explicit that the protection does not replace updates: “Updates fix the underlying issue in the code, while protection rules only block known ways of exploiting it.” Kinsta Automatic Updates, which installs plugin and theme updates as they become available, is an optional paid add-on. Vulnerability Protection also does not scan for or remove existing malware.

A Must-Use Plugin, or the Customer’s Own Patchstack

Kinsta installs the protection as a must-use plugin, which appears under Plugins > Must-Use and cannot be deactivated or removed. It runs on both live and staging environments, and Kinsta’s support team can disable it temporarily while investigating a suspected problem.

Sites that already run a standalone Patchstack plugin keep it, and Kinsta does not enable its version on them. The host checks for such plugins twice a day, so a switch takes effect within 12 hours. A customer who installs the plugin after Vulnerability Protection is active needs their own Patchstack license, because Kinsta then removes its license from the site. The built-in version does not apply Patchstack’s hardening settings and leaves features such as Application Passwords and XML-RPC unchanged. It also does not log site activity or failed logins. A standalone Patchstack plugin applies its default settings, which may include hardening that disables those features.

Final Thoughts

Kinsta is shifting part of plugin and theme security from site owners to the host. Its CTO describes application-level issues as something hosts have traditionally not addressed, and exploit blocking based on Patchstack’s rules now comes with every Kinsta WordPress plan.