Title: Infrastructure built to mitigate security threats Author: WordPress VIP Documentation Published: August 20, 2025 --- 1. [Security](https://docs.wpvip.com/security/) 2. Infrastructure built to mitigate security threats # Infrastructure built to mitigate security threats VIP’s infrastructure is designed to mitigate security threats and manage vulnerabilities at a platform-level. * **Security monitoring: **Safeguards against attacks include monitoring of traffic pattern anomalies and spikes, and controlled responses to suspicious traffic patterns. Brute-force protections are built in at the network level; they monitor for unnatural behavior and dynamically apply restrictions. * **Data center security:** End-to-end encryption from data centers at the edge to origin, resource and data isolation, and encrypted off-site backups. VIP origin data centers meet the International Organization of Standardization (ISO), International Electrotechnical Commission (IEC) 27001 certification and Standards for Attestation Engagements (SSAE) No. 18 SOC2 Type 2. * **Database protection:** Databases for every application are containerized in a separate infrastructure, each with their own unique authentication. This mitigates the risk of unauthorized access between applications. Production database backups are taken each hour and maintained for 30 days. They are stored in an encrypted format to ensure data continuity while maintaining security. * **Firewalls:** Network and host-based firewalls are built into the platform with real-time notification processes designed to prevent unauthorized access attempts. * **Security patch management:** The VIP team promptly deploys security patches and other protections to mitigate critical vulnerabilities for software that runs on the platform such as WordPress, PHP, and Node.js. Whole-site HTTPS is enforced for all sites on the platform, and an installed TLS certificate is required for a site to be launched and publicly accessible. [Let’s Encrypt TLS certificates](https://docs.wpvip.com/lets-encrypt-cert/) are available for all domains by default. Customers have the option to [install custom TLS certificates](https://docs.wpvip.com/custom-tls-cert/) for their domains. ## Reduced attack surface VIP’s infrastructure has reduced attack surfaces that help to protect applications against many common forms of attack. * All web containers run in read-only mode. A read-only web container disallows plugins, themes, and other code from having write permissions. While this can occasionally cause [plugin incompatibilities](https://docs.wpvip.com/plugins/plugin-incompatibilities/), it protects against vulnerabilities such as installation of backdoor shells and other malicious files. * The code deployed to an environment’s read-only web containers can only be modified by GitHub users given write-access to an application’s wpcomvip GitHub repository. [The customer governs user access to an application’s GitHub repository](https://docs.wpvip.com/github-user-access/). Read, Write, or Admin permissions are selectively assigned to users at the customer’s discretion. * Media files are stored in a separate, globally distributed [object store](https://en.wikipedia.org/wiki/Object_storage) called [the VIP File System](https://docs.wpvip.com/vip-go-files-system/). Files within the `/wp-content/uploads` path are not located in a web container’s filesystem. It is possible to programmatically [write a file to the `/tmp` directory](https://docs.wpvip.com/vip-file-system/local-file-operations/) of a web container or within the mapped [`/wp-content/uploads` path](https://docs.wpvip.com/vip-file-system/media-uploads/) on the VIP File System. Files that are written to either of those directories cannot be run or executed (e.g. PHP). ## Enhanced security for WordPress applications The popularity of WordPress as a content management system (CMS) often makes it a target for security threats. However, [development of WordPress Core follows strict security standards](https://wordpress.org/about/security/), and multiple layers of security protocols are built in to the WordPress VIP infrastructure to strengthen protections for WordPress applications against many forms of security threats. * At the network level, dynamic security protocols are in place that can be triggered by unusual behavioral patterns. These protocols protect unauthorized access and abuse of [the login endpoint](https://docs.wpvip.com/security-controls/wordpress/wp-login/)(`/ wp-login.php`) and [the XML-RPC endpoint](https://docs.wpvip.com/security-controls/wordpress/xml-rpc/)(`/ xmlrpc.php`). An automated attack would trigger VIP’s dynamic security measures, and login attempts would be completely blocked. * The functionality of the WP Cron endpoint (`/wp-cron.php`) is disabled for all WordPress sites. [Cron control on WPVIP](https://docs.wpvip.com/wordpress-on-vip/cron-control/) is initiated and regulated by [Automattic’s Cron Control plugin](https://github.com/Automattic/Cron-Control). * Security releases for parts of the software stack on WordPress applications ( e.g., [WordPress Core ](https://docs.wpvip.com/wordpress-on-vip/wordpress-upgrades/) and [VIP MU plugins](https://docs.wpvip.com/vip-go-mu-plugins/)) are automatically deployed to all environments on the platform as quickly as possible. ### WPVIP features for WordPress security management Every WordPress application has access to custom features built by WPVIP for managing and heightening the security of WordPress sites on the platform. * [The **WordPress Security Controls** panel](https://docs.wpvip.com/security-controls/wordpress/) in the VIP Dashboard sets a baseline of security settings for all WordPress environments. Customers can adjust the settings in a VIP Dashboard panel to customize the enforcement of 2FA, management of inactive users, XML-RPC endpoint protections, and more. * [**Codebase Manager**](https://docs.wpvip.com/codebase-manager/) automatically scans all plugins that are located in the [`/plugins` directory](https://docs.wpvip.com/wordpress-skeleton/plugins-directory/) of [a WordPress environment’s wpcomvip GitHub repository](https://docs.wpvip.com/wpcomvip-github-repository/) branch. Known security vulnerabilities and available version updates identified by Codebase Manager are reported in [the VIP Dashboard’s Plugins panel](https://docs.wpvip.com/plugins-panel/). Pull requests to upgrade plugins with available updates can be created within the VIP Dashboard’s Plugins panel. * The **[VIP Code Analysis Bot](https://docs.wpvip.com/vip-code-analysis-bot/) **( the Bot) automatically analyzes code that is pushed to to a WordPress application’s GitHub pull requests. Feedback from the Bot is posted in pull request comments based on the results of automated scans including [Vulnerability and Update Scan](https://docs.wpvip.com/vulnerability-and-update-scan/), [PHPCS analysis](https://docs.wpvip.com/vip-code-analysis-bot/phpcs-analysis/), [PHP linting](https://docs.wpvip.com/vip-code-analysis-bot/php-linting/), and [SVG analysis](https://docs.wpvip.com/vip-code-analysis-bot/svg-analysis/).  ## Compliance * [FedRAMP Authority to Operate (ATO)](https://wpvip.com/wordpress-vip-fedramp-compliant/) * [Data Privacy Framework](https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000CbqcAAC&status=Active) Last updated: August 20, 2025