Kinsta Adds Free Patchstack Vulnerability Protection

Kinsta announced on November 10, 2026 that every WordPress hosting plan on its platform now includes Vulnerability Protection, a feature powered by Patchstack that defends sites against known plugin and theme flaws automatically, with no upgrade or extra fee required. For site owners who have put off a dedicated security plugin, this closes one of the most common gaps: known vulnerabilities that sit unpatched for days or weeks after disclosure.

What the feature actually does

According to Kinsta, the system continuously scans installed plugins, themes, and the WordPress core for known vulnerabilities. When it finds one, it deploys a virtual firewall rule tailored to that specific flaw, blocking exploitation attempts at the application layer without touching the site’s code. Crucially, this protection applies even when no vendor fix exists yet — Patchstack’s own 2026 security report found that 46% of the 11,334 new WordPress vulnerabilities disclosed in 2025 had no vendor patch available at the time they were publicly disclosed.

Kinsta’s CTO Daniel Pataki framed the urgency around automation on the attacker side as well:

AI has dramatically increased how quickly hackers can find and exploit vulnerabilities in software.

That timing concern is backed by Patchstack’s own data showing the median gap between a vulnerability’s disclosure and the first real-world exploitation attempt is now around five hours, far too fast for a manual patch cycle to keep up.

Why this matters beyond Kinsta customers

Virtual patching is not a new idea — Patchstack has offered it as a standalone plugin and through partners like ManageWP for a while, with a February 2026 integration adding a centralized dashboard for agencies managing multiple sites. What’s notable here is Kinsta folding it directly into hosting at zero extra cost across every plan tier, rather than treating it as a premium add-on. In its first weeks of rollout, Kinsta reported the system blocked more than 1.5 million exploitation attempts across over 68,000 hosted sites, a scale that underlines how much automated scanning traffic hits ordinary WordPress installs every day.

For anyone running a business site on shared or budget hosting without this kind of protection, the gap is real. Plugin and theme vulnerabilities remain the single largest attack surface on WordPress, which is why building a baseline with a short list of trusted, well-maintained tools matters — see our rundown of essential WordPress plugins for small business sites for a sane starting point before layering on security extras.

What site owners should check now

If you’re on Kinsta, the feature is already active and requires no setup. If you’re not, this is a good moment to audit your own stack:

The bigger shift: hosts absorbing security that used to be a plugin’s job

Kinsta’s move fits a broader pattern among managed WordPress hosts: baking vulnerability intelligence and automated mitigation directly into infrastructure rather than leaving it entirely to third-party plugins. That doesn’t make dedicated security plugins obsolete, but it does raise the baseline for what “managed hosting” should include in 2026. If you’re evaluating hosts partly on security posture, it’s worth asking directly whether virtual patching is included, and whether it covers themes and third-party plugins as well as core — not just a generic firewall.

For now, the practical takeaway is simple: a known, unpatched vulnerability sitting on your site for even a few hours is enough time to get exploited. Whether that protection comes from your host, a plugin, or both, it needs to be active by default, not something you have to remember to turn on.

Priya Nair

Priya covers hosting, performance, security and backups. She reads changelogs and pricing pages so readers don't have to, and flags what changed since the last update.

Updated on November 13, 2026