Why a WordPress site needs patching every six weeks, and ours doesn't
A WordPress site is four things stacked on top of each other: a server running PHP, the WordPress core, a theme, and a set of plugins. Each one is maintained by different people, and each one gets security fixes on its own schedule. Your site is only as safe as the one you forgot.
In 2026 that stack needed emergency fixes four times in four months. WordPress core in July (WP2Shell). Core again in August (7.0.3, after an exploit chain was used at scale). Core again in September (CVE-2026-87902, exploited within hours of being announced). PHP itself on October 21, for two critical holes that let a stranger run code on the server without logging in. That last one is below WordPress; updating WordPress did nothing about it. On top of that, one popular plugin left 500,000 sites open to account takeover.
Patchstack, which tracks these, lists 5,467 plugin vulnerabilities and 871 theme vulnerabilities against 17 in WordPress core. The core is the small part of the problem. The plugins are the big part, and the plugins are the part nobody owns.
Who is supposed to run the updates?
On most small business sites: nobody. The developer who built it moved on. The hosting company patches its servers, not your plugins. You get an email about an update and ignore it because the last update broke the contact form. Six weeks later the next advisory comes out.
What Telosi does instead
There is no PHP, no plugin, no theme to update, and no database reachable from the internet. Your site is generated once from your content and served as finished pages from Cloudflare's edge. Bookings and forms run on our platform, which we patch on our schedule, not yours. Security is part of the monthly fee because it's our job, not a task we hand you.
Is a managed WordPress host the same thing?
Closer. Good managed hosts patch core and PHP within hours. They still don't own your plugins, and plugins are most of the risk. If you're staying on WordPress, pay for managed hosting and delete every plugin you can't name the purpose of.
What to do this week
Run your site through our scanner. It reads what your site already sends to any visitor: WordPress version, PHP version, plugin count. If any of those are visible, so is your to-do list.