On this page (6 sections)
On August 17, 2026, Patchstack announced that FlyWP, a managed WordPress cloud hosting and server management platform, has integrated Patchstack into a new security add-on called FlySecurity Pro. It is a product announcement, not a vulnerability disclosure, so there is no CVE, no affected version and nothing to patch because of it.
It matters most to agencies, freelancers and teams who manage several WordPress sites on FlyWP, and to anyone weighing whether host-level protection can reduce the time between a plugin flaw being disclosed and a fix being installed.
What the announcement says
According to Patchstack's announcement, FlyWP lets customers deploy, manage, secure and maintain WordPress sites from one dashboard, whether the sites run on FlyWP's managed cloud hosting or on cloud servers the customer connects. FlySecurity Pro is switched on from that dashboard, with no separate WordPress plugin to install.
Patchstack lists these capabilities:
- Real-time vulnerability monitoring across WordPress core, plugins and themes.
- Automated mitigation rules that block known exploit attempts before an official update ships.
- Security intelligence and alerts when new vulnerabilities are disclosed.
- Central security management inside the existing FlyWP dashboard.
The post also names a mechanism called RapidMitigate, described as covering the gap when a disclosure and an official fix do not land on the same day. FlyWP's founder, Tareq Hasan, is quoted in the post describing the aim as responding to emerging threats without relying solely on traditional update cycles.
Virtual patching in plain terms
A virtual patch is a protection rule placed in front of a vulnerable component, usually at the web server or firewall layer. It looks for requests that match a known attack pattern and blocks them, while the vulnerable code stays installed. The real fix is still the updated plugin, theme or core release.
That distinction shapes how to use any product of this kind:
- It can shrink the window between public disclosure and the moment you update.
- It only helps for flaws that have a matching rule. Unknown issues, logic flaws that look like normal traffic and flaws in custom code may not be covered.
- It does not remove malware or backdoors already on a site, and it does not repair a site that was compromised before the rule existed.
- It is no substitute for updating, removing unused plugins and keeping backups.
For more on how filtering layers work in general, see our explainer What is a WAF?.
Who is realistically affected
If you do not use FlyWP, nothing changes for you. If you do, FlySecurity Pro is an add-on, and the announcement says every eligible site starts with 30 days of protection included. It does not say what happens after the 30 days or what the add-on costs, so check FlyWP's own pricing and terms before relying on it.
The announcement also does not say which plugins or themes are covered, how quickly rules are published after a disclosure, or how false positives are handled. Those are fair questions to put to the vendor before you depend on it.
What to do now
Whether or not you adopt this add-on, the habits that reduce WordPress risk are the same. A virtual patching layer works best on top of them.
0 of 7 done
To see whether a plugin you run has a published weakness, use the known vulnerabilities per plugin list and read Is my WordPress plugin vulnerable?. For a broader baseline, the WordPress security checklist covers hardening beyond updates.
If you have WP-CLI access, this read-only command lists each installed plugin with its status and whether an update is available. Run it from the WordPress root directory and look for plugins marked as having an update, or that are inactive and can be removed.
wp plugin listMonitoring after you add a protection layer
A blocking layer reduces risk but can hide trouble if you stop looking. Keep watching for signs that something got through: new administrator accounts, modified files, unfamiliar scripts and unexpected redirects. Our guide on how to check if a website is hacked walks through this, and what to do if a site is hacked covers recovery.
For outside-in checks, Webforta Scan runs read-only security scans of sites you verify, and Webforta Monitor tracks uptime, certificate, DNS and header changes. These complement host-level protection and do not replace it, and no single tool makes a site fully secure.
Bottom line
FlyWP customers now have an option to add Patchstack-powered monitoring and exploit blocking from their dashboard. The idea is sound, since blocking known attacks while an update is pending can help. But the evidence so far is a single vendor announcement. Judge it on documentation, coverage and your own testing, and keep updating as your primary defense.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.