Kinsta adds free Patchstack vulnerability protection to WordPress sites

Managed WordPress host Kinsta announced on October 9, 2026 that every new WordPress environment it creates now comes with Vulnerability Protection, powered by security firm Patchstack. Kinsta says the service is free, and it started rolling it out to existing sites on October 14, 2026.

What it does

When a vulnerability in WordPress core, a plugin or a theme is logged in Patchstack’s database, the service applies a “virtual patch”. It doesn’t change your site’s code. Instead it blocks requests that try to exploit the flaw, until you install the real security update.

That gap matters. In July 2026, after WordPress 7.0.2 fixed two core flaws, Patchstack reported the first attack attempts about 90 minutes after the release.

How it’s set up

• It is on by default for new environments and is being added to existing sites. You don’t need to opt in.
• In WordPress it shows up as a must-use plugin, which can’t be deactivated or deleted.
• In MyKinsta, a green check mark next to Vulnerability Protection under Environment Details on the Site Information page shows it is active.
• Sites that already run the Patchstack plugin are skipped, and customers can swap between Kinsta’s version and their own Patchstack licence.

Kinsta stresses that this does not replace regular updates of WordPress core, plugins and themes.

What it costs

Nothing extra. Kinsta’s plans start at $35 a month, or $30 a month billed annually, for one WordPress site (Single 20GB or Single 35k), on its pricing page as we read it on October 18, 2026.

What to do

If you host with Kinsta, check the Site Information page for the green check mark after October 14. If you pay for a Patchstack licence yourself, decide whether to keep it or use Kinsta’s included version. When you compare managed WordPress hosts, ask whether this kind of protection is included or sold as an add-on.