Summary: It is easy to overstate security. This article lists exactly what wp³ stops a plugin from doing, and states the boundaries: it makes the damage small, it does not promise perfection.
The limits
- Plugins cannot write runnable code anywhere on the platform.
- Plugins cannot reach outside services that were not approved for them.
- Plugins cannot create an administrator or escalate to one.
Why these three matter
Most severe plugin attacks end the same way: the attacker gets a small file onto the server and arranges for it to run. Blocking runnable file writes removes that ending.
Approving outbound addresses closes the easiest route for quietly sending your data somewhere it does not belong, and blocking admin creation removes the permanent foothold attackers try to leave behind.
What this is not
This is not a promise of perfect security. It is a set of platform-enforced limits, and we describe them as hard to bypass rather than impossible to bypass. A plugin that is compromised can still misbehave within the space it is given.
Anyone who tells you a web host gives a perfect guarantee is selling something. What we offer is a much smaller blast radius and fewer emergency patches.