triple “p” of WordPress security