All posts in this stream, newest first.
WordPress 7.0.2 is a forced security release fixing one critical and one high severity vulnerability, including a REST API bug that could lead to remote code execution. Backports are available for 6.8 and 6.9.
Cloudflare deployed new firewall rules protecting all customers, including free plans, from an unauthenticated remote code execution flaw and a related SQL injection bug in WordPress. Site owners should still patch immediately.
A walkthrough of what a real credential-stuffing attack against wp-login.php looks like in the access logs, and the layered defenses that turn it from a threat into a non-event.
The padlock looks the same no matter which certificate sits behind it. Here is what DV, OV, and EV actually verify, and why automated free certificates are the right call for nearly every WordPress site.
Abandoned plugins get bought, weaponized, and pushed back out as trusted updates. Here is how the pattern works and how to shrink your exposure before it becomes your incident.
You do not need a security operations center to handle a hack well. You need a short plan you wrote before the bad day, and this is the template.
Not all WordPress infections look the same because they aren't built for the same purpose. Here's how to recognize the common categories and what each one is actually trying to do to your site.
XSS shows up in plugin vulnerability disclosures more than any other bug class. Here's what stored and reflected XSS actually do, why an admin's browser is the real prize, and how proper escaping closes the door.
A compromised site rarely gets fully cleaned on the first pass. Here is where attackers plant their return tickets, and how to find and remove them systematically.
A practical guide to keeping API keys and credentials out of your WordPress codebase, building a rotation habit, and responding fast when a secret does leak.
