Reading Your Traffic: Separating Bots from Humans
Not all bot traffic is bad, and not all human traffic is safe. Here is how to read your logs, tell the players apart, and respond with the right level of force instead of a blanket ban.
Category
Security
All posts in this stream, newest first.
File Integrity Monitoring: Catching Compromise in Hours, Not Months
Most WordPress hacks sit undetected for weeks because nobody is watching the files. Here is how to build a real file integrity monitoring routine, from core checksums to wp-content baselines, without drowning in false alarms.
Credential Stuffing: When Someone Else’s Breach Hits You
Your WordPress login can be compromised without a single flaw in your site, just a password you reused somewhere else. Here is how the attack works, how to spot it, and why two-factor authentication shuts the whole class down.
How WordPress Vulnerabilities Get Found, Reported, and Patched
A look at the pipeline behind every WordPress security update, from researcher discovery to CVE listing to the patch gap that makes update urgency real.
CSRF: The Attack That Rides Your Login Session
Cross-site request forgery tricks your browser into spending your login session on the attacker's behalf. Here's how it works, how WordPress's nonce system helps, and what to check when a plugin's defenses are not enough.
The One-Hour DIY WordPress Security Audit
A methodical, hour-long pass through users, updates, permissions, exposure, and backups that closes the door on most real-world WordPress attacks.
A Zero-Day Dropped for a Plugin You Run: Now What?
When a zero-day hits a plugin in your stack, the first hour matters more than the fix itself. Here is a calm, ordered way to triage it.
SQL Injection Explained with a WordPress Lens
A plain-language look at how SQL injection actually works, why WordPress core rarely causes it, and the layered defenses that keep a real attack from becoming a real breach.
The OWASP Top 10, Translated for WordPress Sites
The OWASP Top 10 is written for web applications in general. Here is what each risk actually looks like on a WordPress site, and the one fix that matters most for each.
Honeypots and Tripwires: Cheap Early Warning for Your Site
Decoy fields, fake endpoints, and canary tokens turn an attacker's reconnaissance into your alert, often before they ever get close to real data.