SQL Injection Explained with a WordPress Lens
A plain-language look at how SQL injection actually works, why WordPress core rarely causes it, and the layered defenses that keep a real attack from becoming a real breach.
Category
Security
All posts in this stream, newest first.
The OWASP Top 10, Translated for WordPress Sites
The OWASP Top 10 is written for web applications in general. Here is what each risk actually looks like on a WordPress site, and the one fix that matters most for each.
Honeypots and Tripwires: Cheap Early Warning for Your Site
Decoy fields, fake endpoints, and canary tokens turn an attacker's reconnaissance into your alert, often before they ever get close to real data.
Password Managers for Site Teams: Ending Shared Spreadsheets
A shared spreadsheet of logins is a liability waiting to happen. Here is how to move a WordPress team onto a real password manager with proper role scoping and a clean offboarding process.
TOTP, Passkeys, SMS: Two-Factor Methods Ranked
Not all second factors are created equal. Here is how SMS, authenticator apps, and passkeys actually hold up against phishing and SIM swaps, and how to get a reluctant team to turn any of them on.