All posts in this stream, newest first.
A practical runbook for moving a live WordPress site to a new host: how to stage DNS, back up safely, run a serialization-safe search-replace, and verify everything before and after cutover.
Renaming your login URL, hiding your version number, and swapping your table prefix feel like security work. They mostly aren't. Here's what actually reduces risk, and how to do it.
A working WordPress site can hide a compromise for weeks if nobody is watching. Here is the minimum observability stack, uptime checks, file-change detection, and activity logs, that turns a silent breach into something you catch the same day.
Two lines of code, a nonce check and a capability check, close most of the privilege escalation and cross-site request forgery holes found in custom WordPress plugins and themes. Here is how to use them correctly, every time.
Cloudflare's edge protects you only if attackers can't find your server's real address. Here's how origin IPs leak and how to seal every path before someone finds one.
A practical look at how custom database queries become SQL injection holes in WordPress plugins and themes, and the prepare pattern and review habits that stop them before launch.
The uploads folder is writable by design, which makes it the favorite hiding spot for PHP shells. Here's how to make the whole tree inert to code execution without touching your media.
A hacked site is stressful but recoverable. Here is the exact order of operations, containment, entry-point hunting, full cleanup, credential rotation, and hardening, so you fix it once and stay fixed.
Attackers do not need to guess your usernames if your site is handing them out through author archives and the REST API. Here is how the leak happens and how to close it without breaking anything you actually need.
A practical, non-breaking rollout order for HSTS, CSP, and the other browser-enforced security headers, plus how to verify each one actually took effect.
