Security Headers for WordPress: HSTS, CSP and Friends
A practical, non-breaking rollout order for HSTS, CSP, and the other browser-enforced security headers, plus how to verify each one actually took effect.
Tag
security
All posts in this stream, newest first.
Putting a WAF in Front of WordPress: What It Stops and What It Misses
A web application firewall filters out a lot of junk before it ever reaches PHP, but it is not a substitute for patching, strong credentials, or a real backup plan. Here is what it actually buys you.
Backups That Survive Real Disasters: The 3-2-1 Rule for WordPress
A backup you have never restored is a theory, not a backup. Here is how to build an off-site, versioned, encrypted scheme for WordPress and how to actually test it before you need it at 3 a.m.
User Roles and Least Privilege in WordPress
Most WordPress breaches spread further than they should because too many accounts have Administrator access. Here is how to map people to the right built-in roles and audit stale accounts before someone else finds them.
Choosing and Updating Plugins Without Getting Owned
Most WordPress compromises start with a plugin, not core. Here is how to vet what you install, update on a schedule that catches problems early, and avoid the shortcut that causes the most damage.
Hardening wp-config.php: Keys, Salts, and Kill Switches
wp-config.php is the quiet file that controls half your site's security posture. Here is how to rotate its secrets, lock down its constants, and keep it out of anywhere a backup or backup archive might leak.
XML-RPC: The Legacy Door Most Sites Should Close
xmlrpc.php was built for a web that no longer exists, and today it mostly serves attackers looking for brute-force amplification and DDoS leverage. Here is how to shut it down cleanly, or lock it down for the integrations that still need it.
WordPress File Permissions and Ownership, Explained Simply
A plain-English guide to the permission numbers WordPress actually needs, why 777 shows up in bad advice, and the exact commands to fix a mangled file tree.
Hardening wp-login: 2FA, Rate Limits, and CAPTCHAs That Work
wp-login.php is the single most attacked URL on the open web. Here is the layered defense, strong authentication, lockouts, bot challenges, and a plan for what to do when credential stuffing shows up in your logs.
Why ML-DSA Will Have to Do for the Post-Quantum Signature Transition
Cloudflare explains why next-generation post-quantum signature algorithms will not arrive in time for the first migration wave, and why ML-DSA is the practical choice today.