WordPress Security Myths That Waste Your Time
Renaming your login URL, hiding your version number, and swapping your table prefix feel like security work. They mostly aren't. Here's what actually reduces risk, and how to do it.
Tag
security
All posts in this stream, newest first.
Monitoring and Audit Logs: Knowing When Something Is Wrong
A working WordPress site can hide a compromise for weeks if nobody is watching. Here is the minimum observability stack, uptime checks, file-change detection, and activity logs, that turns a silent breach into something you catch the same day.
Nonces and Capability Checks: Writing WordPress Code That Cannot Be CSRF’d
Two lines of code, a nonce check and a capability check, close most of the privilege escalation and cross-site request forgery holes found in custom WordPress plugins and themes. Here is how to use them correctly, every time.
Hiding Your Origin IP: DDoS Resilience Beyond the CDN
Cloudflare's edge protects you only if attackers can't find your server's real address. Here's how origin IPs leak and how to seal every path before someone finds one.
SQL Injection in WordPress: How $wpdb->prepare Saves You
A practical look at how custom database queries become SQL injection holes in WordPress plugins and themes, and the prepare pattern and review habits that stop them before launch.
Locking Down wp-content/uploads: Closing WordPress’s Classic Backdoor
The uploads folder is writable by design, which makes it the favorite hiding spot for PHP shells. Here's how to make the whole tree inert to code execution without touching your media.
Hacked WordPress: A Calm, Complete Cleanup Playbook
A hacked site is stressful but recoverable. Here is the exact order of operations, containment, entry-point hunting, full cleanup, credential rotation, and hardening, so you fix it once and stay fixed.
Stopping User Enumeration and REST API Leaks
Attackers do not need to guess your usernames if your site is handing them out through author archives and the REST API. Here is how the leak happens and how to close it without breaking anything you actually need.
Security Headers for WordPress: HSTS, CSP and Friends
A practical, non-breaking rollout order for HSTS, CSP, and the other browser-enforced security headers, plus how to verify each one actually took effect.
Putting a WAF in Front of WordPress: What It Stops and What It Misses
A web application firewall filters out a lot of junk before it ever reaches PHP, but it is not a substitute for patching, strong credentials, or a real backup plan. Here is what it actually buys you.