All posts in this stream, newest first.
A web application firewall filters out a lot of junk before it ever reaches PHP, but it is not a substitute for patching, strong credentials, or a real backup plan. Here is what it actually buys you.
Cloudflare deployed new firewall rules protecting all customers, including free plans, from an unauthenticated remote code execution flaw and a related SQL injection bug in WordPress. Site owners should still patch immediately.
Not all bot traffic is bad, and not all human traffic is safe. Here is how to read your logs, tell the players apart, and respond with the right level of force instead of a blanket ban.
Cross-site request forgery tricks your browser into spending your login session on the attacker's behalf. Here's how it works, how WordPress's nonce system helps, and what to check when a plugin's defenses are not enough.
