Inside a Brute-Force Campaign Against wp-login
A walkthrough of what a real credential-stuffing attack against wp-login.php looks like in the access logs, and the layered defenses that turn it from a threat into a non-event.
Tag
wordpress security
All posts in this stream, newest first.
Supply-Chain Attacks: When the Plugin Update Is the Malware
Abandoned plugins get bought, weaponized, and pushed back out as trusted updates. Here is how the pattern works and how to shrink your exposure before it becomes your incident.
An Incident Response Plan Sized for a Small Site
You do not need a security operations center to handle a hack well. You need a short plan you wrote before the bad day, and this is the template.
SEO Spam, Redirect Hacks, and Miners: WordPress Malware Taxonomy
Not all WordPress infections look the same because they aren't built for the same purpose. Here's how to recognize the common categories and what each one is actually trying to do to your site.
Finding Backdoors: Where Attackers Hide in WordPress
A compromised site rarely gets fully cleaned on the first pass. Here is where attackers plant their return tickets, and how to find and remove them systematically.
API Keys and Secrets: Stop Committing Them to the Theme
A practical guide to keeping API keys and credentials out of your WordPress codebase, building a rotation habit, and responding fast when a secret does leak.
Security Plugins Compared: What They Catch and What They Can’t
Firewall plugins, malware scanners, and login guards each cover a real slice of WordPress security, but none of them reach the server or network layer where a lot of the actual damage happens.
How WordPress Vulnerabilities Get Found, Reported, and Patched
A look at the pipeline behind every WordPress security update, from researcher discovery to CVE listing to the patch gap that makes update urgency real.
CSRF: The Attack That Rides Your Login Session
Cross-site request forgery tricks your browser into spending your login session on the attacker's behalf. Here's how it works, how WordPress's nonce system helps, and what to check when a plugin's defenses are not enough.
Backup Plugins Compared: Restore Speed Is the Feature
Most backup plugins are judged on how well they back up. The only test that matters is how fast and how completely they restore. Here is what to look for and how to prove it works before you need it.