Wordfence Bug Bounty Program Logged 1,288 Submissions in April 2026
Wordfence's monthly report shows its bug bounty program processed nearly 1,300 vulnerability submissions in April, as researchers continue to help harden the WordPress ecosystem.
Tag
wordpress-security
All posts in this stream, newest first.
DV, OV, EV: TLS Certificate Types and What Browsers Actually Show
The padlock looks the same no matter which certificate sits behind it. Here is what DV, OV, and EV actually verify, and why automated free certificates are the right call for nearly every WordPress site.
Cross-Site Scripting: The Most Common WordPress Plugin Flaw
XSS shows up in plugin vulnerability disclosures more than any other bug class. Here's what stored and reflected XSS actually do, why an admin's browser is the real prize, and how proper escaping closes the door.
Reading Your Traffic: Separating Bots from Humans
Not all bot traffic is bad, and not all human traffic is safe. Here is how to read your logs, tell the players apart, and respond with the right level of force instead of a blanket ban.
Credential Stuffing: When Someone Else’s Breach Hits You
Your WordPress login can be compromised without a single flaw in your site, just a password you reused somewhere else. Here is how the attack works, how to spot it, and why two-factor authentication shuts the whole class down.
What ‘Managed’ Should Mean in Managed WordPress Hosting
The word 'managed' gets stamped on everything from bare VPS resellers to genuine full-stack platforms. Here is the checklist that tells you which one you are actually paying for.
SQL Injection Explained with a WordPress Lens
A plain-language look at how SQL injection actually works, why WordPress core rarely causes it, and the layered defenses that keep a real attack from becoming a real breach.
The OWASP Top 10, Translated for WordPress Sites
The OWASP Top 10 is written for web applications in general. Here is what each risk actually looks like on a WordPress site, and the one fix that matters most for each.
Honeypots and Tripwires: Cheap Early Warning for Your Site
Decoy fields, fake endpoints, and canary tokens turn an attacker's reconnaissance into your alert, often before they ever get close to real data.
TOTP, Passkeys, SMS: Two-Factor Methods Ranked
Not all second factors are created equal. Here is how SMS, authenticator apps, and passkeys actually hold up against phishing and SIM swaps, and how to get a reluctant team to turn any of them on.