All posts in this stream, newest first.
A backup you have never restored is a theory, not a backup. Here is how to build an off-site, versioned, encrypted scheme for WordPress and how to actually test it before you need it at 3 a.m.
Most WordPress breaches spread further than they should because too many accounts have Administrator access. Here is how to map people to the right built-in roles and audit stale accounts before someone else finds them.
Most WordPress compromises start with a plugin, not core. Here is how to vet what you install, update on a schedule that catches problems early, and avoid the shortcut that causes the most damage.
wp-config.php is the quiet file that controls half your site's security posture. Here is how to rotate its secrets, lock down its constants, and keep it out of anywhere a backup or backup archive might leak.
xmlrpc.php was built for a web that no longer exists, and today it mostly serves attackers looking for brute-force amplification and DDoS leverage. Here is how to shut it down cleanly, or lock it down for the integrations that still need it.
A plain-English guide to the permission numbers WordPress actually needs, why 777 shows up in bad advice, and the exact commands to fix a mangled file tree.
wp-login.php is the single most attacked URL on the open web. Here is the layered defense, strong authentication, lockouts, bot challenges, and a plan for what to do when credential stuffing shows up in your logs.
A layer-by-layer look at what actually makes a WordPress site fast, from disk to browser, plus the questions worth asking any host about the hardware and software running underneath your site.
Stores aren't blogs. Here's which pages must stay dynamic, how object caching and edge rules work together, and how to speed up a WooCommerce site without corrupting carts or showing stale prices.
Before you trust any before-and-after speed number, you need to know whose cache you tested, where the request came from, and whether a bot skewed the sample.
