WordPress User Roles: Who Really Has The Keys
Every WordPress site has an account nobody remembers creating.
The Blog
Security.
17 posts filed here.
WordPress Hacked: The First Hour, In Order
The worst moment of a hacked site is not the discovery. It is the next ten minutes.
WordPress Malware Scan: The Playbook, Step By Step
Your site can look perfectly fine to you and still be selling pills to Google.
WordPress Security Audit: The Playbook, Step By Step
A security grade is only useful if it tells you what it did not check.
WordPress Security Monitoring: The Playbook, Step By Step
A vulnerability feed can tell you what is vulnerable. It cannot tell you which of your WordPress sites…
A WordPress Content Security Policy That Does Not Break The Site
Short answer: deploy the four low-risk directives today, run everything else in report-only mode for a week…
WordPress Cookie Security: Which Flags Core Sets, And The One It Leaves Out
Short answer: WordPress sets HttpOnly on its authentication cookies and sets Secure conditionally when the…
WordPress Security Headers: Two You Can Set Today, One That Needs An Afternoon
Short answer: two wordpress security headers carry real benefit and cannot break anything, so set them now on…
WordPress xmlrpc.php In 2026: Leave It On Or Turn It Off?
Short answer: block wordpress xmlrpc on most agency sites, after checking that nothing on the site actually…
WordPress Vulnerability Scanner Design: Start From The Site
Short answer: a useful wordpress vulnerability scanner reads what is actually installed on a site and matches…
WordPress Hardening: I Measured The Advice Before Following It
Short answer: WordPress hardening checklists are usually unordered, and order is the only thing that matters…
WordPress MCP: I Listed Every Ability On A Live Site Before Trusting One
Short answer: a WordPress MCP connection does not give an agent “access to your site” as a single switch. It…
WordPress User Enumeration Is Still On By Default, And Two Of Our Sites Prove It
Short answer: wordpress user enumeration is available to anyone through /wp-json/wp/v2/users, through…
The WordPress PHP Version Problem: A Third Of Sites Get No Security Fixes
Short answer: as of 5 September 2026, at least 32.8% of WordPress installs ran a PHP branch that receives no…
Is Your WordPress Debug Log Exposed Right Now?
Short answer: if WP_DEBUG_LOG is set to true, WordPress writes errors to wp-content/debug.log, which sits…
Your wp-config.php Is Fine. The Exposed File Next To It Is Not.
Short answer: a wp-config exposed to the internet is almost never wp-config.php itself. PHP executes that…
When A WordPress Plugin Is Removed From The Repository, Nobody Tells The Site
Short answer: when a wordpress plugin removed from repository is sitting on a site, nothing happens. It stays…