Practical guides on WordPress security, WooCommerce, Core Web Vitals, development and monitoring, checked against primary documentation before publishing.
Security11 min read
WordPress 7.1.4 security release: The updater flaw and what to do now
The WordPress 7.1.4 security release fixes 22 vulnerabilities, including an updater flaw that needs no login and could allow remote code execution. Wordfence has recorded attack attempts against the flaw. Check your WordPress version, block public access to the upgrade folder, and review your server logs.
Try· press / to search · typos are fine
65 articles
Security11 min read
WordPress 7.1.4 security release: The updater flaw and what to do now
The WordPress 7.1.4 security release fixes 22 vulnerabilities, including an updater flaw that needs no login and could allow remote code execution. Wordfence has recorded attack attempts against the flaw. Check your WordPress version, block public access to the upgrade folder, and review your server logs.
Development8 min read
AI lead routing for WordPress inquiries with a review queue
AI lead routing on a WordPress site should do one small job: turn each incoming inquiry into an approved route or a human review item.
Monitoring9 min read
WooCommerce checkout monitoring without placing live orders
WooCommerce checkout monitoring should run a scheduled browser journey against a staging or sandbox store, using synthetic products, customer details and a test payment method.
Development8 min read
Custom WordPress plugin vs SaaS: how to choose
Custom WordPress plugin vs SaaS is a procurement choice between maintaining a codebase for your WordPress workflow and depending on a hosted product that already supplies much of it. Choose custom when the workflow is specific enough to justify ongoing engineering.
Security11 min read
HTTP2Shell (CVE-2026-111497): WordPress and Next.js exposure
HTTP2Shell is CVE-2026-111497, a flaw in Google's Brotli decoder that can corrupt memory when software decompresses malicious data. Also called Node2Shell and Broccoli2Shell, it has fixes in Node.js 22.23.4, 24.22.1 and 26.12.1, plus Brotli 1.0.10, 1.1.1 and 1.2.1.
Monitoring7 min read
Trace WooCommerce order emails not sending from order to inbox
The phrase "WooCommerce order emails not sending" can describe several different failures. First prove that the expected order event happened, then trace one controlled order through WooCommerce, WordPress, your mail provider, and the destination mailbox.
Security11 min read
PHP session upload progress vulnerability after the PHP2Shell patch
The PHP session upload progress vulnerability remains open after the PHP2Shell patch. On 23 October 2026, php.net warned about an unlikely remote code execution path tracked as CVE-2026-115560; the 21 October security releases still fix the two original PHP2Shell vulnerabilities.
Security11 min read
AI agents in US bank accounts: what banks found and what to do now
AI agents accessing bank accounts have prompted major US banks to tighten security after Axios reported on Thursday, 22 October 2026, that third-party assistants were operating inside customer accounts, sometimes beyond user instructions.
Performance8 min read
PageSpeed good, Core Web Vitals failed: read the right data
If PageSpeed looks good but Core Web Vitals failed, check the data source before you change WordPress. The green Lighthouse score and the failed Core Web Vitals assessment can both be correct because they measure different populations, time periods and conditions.