13 articles
Hardening WordPress, cleaning up a compromised site, and keeping the fixes in place afterwards.
What to lock down first on a WordPress site, how to keep plugins and themes patched without breaking the site, and what a clean-up involves when a site is already compromised. Start with the hardening checklist; the maintenance service covers the same ground as a monthly routine.
Not covered yet: incident response planning and a repeatable security maintenance routine for small teams.
Message
Ask me about your site
Tell me what is wrong or what you need built. I reply by email.
Security11 min read
WordPress 7.1.4 security release: The updater flaw and what to do now
The WordPress 7.1.4 security release fixes 22 vulnerabilities, including an updater flaw that needs no login and could allow remote code execution. Wordfence has recorded attack attempts against the flaw. Check your WordPress version, block public access to the upgrade folder, and review your server logs.
Security11 min read
HTTP2Shell (CVE-2026-111497): WordPress and Next.js exposure
HTTP2Shell is CVE-2026-111497, a flaw in Google's Brotli decoder that can corrupt memory when software decompresses malicious data. Also called Node2Shell and Broccoli2Shell, it has fixes in Node.js 22.23.4, 24.22.1 and 26.12.1, plus Brotli 1.0.10, 1.1.1 and 1.2.1.
Security11 min read
PHP session upload progress vulnerability after the PHP2Shell patch
The PHP session upload progress vulnerability remains open after the PHP2Shell patch. On 23 October 2026, php.net warned about an unlikely remote code execution path tracked as CVE-2026-115560; the 21 October security releases still fix the two original PHP2Shell vulnerabilities.
Security11 min read
AI agents in US bank accounts: what banks found and what to do now
AI agents accessing bank accounts have prompted major US banks to tighten security after Axios reported on Thursday, 22 October 2026, that third-party assistants were operating inside customer accounts, sometimes beyond user instructions.
Security14 min read
PHP critical security update: PHP2Shell leak and fixes
PHP released a PHP critical security update on Wednesday, October 21, 2026, for two vulnerabilities known as PHP2Shell that allow remote code execution without authentication. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Security12 min read
How to clean a hacked WordPress site and stop it happening again
To clean a hacked WordPress site, contain it and keep a copy of the compromised files and database, then find what changed and replace compromised code from trusted sources. Close the entry point, rotate credentials and salts, clear search warnings and watch for reinfection.
Security7 min read
Cloudflare WAF rules for WordPress that block attacks, not customers
Cloudflare WAF rules for WordPress should match narrow paths, start in observation mode, and exclude machine-to-machine traffic before enforcement. Use custom rules for path-based blocking or challenges, rate limiting rules for repeated requests, and managed rules for Cloudflare-maintained exploit detection.
Security7 min read
Secure WordPress REST API endpoints: permission callbacks that hold up
A WordPress REST API permission_callback should answer one question: can this authenticated user perform this specific action on this specific object? Pair that check with the right authentication method, strict argument validation, a narrow response shape, and limits on expensive or sensitive requests.
Security8 min read
WooCommerce card testing attacks: how to spot and stop them
WooCommerce card testing, also called carding, usually shows up as a sudden run of low-value payment attempts, many failed orders, or repeated declines in your gateway dashboard.