6 articles
Every article tagged Hardening, newest first. Search all articles
Security11 min read
DreamHost data breach: what to check on your WordPress site now
The DreamHost data breach exposed FTP/SFTP credentials and some webmail accounts, putting affected WordPress sites at risk of unauthorized changes. Start by checking DreamHost's reset notice and securing your file-access and email accounts.
Security10 min read
Audit WordPress plugin capabilities after installing plugins
Audit WordPress plugin capabilities by recording each role before you install or update a plugin, recording it again afterward, and testing the tasks that changed.
Security13 min read
WordPress 7.1.4 security release: exploited updater flaw and what to do now
The WordPress 7.1.4 security release fixes 22 vulnerabilities, including an updater flaw that needs no login and can lead to remote code execution. Wordfence recorded attack attempts, and on November 3, 2026, CISA added the flaw to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
Security7 min read
Cloudflare WAF rules for WordPress that block attacks, not customers
Cloudflare WAF rules for WordPress should match narrow paths, start in observation mode, and exclude machine-to-machine traffic before enforcement. Use custom rules for path-based blocking or challenges, rate limiting rules for repeated requests, and managed rules for Cloudflare-maintained exploit detection.
Security9 min read
WordPress security headers: what to set and how to test them
Add WordPress security headers at the web server or CDN when you can, then test them before enforcing a strict policy. HSTS and CSP can cause outages if you apply them blindly, so start conservatively, use CSP Report-Only first, and verify cached as well as uncached responses.
Security4 min read
WordPress security hardening: a practical checklist for 2026
A practical WordPress security hardening checklist: updates, logins, wp-config settings, upload rules, headers and what to do after a hack.