19 articles
Every article tagged Security, newest first. The Security category lists most of these articles too. Search all articles
Security12 min read
How to clean a hacked WordPress site and stop it happening again
To clean a hacked WordPress site, contain it and keep a copy of the compromised files and database, then find what changed and replace compromised code from trusted sources. Close the entry point, rotate credentials and salts, clear search warnings and watch for reinfection.
Security7 min read
Cloudflare WAF rules for WordPress that block attacks, not customers
Cloudflare WAF rules for WordPress should match narrow paths, start in observation mode, and exclude machine-to-machine traffic before enforcement. Use custom rules for path-based blocking or challenges, rate limiting rules for repeated requests, and managed rules for Cloudflare-maintained exploit detection.
Security7 min read
Secure WordPress REST API endpoints: permission callbacks that hold up
A WordPress REST API permission_callback should answer one question: can this authenticated user perform this specific action on this specific object? Pair that check with the right authentication method, strict argument validation, a narrow response shape, and limits on expensive or sensitive requests.
Security8 min read
WooCommerce card testing attacks: how to spot and stop them
WooCommerce card testing, also called carding, usually shows up as a sudden run of low-value payment attempts, many failed orders, or repeated declines in your gateway dashboard.
Security7 min read
Application passwords for safer WordPress integrations
WordPress application passwords let an external system authenticate without storing a user's main login password. Use a dedicated low-privilege user, send the credential only over HTTPS, and give each integration its own password so you can revoke it without affecting the others.
Security8 min read
WordPress plugin supply chain security: when the update itself is the attack
WordPress plugin supply chain security treats the update channel itself as something you must verify, not just a way to receive fixes. Use trusted sources, inspect unusual releases, verify installed files, and stage updates so one bad package does not reach every site at once.
Monitoring8 min read
WordPress plugin vulnerability monitoring: from alert to fix
WordPress vulnerability monitoring works when you keep a current inventory of installed plugins and themes. Compare exact versions with trusted vulnerability data, then record what you did with each match.
Security9 min read
WordPress security headers: what to set and how to test them
Add WordPress security headers at the web server or CDN when you can, then test them before enforcing a strict policy. HSTS and CSP can cause outages if you apply them blindly, so start conservatively, use CSP Report-Only first, and verify cached as well as uncached responses.
Monitoring5 min read
How to monitor WordPress sites without alert fatigue
To monitor many WordPress sites without drowning in noise, collect data from each site (versions, plugins, health) instead of only pinging its homepage, sign every request, match installed plugins against a vulnerability feed automatically, and route alerts by severity, with quiet hours and a daily digest.