52 articles
Every article tagged WordPress, newest first. Search all articles
Security10 min read
Audit WordPress plugin capabilities after installing plugins
Audit WordPress plugin capabilities by recording each role before you install or update a plugin, recording it again afterward, and testing the tasks that changed.
Performance9 min read
Find the element causing WordPress layout shift
A WordPress layout shift is a moving-page problem, so start by capturing the shift event before changing CSS, fonts, plugins, or cache settings. Reproduce one visible jump, use Chrome to identify the elements that moved, then trace upward to the content or style change that pushed them.
Security11 min read
WordPress 7.1.4 security release: The updater flaw and what to do now
The WordPress 7.1.4 security release fixes 22 vulnerabilities, including an updater flaw that needs no login and could allow remote code execution. Wordfence has recorded attack attempts against the flaw. Check your WordPress version, block public access to the upgrade folder, and review your server logs.
Development8 min read
Custom WordPress plugin vs SaaS: how to choose
Custom WordPress plugin vs SaaS is a procurement choice between maintaining a codebase for your WordPress workflow and depending on a hosted product that already supplies much of it. Choose custom when the workflow is specific enough to justify ongoing engineering.
Security11 min read
HTTP2Shell (CVE-2026-111497): WordPress and Next.js exposure
HTTP2Shell is CVE-2026-111497, a flaw in Google's Brotli decoder that can corrupt memory when software decompresses malicious data. Also called Node2Shell and Broccoli2Shell, it has fixes in Node.js 22.23.4, 24.22.1 and 26.12.1, plus Brotli 1.0.10, 1.1.1 and 1.2.1.
Security11 min read
PHP session upload progress vulnerability after the PHP2Shell patch
The PHP session upload progress vulnerability remains open after the PHP2Shell patch. On 23 October 2026, php.net warned about an unlikely remote code execution path tracked as CVE-2026-115560; the 21 October security releases still fix the two original PHP2Shell vulnerabilities.
Performance8 min read
PageSpeed good, Core Web Vitals failed: read the right data
If PageSpeed looks good but Core Web Vitals failed, check the data source before you change WordPress. The green Lighthouse score and the failed Core Web Vitals assessment can both be correct because they measure different populations, time periods and conditions.
Security14 min read
PHP critical security update: PHP2Shell leak and fixes
PHP released a PHP critical security update on Wednesday, October 21, 2026, for two vulnerabilities known as PHP2Shell that allow remote code execution without authentication. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Performance8 min read
Fix INP in WordPress by finding the slow interaction
To fix INP in WordPress, start by reproducing the exact tap or key interaction that feels slow, then record it in Chrome DevTools and split its delay into input, processing, and presentation.