WordPress Security7 min read
Least Privilege for the WordPress Database User
Many WordPress sites connect to MySQL with a user that can do far more than WordPress needs, sometimes even the…
YuviYuvi
WordPress Security7 min read
Stopping Fake User Registrations on WordPress and WooCommerce
Thousands of junk accounts can pile up on a site that allows registration, bloating the database, wasting email credits and…
Yuvi
WordPress Security8 min read
Where Attackers Hide Backdoors in WordPress and How to Find Them
Removing visible malware is the easy part of a cleanup. The backdoors attackers leave behind are what bring them back…
Yuvi
WordPress Security8 min read
Security Headers for WordPress Beyond CSP: What Each One Does and How to Set It
A handful of HTTP response headers can close off whole classes of browser-based attacks with a few lines of configuration.…
Yuvi
WordPress Security8 min read
Restricting wp-admin Access: IP Allowlists, HTTP Authentication and Their Trade-offs
Strong passwords and two-factor authentication protect the WordPress login. Restricting who can even reach it adds another layer. Here's how…
Yuvi
WordPress Security8 min read
Rotating WordPress Secrets After a Security Incident: Salts, Passwords and API Keys
Cleaning malware is only half of recovering from a hack. Every secret the attacker could have read must be replaced.…
Yuvi
WordPress Security8 min read
Stopping WordPress User Enumeration Through the REST API, Author Archives and Sitemaps
WordPress makes it surprisingly easy for anyone to discover your usernames. That's half of a login handed to attackers. Here's…
Yuvi
WordPress Security8 min read
How to Read a WordPress Vulnerability Report and Decide How Fast to Patch
Every week brings new WordPress plugin vulnerability disclosures. Most aren't emergencies, and a few really are. Here's how to read…
Yuvi
WordPress Security8 min read
Stopping Form Spam in WordPress Without Annoying Real Visitors
Contact form spam wastes time, buries real leads and can even hurt your email reputation. Here's how to stop most…
Yuvi
WordPress Security8 min read
Offboarding Done Right: Removing WordPress Access When People Leave
Staff leave, agencies change and freelancers finish projects, but their WordPress access often stays behind. Here's a complete offboarding checklist…
Yuvi
WordPress Security9 min read
WordPress Activity Logs: How to Know Who Changed What and When
When something changes on a WordPress site and nobody knows how, an activity log turns guesswork into a two-minute lookup.…
Yuvi
WordPress Security10 min read
XML-RPC in WordPress: Should You Disable It, and What Breaks If You Do?
XML-RPC is one of the oldest parts of WordPress and one of the most abused. Here's what it actually does…
Yuvi