-
This Week's Critical Bug Was in PHP, Not WordPress
8 min read
Two unauthenticated remote code execution flaws in PHP itself, fixed on 21 October 2026 and exploited the same day. No WordPress update fixes them. Here is who patches PHP, and how to tell if yours is.
Read the post → -
Two Plugin Compromises in One Week, and Neither Was a Bug
8 min read
Rank Math PRO shipped malware for 11 hours. Stolen UpdraftCentral keys backdoored sites for 18. Neither needed a vulnerability. Both used trust you had already granted.
Read the post → -
nginx Fixed Five Bugs This Week. Which Ones Reach a WordPress Server?
5 min read
nginx 1.30.6 fixes five CVEs, including a TLS session forgery and three memory corruption bugs. Each one needs a specific configuration to trigger. Check which you actually run, then patch anyway.
Read the post → -
Let's Encrypt Certificates Are Getting Shorter. Check Your Renewal.
5 min read
From 10 February 2027 Let's Encrypt issues 64-day certificates by default, with 45 days to follow. If your renewal is on a fixed schedule or a stale certbot, now is the time to find out.
Read the post → -
The PHP Setting That Turned a Core Bug Into a Shell
5 min read
CVE-2026-87902 let an unauthenticated request include a file from outside the theme. Whether that became code execution came down to one php.ini setting most people have never looked at.
Read the post → -
WordPress Security, September 2026 in Review
5 min read
Two core security releases in six days, one of them exploited within hours, a premium WooCommerce plugin still being hit seven months after its patch, and the 7.2 roadmap. What September changed and what to do about it.
Read the post → -
88% of WordPress Sites Are Out of Date. The Real Number Is Worse.
6 min read
88% of 44 million WordPress sites are behind the latest release. The serious number is the sites that never got July's forced fix for a code execution flaw.
Read the post → -
WordPress 7.1 Security: The One Change That Matters
7 min read
WordPress 7.1 is not a security release, but one Abilities API change matters for security, and the WP Rocket outage on launch day is a lesson worth keeping.
Read the post → -
How Well Are the Top 1,000 WordPress Plugins Maintained?
9 min read
I checked the 1,000 most-installed WordPress plugins: 75 have not shipped in a year, 186 never declared testing on WordPress 7, nearly half have one maintainer.
Read the post → -
WordPress.org Now Holds Every Plugin Release. What That Buys You
7 min read
Every WordPress plugin release now sits in a cooldown before auto-updates get it, and automated review can block it. How it works and what it cannot see.
Read the post → -
Elementor Pro Exploited in Hours. One Server Rule Stops It.
7 min read
A 9.8-rated Elementor Pro upload flaw was exploited the day the patch shipped. One server rule, blocking PHP in uploads, makes that attack a dead file.
Read the post → -
Your Host Blocks 12% of WordPress Attacks
5 min read
Patchstack ran real exploits against typical WordPress hosting defences: 26% of attacks stopped, 12% of WordPress-specific ones. What that leaves for you to do.
Read the post → -
Why "Self-Healing" WordPress Malware Keeps Coming Back
8 min read
You deleted the malware and it came back in under a second. That is code running before WordPress does, not malware repairing itself. Here is where it hides.
Read the post → -
WordPress 7.0 Put an AI Agent Behind Your Login
5 min read
WordPress 7.0 shipped an AI agent stack into core, with an MCP adapter driven over Application Passwords. What changed and how to stop it getting you hacked.
Read the post → -
How to Remove Malware From a WordPress Site
6 min read
A calm, ordered process for removing malware from a hacked WordPress site, why a plugin scan rarely finishes the job, and how to stop it coming straight back.
Read the post → -
Setting Up Two-Factor Authentication on WordPress, Properly
6 min read
How to set up two-factor authentication on WordPress properly: which plugin, how to enforce it by role, why SMS is wrong, and how not to lock yourself out.
Read the post → -
A WordPress Backup Strategy That Works When You Need It
7 min read
Most WordPress backups fail at the restore. The backup strategy I run for client sites, why a backup on the same server is not a backup, and how to test yours.
Read the post → -
WordPress Released Official AI Agent Skills. What It Means
8 min read
WordPress shipped an official repo of AI coding-assistant skills in July 2026. What it is, what it fixes, and why it is not a substitute for reviewing the code.
Read the post → -
Passkeys for WordPress Admins: The Actual Setup
7 min read
Passkeys are now the recommended default for WordPress admin logins. Core does not ship them yet. The plugin, the settings, and the mistakes that lock you out.
Read the post → -
WordPress Auto Updates Are Not a Security Strategy
7 min read
Auto updates catch routine plugin patching, and happily push a compromised release the moment one exists. The update workflow the ecosystem is moving to.
Read the post → -
WordPress vs Squarespace: Security Compared
12 min read
Squarespace has strong platform security and one documented weak spot that cost a dozen companies their domains. An honest 2026 comparison with WordPress.
Read the post → -
The WordPress Plugin You Trusted Just Got Sold
8 min read
An attacker bought thirty WordPress plugins on Flippa, shipped a dormant backdoor as an update, and switched it on months later. How to pick plugins now.
Read the post → -
WordPress vs Wix: Security Compared
9 min read
An honest 2026 comparison of what WordPress and Wix actually do for security, where each one is stronger, and how to choose without the marketing spin.
Read the post → -
Is WordPress Secure?
8 min read
A straight answer to whether WordPress is secure, and the handful of things that actually decide whether any given WordPress site is safe or not.
Read the post → -
WordPress File Permissions and Database Security
9 min read
The two layers under the WordPress dashboard that decide how bad a compromise gets: the correct file permissions, and how to lock down the database properly.
Read the post → -
Lock Down wp-login.php, xmlrpc.php and wp-admin
7 min read
The three URLs that take the most attack traffic on any WordPress site, and the specific configuration that locks each one down without breaking anything.
Read the post → -
WordPress Security Headers, Explained Properly
8 min read
A practical guide to the HTTP security headers worth setting on a WordPress site, what each one actually does, and the configuration that works.
Read the post → -
Common WordPress Security Issues
8 min read
The WordPress security issues that actually get sites compromised, in order of how often they show up. What each one is, why it happens, and what fixes it.
Read the post → -
Should You Move wp-config.php Above the Webroot?
6 min read
Moving wp-config.php one folder up is standard WordPress advice. Here's what it actually protects against, what it doesn't, and when it's worth doing.
Read the post → -
What Your WordPress Host Won't Do For You
6 min read
Managed hosting protects the server, not your WordPress site. Here's the gap between what your host covers and what's actually left to you.
Read the post → -
Is My WordPress Site Hacked? Twelve Signs to Check
8 min read
A practical checklist for working out whether your WordPress site has been compromised, what to look at first, and what each sign actually means.
Read the post → -
The Best WordPress Security Plugins in 2026
6 min read
The WordPress security plugins I actually install in 2026, the ones I skip, and how they fit together as a stack.
Read the post → -
How to Harden WordPress
7 min read
What to actually change to harden a WordPress site, starting with wp-config and working outwards.
Read the post → -
How to Recover a Hacked WordPress Site Step by Step
7 min read
A calm, ordered run through of what to do when your WordPress site has been compromised, from taking it offline to closing the gap the attacker came in through.
Read the post →
Get the free WordPress Security Checklist
The security checks I'd run through on any WordPress site, delivered straight to your inbox. Or work through it online.