IT risk assessment for WordPress sites: a simple method
A simple IT risk assessment for WordPress sites: list assets, name threats, rate on a 1–3 scale, pick measures and owners, with a worked example register.
WordPress security & EU compliance guides
Practical, honest guides on securing WordPress — and on what GDPR, NIS2 and the Cyber Resilience Act expect from you. Written by Melike Görel for AngelForce OÜ.
Also in: Deutsch Français Español Italiano Polski Português Türkçe
WordPress HTTPS: fix mixed content and redirects
WordPress HTTPS done right: free certificates, safe URL replacement with WP-CLI, one 301 redirect, proxy redirect loops, mixed content and expiry checks.
WordPress keeps getting hacked? Find the backdoor
WordPress keeps getting hacked after cleanup? Find the backdoors that survive: auto_prepend_file, mu-plugins, fake plugins, cron, sibling sites, open entry points.
WordPress user enumeration: REST API and author URLs
WordPress user enumeration explained: test which login names your site leaks via REST API, author URLs, sitemaps and login errors, and apply safe fixes.
WordPress file permissions: 644, 755 and ownership
WordPress file permissions explained: what 755 and 644 mean, which user should own the files, safe reset commands, and why 777 never fixes upload errors.
Data processing agreement for web agencies (GDPR Art. 28)
When a web agency needs a data processing agreement (GDPR Art. 28), what the security annex should cover, subprocessors, incident reporting and offboarding.
WordPress redirect hack: find and remove spam redirects
WordPress redirect hack: reproduce conditional redirects with curl and dev tools, find them in .htaccess, PHP, the database or CDN, and stop them returning.
wp-config.php hardening: 10 settings to check
wp-config.php hardening in 10 checks: unique salts, production debug settings, FORCE_SSL_ADMIN, file permissions, stray backups and how to edit safely.
Website security seals: what a badge can and can't prove
What a website security seal can and can't prove: seal types, why static badges mean nothing, four marks of an honest seal and how to check one in a minute.
WordPress user roles security: clean up admin accounts
WordPress user roles security: find every admin, remove old staff and agency logins, revoke stale application passwords and run a quarterly access review.
WordPress backups that actually restore
A WordPress backup plan built for restoring: files plus database, 3-2-1 with an off-site immutable copy, encryption, restore tests and GDPR Art. 32.
WordPress security headers: CSP, HSTS and more
WordPress security headers explained: safe starting values for HSTS, CSP, Referrer-Policy and Permissions-Policy, where to set them, and how to avoid breakage.