IT risk assessment for WordPress sites: a simple method
A simple IT risk assessment for WordPress sites: list assets, name threats, rate on a 1–3 scale, pick measures and owners, with a worked example register.
Melike Görel
Melike Görel writes the secaudit.eu guides on WordPress security and EU compliance for AngelForce OÜ, the Tallinn software company behind secaudit.eu.
Articles by Melike Görel
WordPress HTTPS: fix mixed content and redirects
WordPress HTTPS done right: free certificates, safe URL replacement with WP-CLI, one 301 redirect, proxy redirect loops, mixed content and expiry checks.
WordPress keeps getting hacked? Find the backdoor
WordPress keeps getting hacked after cleanup? Find the backdoors that survive: auto_prepend_file, mu-plugins, fake plugins, cron, sibling sites, open entry points.
WordPress user enumeration: REST API and author URLs
WordPress user enumeration explained: test which login names your site leaks via REST API, author URLs, sitemaps and login errors, and apply safe fixes.
WordPress file permissions: 644, 755 and ownership
WordPress file permissions explained: what 755 and 644 mean, which user should own the files, safe reset commands, and why 777 never fixes upload errors.
Data processing agreement for web agencies (GDPR Art. 28)
When a web agency needs a data processing agreement (GDPR Art. 28), what the security annex should cover, subprocessors, incident reporting and offboarding.
WordPress redirect hack: find and remove spam redirects
WordPress redirect hack: reproduce conditional redirects with curl and dev tools, find them in .htaccess, PHP, the database or CDN, and stop them returning.
wp-config.php hardening: 10 settings to check
wp-config.php hardening in 10 checks: unique salts, production debug settings, FORCE_SSL_ADMIN, file permissions, stray backups and how to edit safely.
Website security seals: what a badge can and can't prove
What a website security seal can and can't prove: seal types, why static badges mean nothing, four marks of an honest seal and how to check one in a minute.
WordPress user roles security: clean up admin accounts
WordPress user roles security: find every admin, remove old staff and agency logins, revoke stale application passwords and run a quarterly access review.
WordPress backups that actually restore
A WordPress backup plan built for restoring: files plus database, 3-2-1 with an off-site immutable copy, encryption, restore tests and GDPR Art. 32.
WordPress security headers: CSP, HSTS and more
WordPress security headers explained: safe starting values for HSTS, CSP, Referrer-Policy and Permissions-Policy, where to set them, and how to avoid breakage.
WordPress brute force protection: what a plugin can stop
WordPress brute force protection in layers: login throttling, XML-RPC multicall, REST user enumeration, and why a plugin cannot stop a DDoS attack.
PHP2Shell: what WordPress site owners must do now
PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on unpatched PHP. Check your PHP version, update, restart and watch for signs.
DISALLOW_FILE_EDIT: disable the WordPress file editor
How to add DISALLOW_FILE_EDIT to wp-config.php, what it does not stop, and when DISALLOW_FILE_MODS is worth it without breaking WordPress updates.
Verify WordPress checksums: find modified core files
How to verify WordPress checksums with WP-CLI or the WordPress.org API, read modified vs extra file warnings, check plugins and reinstall core safely.
WordPress web shells in uploads: find and block them
Find WordPress web shells in wp-content/uploads with safe commands, block PHP execution on Apache and nginx, review file permissions and close the entry point.
WordPress SEO spam: find hidden casino and pharma links
WordPress SEO spam explained: find hidden casino and pharma links, see what Googlebot sees, clean the database and files, and request a Google review.
WordPress security audit report: what evidence to keep
How to build a WordPress security audit report: the six records to keep, what good evidence looks like, supplier and insurance questions, and a template.
Two-factor authentication for WordPress admins
How to set up WordPress two-factor authentication: TOTP apps, passkeys, backup codes, why SMS is weaker, who needs 2FA, rollout steps and NIS2 duties.
WordPress security checklist for EU businesses (2026)
A practical WordPress security checklist for EU businesses: 25 steps for hosting, updates, 2FA, monitoring, backups and docs, mapped to GDPR and NIS2.
Vulnerable WordPress plugins: audit, update, replace
How to handle WordPress plugin vulnerabilities: keep an inventory, update fast, delete unused or abandoned plugins, and know what to do when no fix exists.
WordPress malware removal: a step-by-step plan
WordPress malware removal in eight steps: contain the site, keep evidence, find the entry point, clean from known-good sources, rotate secrets and harden.
12 signs your WordPress site has been hacked
Twelve signs of a hacked WordPress site, from unknown admin users to cloaked redirects, how to check each one, and what to do in the first hour.
OWASP Top 10:2025 for WordPress, explained
The OWASP Top 10:2025 mapped to WordPress: what each risk looks like in plugins, themes and settings, and the checks owners and developers can run.
NIS2 and your WordPress site: are you in scope?
NIS2 and WordPress: check if your company, agency or hosting business is in scope, what suppliers should expect, and which Art. 21 measures affect your site.
Google Fonts and GDPR: self-host fonts on WordPress
Google Fonts and GDPR: what the Munich court ruled, why the Data Privacy Framework doesn't settle it, and how to find and self-host fonts on WordPress.
Hacked WordPress site? The GDPR 72-hour breach notification
Hacked WordPress site? When a hack is a GDPR data breach, when the 72-hour notification clock starts, what to report, what to document, and who to inform.
GDPR Article 32 for WordPress: what 'appropriate security' means
GDPR Article 32 and WordPress security in practice: encryption, updates, access control, tested backups, regular scans, records and processor contracts.
Cyber Resilience Act: what WordPress plugin sellers must do
Cyber Resilience Act for WordPress plugin and theme sellers: reporting duties since 11 September 2026, the December 2027 obligations, and a to-do list.