WordPress HTTPS: fix mixed content and redirects
WordPress HTTPS done right: free certificates, safe URL replacement with WP-CLI, one 301 redirect, proxy redirect loops, mixed content and expiry checks.
Hardening
Guides on Hardening for WordPress sites in the EU — practical steps, the legal background and checklists.
WordPress user enumeration: REST API and author URLs
WordPress user enumeration explained: test which login names your site leaks via REST API, author URLs, sitemaps and login errors, and apply safe fixes.
WordPress file permissions: 644, 755 and ownership
WordPress file permissions explained: what 755 and 644 mean, which user should own the files, safe reset commands, and why 777 never fixes upload errors.
wp-config.php hardening: 10 settings to check
wp-config.php hardening in 10 checks: unique salts, production debug settings, FORCE_SSL_ADMIN, file permissions, stray backups and how to edit safely.
WordPress user roles security: clean up admin accounts
WordPress user roles security: find every admin, remove old staff and agency logins, revoke stale application passwords and run a quarterly access review.
WordPress backups that actually restore
A WordPress backup plan built for restoring: files plus database, 3-2-1 with an off-site immutable copy, encryption, restore tests and GDPR Art. 32.
WordPress security headers: CSP, HSTS and more
WordPress security headers explained: safe starting values for HSTS, CSP, Referrer-Policy and Permissions-Policy, where to set them, and how to avoid breakage.
WordPress brute force protection: what a plugin can stop
WordPress brute force protection in layers: login throttling, XML-RPC multicall, REST user enumeration, and why a plugin cannot stop a DDoS attack.
DISALLOW_FILE_EDIT: disable the WordPress file editor
How to add DISALLOW_FILE_EDIT to wp-config.php, what it does not stop, and when DISALLOW_FILE_MODS is worth it without breaking WordPress updates.
Verify WordPress checksums: find modified core files
How to verify WordPress checksums with WP-CLI or the WordPress.org API, read modified vs extra file warnings, check plugins and reinstall core safely.
Two-factor authentication for WordPress admins
How to set up WordPress two-factor authentication: TOTP apps, passkeys, backup codes, why SMS is weaker, who needs 2FA, rollout steps and NIS2 duties.
WordPress security checklist for EU businesses (2026)
A practical WordPress security checklist for EU businesses: 25 steps for hosting, updates, 2FA, monitoring, backups and docs, mapped to GDPR and NIS2.
Vulnerable WordPress plugins: audit, update, replace
How to handle WordPress plugin vulnerabilities: keep an inventory, update fast, delete unused or abandoned plugins, and know what to do when no fix exists.
OWASP Top 10:2025 for WordPress, explained
The OWASP Top 10:2025 mapped to WordPress: what each risk looks like in plugins, themes and settings, and the checks owners and developers can run.