https://secaudit.eu/blog/Practical guides on WordPress security and the EU rules behind it — GDPR, NIS2 and the Cyber Resilience Act — for businesses, agencies and plugin vendors.en https://secaudit.eu/blog/it-risk-assessment-wordpress/https://secaudit.eu/blog/it-risk-assessment-wordpress/Tue, 03 Nov 2026 08:00:00 +0000A simple IT risk assessment for WordPress sites: list assets, name threats, rate on a 1–3 scale, pick measures and owners, with a worked example register.Compliance https://secaudit.eu/blog/wordpress-https-mixed-content-redirects/https://secaudit.eu/blog/wordpress-https-mixed-content-redirects/Mon, 02 Nov 2026 08:00:00 +0000WordPress HTTPS done right: free certificates, safe URL replacement with WP-CLI, one 301 redirect, proxy redirect loops, mixed content and expiry checks.Hardening https://secaudit.eu/blog/wordpress-keeps-getting-hacked/https://secaudit.eu/blog/wordpress-keeps-getting-hacked/Sun, 01 Nov 2026 08:00:00 +0000WordPress keeps getting hacked after cleanup? Find the backdoors that survive: auto_prepend_file, mu-plugins, fake plugins, cron, sibling sites, open entry points.Incident response https://secaudit.eu/blog/wordpress-user-enumeration/https://secaudit.eu/blog/wordpress-user-enumeration/Sat, 31 Oct 2026 08:00:00 +0000WordPress user enumeration explained: test which login names your site leaks via REST API, author URLs, sitemaps and login errors, and apply safe fixes.Hardening https://secaudit.eu/blog/wordpress-file-permissions/https://secaudit.eu/blog/wordpress-file-permissions/Fri, 30 Oct 2026 08:00:00 +0000WordPress file permissions explained: what 755 and 644 mean, which user should own the files, safe reset commands, and why 777 never fixes upload errors.Hardening https://secaudit.eu/blog/data-processing-agreement-web-agencies/https://secaudit.eu/blog/data-processing-agreement-web-agencies/Thu, 29 Oct 2026 08:00:00 +0000When a web agency needs a data processing agreement (GDPR Art. 28), what the security annex should cover, subprocessors, incident reporting and offboarding.Compliance https://secaudit.eu/blog/wordpress-redirect-hack/https://secaudit.eu/blog/wordpress-redirect-hack/Wed, 28 Oct 2026 08:00:00 +0000WordPress redirect hack: reproduce conditional redirects with curl and dev tools, find them in .htaccess, PHP, the database or CDN, and stop them returning.Incident response https://secaudit.eu/blog/wp-config-php-hardening/https://secaudit.eu/blog/wp-config-php-hardening/Tue, 27 Oct 2026 08:00:00 +0000wp-config.php hardening in 10 checks: unique salts, production debug settings, FORCE_SSL_ADMIN, file permissions, stray backups and how to edit safely.Hardening https://secaudit.eu/blog/website-security-seals/https://secaudit.eu/blog/website-security-seals/Mon, 26 Oct 2026 08:00:00 +0000What a website security seal can and can't prove: seal types, why static badges mean nothing, four marks of an honest seal and how to check one in a minute.Trust https://secaudit.eu/blog/wordpress-user-roles-security/https://secaudit.eu/blog/wordpress-user-roles-security/Sun, 25 Oct 2026 08:00:00 +0000WordPress user roles security: find every admin, remove old staff and agency logins, revoke stale application passwords and run a quarterly access review.Hardening https://secaudit.eu/blog/wordpress-backups-that-restore/https://secaudit.eu/blog/wordpress-backups-that-restore/Sat, 24 Oct 2026 08:00:00 +0000A WordPress backup plan built for restoring: files plus database, 3-2-1 with an off-site immutable copy, encryption, restore tests and GDPR Art. 32.Hardening https://secaudit.eu/blog/wordpress-security-headers/https://secaudit.eu/blog/wordpress-security-headers/Fri, 23 Oct 2026 08:00:00 +0000WordPress security headers explained: safe starting values for HSTS, CSP, Referrer-Policy and Permissions-Policy, where to set them, and how to avoid breakage.Hardening https://secaudit.eu/blog/wordpress-brute-force-protection/https://secaudit.eu/blog/wordpress-brute-force-protection/Thu, 22 Oct 2026 08:00:00 +0000WordPress brute force protection in layers: login throttling, XML-RPC multicall, REST user enumeration, and why a plugin cannot stop a DDoS attack.Hardening https://secaudit.eu/blog/php2shell-wordpress/https://secaudit.eu/blog/php2shell-wordpress/Wed, 21 Oct 2026 08:00:00 +0000PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on unpatched PHP. Check your PHP version, update, restart and watch for signs.Incident response https://secaudit.eu/blog/disallow-file-edit-wordpress/https://secaudit.eu/blog/disallow-file-edit-wordpress/Wed, 21 Oct 2026 08:00:00 +0000How to add DISALLOW_FILE_EDIT to wp-config.php, what it does not stop, and when DISALLOW_FILE_MODS is worth it without breaking WordPress updates.Hardening https://secaudit.eu/blog/verify-wordpress-checksums/https://secaudit.eu/blog/verify-wordpress-checksums/Mon, 19 Oct 2026 08:00:00 +0000How to verify WordPress checksums with WP-CLI or the WordPress.org API, read modified vs extra file warnings, check plugins and reinstall core safely.Hardening https://secaudit.eu/blog/wordpress-web-shells-uploads/https://secaudit.eu/blog/wordpress-web-shells-uploads/Sun, 18 Oct 2026 08:00:00 +0000Find WordPress web shells in wp-content/uploads with safe commands, block PHP execution on Apache and nginx, review file permissions and close the entry point.Incident response https://secaudit.eu/blog/wordpress-seo-spam/https://secaudit.eu/blog/wordpress-seo-spam/Sat, 17 Oct 2026 08:00:00 +0000WordPress SEO spam explained: find hidden casino and pharma links, see what Googlebot sees, clean the database and files, and request a Google review.Incident response https://secaudit.eu/blog/wordpress-security-audit-report/https://secaudit.eu/blog/wordpress-security-audit-report/Fri, 16 Oct 2026 08:00:00 +0000How to build a WordPress security audit report: the six records to keep, what good evidence looks like, supplier and insurance questions, and a template.Compliance https://secaudit.eu/blog/wordpress-two-factor-authentication/https://secaudit.eu/blog/wordpress-two-factor-authentication/Thu, 15 Oct 2026 08:00:00 +0000How to set up WordPress two-factor authentication: TOTP apps, passkeys, backup codes, why SMS is weaker, who needs 2FA, rollout steps and NIS2 duties.Hardening