WordPress brute force protection: what a plugin can stop
WordPress brute force protection in layers: login throttling, XML-RPC multicall, REST user enumeration, and why a plugin cannot stop a DDoS attack.
WordPress security & EU compliance guides — Page 2
PHP2Shell: what WordPress site owners must do now
PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on unpatched PHP. Check your PHP version, update, restart and watch for signs.
DISALLOW_FILE_EDIT: disable the WordPress file editor
How to add DISALLOW_FILE_EDIT to wp-config.php, what it does not stop, and when DISALLOW_FILE_MODS is worth it without breaking WordPress updates.
Verify WordPress checksums: find modified core files
How to verify WordPress checksums with WP-CLI or the WordPress.org API, read modified vs extra file warnings, check plugins and reinstall core safely.
WordPress web shells in uploads: find and block them
Find WordPress web shells in wp-content/uploads with safe commands, block PHP execution on Apache and nginx, review file permissions and close the entry point.
WordPress SEO spam: find hidden casino and pharma links
WordPress SEO spam explained: find hidden casino and pharma links, see what Googlebot sees, clean the database and files, and request a Google review.
WordPress security audit report: what evidence to keep
How to build a WordPress security audit report: the six records to keep, what good evidence looks like, supplier and insurance questions, and a template.
Two-factor authentication for WordPress admins
How to set up WordPress two-factor authentication: TOTP apps, passkeys, backup codes, why SMS is weaker, who needs 2FA, rollout steps and NIS2 duties.
WordPress security checklist for EU businesses (2026)
A practical WordPress security checklist for EU businesses: 25 steps for hosting, updates, 2FA, monitoring, backups and docs, mapped to GDPR and NIS2.
Vulnerable WordPress plugins: audit, update, replace
How to handle WordPress plugin vulnerabilities: keep an inventory, update fast, delete unused or abandoned plugins, and know what to do when no fix exists.
WordPress malware removal: a step-by-step plan
WordPress malware removal in eight steps: contain the site, keep evidence, find the entry point, clean from known-good sources, rotate secrets and harden.
12 signs your WordPress site has been hacked
Twelve signs of a hacked WordPress site, from unknown admin users to cloaked redirects, how to check each one, and what to do in the first hour.