Security Intro
Why sites with almost no visitors still get hacked
"We are too small to be a target" is the most common misreading. Most attempts are not chosen by a person but swept automatically — they never look…
Technote
Before your first security incident
Small sites get hit precisely because the attacks are automated. The doors to close beforehand, and the preparation that decides what you lose when something does happen.
8 articles
Security Intro
What one properly made admin account prevents
The login screen is the most-knocked door on your site. Get the username, the password and the second factor right and most of that knocking becomes pointless.
Security Intro
What happens while you put off updates
A vulnerability sits quietly and then, one day, becomes public. A clock starts at that moment — and it stops when you press update.
Themes & plugins Practical
The three minutes before you press install
A plugin runs inside your site with the same privileges you have. So the criterion is not the feature but the trust — and trust is checkable before…
Security Practical
A backup you have never restored is not a backup
Sites are lost with backups in place. Usually not because the backup was missing but because nobody ever checked the conditions for restoring it — an hour's work.
Security Practical
SSL is on, so why is there no padlock?
The certificate is fine, yet the address bar shows a warning. The cause is usually one leftover http:// inside the page — and there is a set order…
Security Practical
Making repeated login attempts pointless
Rate limiting and moving the login URL are recommended in the same breath, but they do different jobs. Here is an honest account of what each one does…
Security Practical
The first hour after you discover a compromise
The most common mistake in this moment is deleting things in a hurry. Here is what to stop first, what to preserve, and in what order to recover…