Security Practical
Closing user enumeration: what REST hands out by default
/wp-json/wp/v2/users opens without login, and the slug it carries is usually the username. That leaves an attacker with only the password to find.
Technote
Security
Vulnerabilities, hardening, permissions, login protection and backups — closing the routes into a WordPress site one at a time.
20 articles· Security
Security Practical
Lead data is an asset and a liability at once
A contact list is a marketing asset and personal data at the same time. Collect the minimum, set a retention period, and actually delete when it expires.
Security Practical
Analytics and privacy: collecting the minimum, honestly disclosed
Showing a banner is not the same as obtaining consent. You should be able to explain what you collect and why — and a retention period ought to…
Security Practical
Receiving webhooks: a nonce check fails every time
An external server has no cookie and no nonce. Verify by signature or shared key, compare with hash_equals, and always sign the raw body.
Security Practical
Escaping on output: which function for which context
Escape at output, not at input. The same stored value can end up in body text, an attribute or a URL, and each context defines safety differently.
Security Intro
Actually reading the licence on a “free” image
"I found it on a search engine" is not a source. Commercial use, attribution, modification, and consent where people appear — four lines that head off most later…
Security Practical
Cutting form spam without reaching for a CAPTCHA
A CAPTCHA reduces spam and real enquiries alike. The measures that only bots notice are worth trying first.
Security Practical
Choosing authentication: cookies, application passwords, tokens
These three differ in threat model, not convenience. Whether the caller is a browser, your own server, or a third party decides the answer for you.
Security Practical
wp-config and secrets: keeping per-environment values out of the repo
A committed secret is a leaked secret. Rewriting history does not take it back, and the only remaining fix is rotation.
Security Practical
The first hour after you discover a compromise
The most common mistake in this moment is deleting things in a hurry. Here is what to stop first, what to preserve, and in what order to recover…
Security Practical
Designing access when the team starts to grow
If everyone is an administrator, nobody is. Roles exist not to inconvenience people but to limit how far a mistake can travel.
Security Practical
Making repeated login attempts pointless
Rate limiting and moving the login URL are recommended in the same breath, but they do different jobs. Here is an honest account of what each one does…