Security Intro
Hardening starts by counting your administrators
However many doors you close in configuration, eight people holding keys means eight things to protect. A role audit comes before every other hardening step.
Technote
Security
Vulnerabilities, hardening, permissions, login protection and backups — closing the routes into a WordPress site one at a time.
23 articles· Security
Security Intro
What to back up: code, database and uploads are not alike
Manage it as one lump called "the full backup" and an incident leaves you no options. The three parts change at different rates and restore along different paths.
Security Practical
Consent and tracking — the tag that fires first
Collect the minimum, say that you collect it, and honour a refusal. Three lines of principle, and nearly all the failures happen in one place: a tag that…
Security Practical
Closing user enumeration: what REST hands out by default
/wp-json/wp/v2/users opens without login, and the slug it carries is usually the username. That leaves an attacker with only the password to find.
Security Practical
Lead data is an asset and a liability at once
A contact list is a marketing asset and personal data at the same time. Collect the minimum, set a retention period, and actually delete when it expires.
Security Practical
Analytics and privacy: collecting the minimum, honestly disclosed
Showing a banner is not the same as obtaining consent. You should be able to explain what you collect and why — and a retention period ought to…
Security Practical
Receiving webhooks: a nonce check fails every time
An external server has no cookie and no nonce. Verify by signature or shared key, compare with hash_equals, and always sign the raw body.
Security Practical
Escaping on output: which function for which context
Escape at output, not at input. The same stored value can end up in body text, an attribute or a URL, and each context defines safety differently.
Security Intro
Actually reading the licence on a “free” image
"I found it on a search engine" is not a source. Commercial use, attribution, modification, and consent where people appear — four lines that head off most later…
Security Practical
Cutting form spam without reaching for a CAPTCHA
A CAPTCHA reduces spam and real enquiries alike. The measures that only bots notice are worth trying first.
Security Practical
Choosing authentication: cookies, application passwords, tokens
These three differ in threat model, not convenience. Whether the caller is a browser, your own server, or a third party decides the answer for you.
Security Practical
wp-config and secrets: keeping per-environment values out of the repo
A committed secret is a leaked secret. Rewriting history does not take it back, and the only remaining fix is rotation.