Security
Articles about security on WordPress: what each setting does, why it matters, and how to change it.
-
Security
php2shell: How to Check If Your WordPress Site’s PHP Is Patched
Two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) were fixed on 21 October 2026. Find your site's real PHP version, see if it is fixed, and what to ask your host.
-
Security
How to Check If Your WordPress Core Files Were Modified
Core files never change between updates, so a file that differs from the official release is a warning sign. Check with WP-CLI or without SSH, and what to do next.
-
Security
PHP Files in the WordPress Uploads Folder: What They Mean
The uploads folder should hold only media. How to find PHP files there, tell harmless ones from back doors, remove them and stop PHP running in uploads.
-
Security
Is Your WordPress debug.log Public? Check and Fix It
A public wp-content/debug.log hands out server paths, plugin lists and sometimes personal data. A ten-second check, and how to move the log out of reach.
-
Security
Why WordPress Login Error Messages Help Hackers
WordPress tells attackers if a username exists by showing different error messages. Here's how to replace those hints with a generic message.
-
Security
WordPress Security Headers: What They Are and How to Add Them
Most WordPress sites are missing security headers that protect against XSS, clickjacking, and MIME attacks. Here's what they are and how to add them.
-
Security
How Hackers Find Your WordPress Username (and How to Stop Them)
Typing ?author=1 on any WordPress site reveals the admin username. Attackers use this for brute force login. Here's how to block author enumeration.
-
Security
Your WordPress REST API Is Leaking User Data — Here’s the Fix
The WordPress REST API exposes your user list at /wp-json/wp/v2/users — no login required. Here's how to restrict it without breaking your site.
-
Security
Why the WordPress Theme/Plugin Editor Is a Security Risk
WordPress ships with a built-in code editor that lets anyone with admin access edit PHP files live. Here's why that's dangerous and how to disable it.
-
Security
WordPress Application Passwords: Do You Need Them?
WordPress 5.6 added Application Passwords for REST API authentication. If you don't use external apps, it's an attack surface you don't need. Here's how to disable it.