WordPress Security

An opinionated, vendor-neutral hardening checklist for self-hosted WordPress. It covers what actually reduces your risk in 2026, what is security theatre, and a concrete configuration reference you can apply in an afternoon.

An SSL certificate is how your WordPress site proves its identity and encrypts traffic between visitor and server. This article explains what the certificate actually does, which type you need, how Let's Encrypt and managed hosts issue and renew it, and how to verify yours is working.

A plain-language explanation of WordPress file permissions, why the FTP credentials prompt appears when you try to install a plugin, and a reference table with the exact values for every path including wp-config.php.

A layered defence for the two URLs that take almost all the brute-force traffic on a WordPress site. Rate limit at the edge, harden authentication in WordPress, and keep Jetpack, mobile apps and Application Passwords working while you do it.

A practical guide to adding two-factor authentication to a WordPress site without locking out yourself or your team. Picking a method, picking a plugin, enforcing it by role, and recovering when a phone is lost or a backup code goes missing.

Visitors get redirected to a spam page, but you see nothing when you check. This article explains how modern WordPress redirect malware hides from admins, where it actually lives, and how to clean a site so it stays clean.

Managed WordPress hosts block specific plugins because they conflict with server-level infrastructure the host already provides. This reference covers which plugins are blocked on which hosts, why each category is restricted, and what to use instead.

A security scan flagged /wp-json/wp/v2/users as exposed. This article explains what the endpoint actually reveals to unauthenticated visitors, which data is the real risk (login slugs, not emails), and three ways to lock it down without breaking the block editor or Application Passwords.

A layered, Akismet-free approach to WordPress comment spam. Tighten the built-in Discussion settings first, add a JavaScript honeypot, then a heuristic filter, and drop a developer hook on top only if you need one.