Security research and disclosures
Vulnerability research, disclosure write-ups and practical hardening guidance for people running WordPress in production.
-
Why Other Plugins Aren’t Enough: Turn WordPress Telemetry Into Immediate Remediation
A pragmatic playbook for WordPress owners: why relying on security plugins creates noisy telemetry and what to do to convert alerts into fast, focused…
-
Reduce Incident Blast Radius: Monitoring & Recovery Playbooks for WordPress
A hardening guide and implementation roadmap for IT generalists: shrink attacker impact with focused telemetry, containment controls, and recovery playbooks that restore uptime fast.
-
Layered Defense for Malware & Web Shells: A Practical Threat-Model Walkthrough
A high-urgency, technical founder’s blueprint to stop malware drops and web shells on WordPress. Prioritized controls, quick detection, and an operational 90-minute playbook to…
-
How WordPress Hacks Actually Happen: A Mistakes-to-Avoid Teardown for WooCommerce Admins
A teardown focused on how attackers reach privileged WordPress admin access on WooCommerce sites — the common operator mistakes that create the blast radius…
-
Operator Blueprint: Reduce Plugin Exploit Risk During Disclosure Windows
A step-by-step operator blueprint for agencies to harden multiple client WordPress sites and reduce plugin exploit risk during disclosure windows — triage, containment, temporary…
-
Stopping Brute-Force & Credential Stuffing: A Battle-Tested Incident Playbook for WordPress Owners
A pragmatic, battle-tested playbook for small WordPress teams to stop brute-force and credential stuffing attacks fast — detection, containment, and hardening steps you can…