Category
WordPress
Hardening and monitoring WordPress & WooCommerce from the outside — no plugin required.
WordPress6 min read
WordPress user enumeration: why /?author=1 hands attackers half a login
If your site redirects /?author=1 to /author/<name>/, it's publishing valid usernames. Here's why that matters and how to shut it down.
WordPress5 min read
Your WordPress debug.log is public — here’s what it’s handing out
A reachable /wp-content/debug.log is a running confession of everything going wrong on the box: paths, plugins, queries, sometimes secrets.
WordPress5 min read
xmlrpc.php: the WordPress endpoint you can almost certainly turn off
A reachable xmlrpc.php is a brute-force amplifier and a DDoS reflector. Most modern sites don’t use it at all.
WordPress5 min read
WordPress version disclosure: a small leak that makes you a precise target
Publishing your exact WordPress version lets attackers match your site to a CVE list in seconds. Hide it — but don’t mistake that for the real fix.
WordPress6 min read
Monitoring WordPress without installing a plugin
Core version drift, exposed xmlrpc, leaked debug logs — all catchable from the outside.