WordPress hardening

WordPress supply chain security: auditing plugins and themes Every plugin and theme is code from someone else running with full access to your site. The supply chain risk is real: a plugin author’s account is compromised and a malicious update goes out, an abandoned plugin is bought and “updated” with a backdoor, or a premium…

Secrets in WordPress: keep keys out of wp-config.php, git and backups A typical wp-config.php holds the database password, the salts, an SMTP password, payment and API keys. The file gets copied to staging, ends up in backups that are stored for years, and sometimes in a git repository. Each copy is a place where the…

auditd for WordPress: who changed wp-config.php, and which process ran it After an incident, file timestamps say that wp-config.php changed at 03:12, but not who changed it or how: an SFTP user, a compromised plugin through PHP, a cron job. The Linux audit system records such events in the kernel, with the user, the process…

JWT authentication for the WordPress REST API: when it fits and how to do it safely Cookies and nonces authenticate REST requests from the WordPress site itself. A mobile app or a separate frontend needs something else. WordPress core has Application Passwords since 5.6, which work with Basic Auth over HTTPS. JSON Web Tokens are…

A security review of a WordPress plugin with PHPCS and Semgrep Most vulnerabilities in WordPress plugins belong to a few patterns: output without escaping, input without sanitizing, a missing nonce or capability check, SQL built from variables, a file path from a request. Static analysis tools find many of them in minutes, before a human…

Harden the WordPress REST API without breaking the editor “Disable the REST API” is common advice and wrong: the block editor, the Site Editor, many plugins and WooCommerce’s checkout blocks run on it. What can be done is smaller and safer: hide the routes that leak data to anonymous visitors, remove routes of features the…

File integrity checks for WordPress: find modified and injected files After a hack, the first question is “which files were changed?”. Without a reference, nobody can say whether wp-includes/functions.php is original or has three extra lines at the end. WordPress publishes checksums for every core release, WP-CLI compares against them, and for plugins and themes…

Nginx map and geo: block bad traffic and protect wp-admin before PHP runs Every request that reaches PHP costs a worker, a WordPress bootstrap and often database queries. Scanners that probe /.env, bots that hammer wp-login.php and scrapers with known user agents can be rejected by Nginx itself in microseconds. Two modules do the classification:…

Disable and secure xmlrpc.php against brute-force attacks xmlrpc.php is WordPress’ old remote API, older than the REST API: external applications can publish posts, manage comments, upload media and check credentials with XML requests. Its system.multicall method is the security problem: one HTTP request can contain hundreds of login attempts, so per-request limits and log-based bans…