Tweaks WP

Timeline showing a thirty day exposure window between a premium WAF rule shipping on 28 July and the free tier rule on 27 August

Your WAF Protected Paying Customers on 28 July. You Get the Rule on 27 August.

Wordfence shipped the ARVE backdoor rule to premium on 28 July. Free tier gets it 27 August. How to measure your own exposure window, verify the WAF is actually loaded, and four ways to close the gap.

Varun Dubey · August 2, 2026 · 13 min read

WordPress media library grid loading more attachments on scroll, with the media_library_infinite_scrolling filter set to true

Performance

WordPress 7.1 Turns On Media Library Infinite Scroll. Measure It Before You Keep It.

Media library infinite scroll is on by default in WordPress 7.1. The new precedence order, why setting the filter overrides every user's opt-out, WP-CLI commands to measure your own library, and the three plugin patterns this breaks.

Varun Dubey · August 1, 2026 · 13 min read

Membership Websites

Best 5 Facebook Group Alternatives for WordPress (2026)

Facebook Groups make it easy to start an online community, but they come with limitations. You don’t own your audience, your content is subject … Read more

Varun Dubey · July 31, 2026 · 13 min read

Dark navy card in WordPress blue reading Half the jobs, half the reruns, with metrics showing 52 percent fewer matrix jobs, 54 percent fewer job-minutes, and runs needing a rerun falling from 68 percent to 36 percent

Code Snippets

Core Trimmed Its PHPUnit Matrix. Do the Same to Yours.

Core cut its PHPUnit matrix by 52 percent and halved its rerun rate. How to apply the same reasoning to a plugin test suite.

Varun Dubey · July 31, 2026 · 13 min read

Dark terminal graphic pairing four hosting marketing claims with the command that tests each, three failing and the checksum verification passing

Security

Your Host Says It Is Secure. Here Is How to Actually Test That

WAF, malware scanning, isolation, daily backups. Every host lists them and almost none of it is verifiable from the marketing page. Ten checks you can run yourself to find out which claims are real, and the questions worth asking before you buy.

Varun Dubey · July 30, 2026 · 13 min read

Dark code graphic showing the _arve_uc_init backdoor function comparing a request parameter against a hardcoded hash, registered on the init hook at priority 1 before authentication

Security

The Backdoor Came Through the Plugin Repo, Not Around It

A hardcoded backdoor reached version 10.8.7 of a 20,000-install WordPress plugin via a compromised developer account. It was caught in under two hours and never distributed. What it did, why the detection matters more than the damage, and what it says about trusting the repo.

Varun Dubey · July 29, 2026 · 13 min read

Dark terminal graphic showing four WP-CLI compromise-assessment checks, with verify-checksums clean and an unknown administrator, unknown application password and two PHP files in uploads flagged red

Security

You Patched wp2shell. Now Prove You Were Not Already Breached

Both wp2shell CVEs went into CISA's KEV catalog on 21 July and public exploits are circulating. Patching closed the door; it did not tell you whether anyone was already inside. A WP-CLI compromise-assessment runbook, and the line where cleanup stops and rebuild begins.

Varun Dubey · July 29, 2026 · 13 min read

Dark graphic with the phrase a security control struck through in red, beside two panels listing what an object cache is not and what to verify

Performance

Your Object Cache Is Not a Security Control

Redis interfered with a recent WordPress exploit chain by accident, not by design. What a persistent object cache actually does, the four things it does not, and how to verify yours is correct rather than merely present.

Varun Dubey · July 26, 2026 · 13 min read

Dark terminal graphic showing a fleet audit script listing four WordPress sites with their core versions and auto-update settings, two flagged red as unpatched

How To

WordPress Auto-Updates at Fleet Scale: The WP-CLI Setup

Which of your sites were unpatched last Friday? A defensible auto-update policy, a WP-CLI fleet inventory you can query, verification that runs itself, and an emergency patch path for the next zero-day.

Varun Dubey · July 26, 2026 · 13 min read

Dark terminal graphic reading wp2shell with CVE-2026-63030 and CVE-2026-60137, showing wp core version returning 7.0.1 as exposed and wp core update installing WordPress 7.0.2

Security

wp2shell: The WordPress Core RCE Chain That Needs No Login

Two chained WordPress core flaws give an anonymous attacker remote code execution on a default install. What CVE-2026-63030 and CVE-2026-60137 actually are, how to check your exposure with WP-CLI, and how to tell whether you were hit before you patched.

Varun Dubey · July 26, 2026 · 13 min read

How to safely update WordPress - backup, staging, then live, an update workflow that never breaks the site

Security

How to Safely Update WordPress (Core, Plugins & Themes) Without Breaking Your Site

Outdated software is the top cause of hacked WordPress sites, but a bad update can break your live site. The safe update workflow - backup, test on staging, apply and verify - that lets you stay current without ever taking the site down.

Varun Dubey · July 17, 2026 · 13 min read

WordPress two-factor authentication setup - password plus a second factor code stops stolen-password attacks

Security

WordPress Two-Factor Authentication (2FA): A Complete Setup Guide

Most WordPress hacks come down to a stolen password, and 2FA makes a stolen password useless on its own. What two-factor authentication is, which method to choose, how to set it up on WordPress, and how to handle recovery codes and team rollout.

Varun Dubey · July 16, 2026 · 13 min read

Latest Posts

Your WAF Protected Paying Customers on 28 July. You Get the Rule on 27 August.

WordPress 7.1 Turns On Media Library Infinite Scroll. Measure It Before You Keep It.

Best 5 Facebook Group Alternatives for WordPress (2026)

Core Trimmed Its PHPUnit Matrix. Do the Same to Yours.

Your Host Says It Is Secure. Here Is How to Actually Test That

The Backdoor Came Through the Plugin Repo, Not Around It

You Patched wp2shell. Now Prove You Were Not Already Breached

Your Object Cache Is Not a Security Control

WordPress Auto-Updates at Fleet Scale: The WP-CLI Setup

wp2shell: The WordPress Core RCE Chain That Needs No Login

How to Safely Update WordPress (Core, Plugins & Themes) Without Breaking Your Site

WordPress Two-Factor Authentication (2FA): A Complete Setup Guide