Tweaks WP

Dark terminal graphic pairing four hosting marketing claims with the command that tests each, three failing and the checksum verification passing

Your Host Says It Is Secure. Here Is How to Actually Test That

WAF, malware scanning, isolation, daily backups. Every host lists them and almost none of it is verifiable from the marketing page. Ten checks you can run yourself to find out which claims are real, and the questions worth asking before you buy.

Varun Dubey · July 30, 2026 · 10 min read

Dark code graphic showing the _arve_uc_init backdoor function comparing a request parameter against a hardcoded hash, registered on the init hook at priority 1 before authentication

Security

The Backdoor Came Through the Plugin Repo, Not Around It

A hardcoded backdoor reached version 10.8.7 of a 20,000-install WordPress plugin via a compromised developer account. It was caught in under two hours and never distributed. What it did, why the detection matters more than the damage, and what it says about trusting the repo.

Varun Dubey · July 29, 2026 · 10 min read

Dark terminal graphic showing four WP-CLI compromise-assessment checks, with verify-checksums clean and an unknown administrator, unknown application password and two PHP files in uploads flagged red

Security

You Patched wp2shell. Now Prove You Were Not Already Breached

Both wp2shell CVEs went into CISA's KEV catalog on 21 July and public exploits are circulating. Patching closed the door; it did not tell you whether anyone was already inside. A WP-CLI compromise-assessment runbook, and the line where cleanup stops and rebuild begins.

Varun Dubey · July 29, 2026 · 10 min read

Dark graphic with the phrase a security control struck through in red, beside two panels listing what an object cache is not and what to verify

Performance

Your Object Cache Is Not a Security Control

Redis interfered with a recent WordPress exploit chain by accident, not by design. What a persistent object cache actually does, the four things it does not, and how to verify yours is correct rather than merely present.

Varun Dubey · July 26, 2026 · 10 min read

Dark terminal graphic showing a fleet audit script listing four WordPress sites with their core versions and auto-update settings, two flagged red as unpatched

How To

WordPress Auto-Updates at Fleet Scale: The WP-CLI Setup

Which of your sites were unpatched last Friday? A defensible auto-update policy, a WP-CLI fleet inventory you can query, verification that runs itself, and an emergency patch path for the next zero-day.

Varun Dubey · July 26, 2026 · 10 min read

Dark terminal graphic reading wp2shell with CVE-2026-63030 and CVE-2026-60137, showing wp core version returning 7.0.1 as exposed and wp core update installing WordPress 7.0.2

Security

wp2shell: The WordPress Core RCE Chain That Needs No Login

Two chained WordPress core flaws give an anonymous attacker remote code execution on a default install. What CVE-2026-63030 and CVE-2026-60137 actually are, how to check your exposure with WP-CLI, and how to tell whether you were hit before you patched.

Varun Dubey · July 26, 2026 · 10 min read

How to safely update WordPress - backup, staging, then live, an update workflow that never breaks the site

Security

How to Safely Update WordPress (Core, Plugins & Themes) Without Breaking Your Site

Outdated software is the top cause of hacked WordPress sites, but a bad update can break your live site. The safe update workflow - backup, test on staging, apply and verify - that lets you stay current without ever taking the site down.

Varun Dubey · July 17, 2026 · 10 min read

WordPress two-factor authentication setup - password plus a second factor code stops stolen-password attacks

Security

WordPress Two-Factor Authentication (2FA): A Complete Setup Guide

Most WordPress hacks come down to a stolen password, and 2FA makes a stolen password useless on its own. What two-factor authentication is, which method to choose, how to set it up on WordPress, and how to handle recovery codes and team rollout.

Varun Dubey · July 16, 2026 · 10 min read

Speculative loading in WordPress - speculation rules prerender the next page before the click, on a dark terminal

Performance

Speculative Loading in WordPress: How Prerendering Makes Page Navigation Instant

Speculative loading loads the next page before the visitor clicks, so navigation feels instant. How it works via the Speculation Rules API, how WordPress uses it, the more-aggressive default coming in 7.1, and how to configure it safely.

Varun Dubey · July 14, 2026 · 10 min read

How to set up a CDN for WordPress - edge network serving visitors from the nearest node, on a dark background

Performance

How to Set Up a CDN for WordPress (And Why It’s Not Optional in 2026)

A CDN keeps copies of your files on servers worldwide and serves each visitor from the nearest one, so your site loads faster everywhere. What a CDN does, why it is close to essential in 2026, and how to set one up on WordPress without breaking anything.

Varun Dubey · July 11, 2026 · 10 min read

Scaling WordPress to 50000 rows - unbounded queries and N+1 loops that break at scale, on a dark terminal

Performance

Scaling WordPress to 50,000 Rows: Why Your Admin Lists and Queries Break

WordPress runs fast until a dataset hits tens of thousands of rows, then admin lists crawl and queries time out. The specific patterns that break at scale - unbounded queries, N+1 loops, counting by loading, missing indexes - and how to fix each one.

Varun Dubey · July 10, 2026 · 10 min read

Security

The Paywall That Wasn’t: How WordPress Membership Sites Leak Protected Content

A large share of WordPress membership sites leak their paid content - not because the plugin is broken, but because the content lives in files, APIs, feeds, and caches the paywall never guards. The real leak paths, and how to audit your own site as a stranger.

Varun Dubey · July 8, 2026 · 10 min read

Latest Posts

Your Host Says It Is Secure. Here Is How to Actually Test That

The Backdoor Came Through the Plugin Repo, Not Around It

You Patched wp2shell. Now Prove You Were Not Already Breached

Your Object Cache Is Not a Security Control

WordPress Auto-Updates at Fleet Scale: The WP-CLI Setup

wp2shell: The WordPress Core RCE Chain That Needs No Login

How to Safely Update WordPress (Core, Plugins & Themes) Without Breaking Your Site

WordPress Two-Factor Authentication (2FA): A Complete Setup Guide

Speculative Loading in WordPress: How Prerendering Makes Page Navigation Instant

How to Set Up a CDN for WordPress (And Why It’s Not Optional in 2026)

Scaling WordPress to 50,000 Rows: Why Your Admin Lists and Queries Break

The Paywall That Wasn’t: How WordPress Membership Sites Leak Protected Content