How to Disable XML-RPC and Block REST API User Enumeration in WordPress
Disable XML-RPC, block REST API user enumeration, and stop ?author= redirects with exact PHP hooks, Apache/.htaccess, and Nginx config examples.
Backup and Security9 min read
Category: Security
Wordfence Weekly: 450K WordPress Sites at Risk (Perfmatters, Ninja Forms, MW WP Form)
<p>Three major WordPress plugin vulnerabilities disclosed in early April 2026, Perfmatters (200K sites), Ninja Forms File Upload (50K sites), and MW WP Form (200K sites). What each vulnerability does, whether your site is affected, and the patched version numbers.</p>
Security8 min read
400,000 WordPress Sites at Risk: How to Check and Fix the Ally Plugin SQL Injection
A critical unauthenticated SQL injection vulnerability in the Ally accessibility plugin puts 400,000 WordPress sites at risk. How to check if you're affected, how to update, and what to do if you were already compromised.
Security13 min read
7 WordPress Security Mistakes Even Experienced Developers Make
Even seasoned WordPress developers make predictable security mistakes: nonce misuse, missing capability checks, SQL injection via $wpdb, incorrect file permissions, debug mode in production, no direct file access protection, and gaps in sanitization and escaping. This guide shows each mistake with the wrong pattern and the correct fix.
Security12 min read
How to Protect Your WordPress Site from Malware and Crypto Miners (Complete Guide)
A practical guide for developers and site owners on hardening WordPress against malware infections and crypto mining scripts - covering server hardening, file monitoring, mu-plugin security, wp-config hardening, malware detection techniques, and signs your site has been compromised.
Security12 min read
WordPress Vulnerability Roundup: February 23 to March 1 (Analysis and Action Items)
Weekly analysis of WordPress vulnerabilities reported between February 23 and March 1. Covers critical and high-severity issues, affected plugins, CVE details, and the action items site owners need to take immediately.
Security13 min read
WordPress .htaccess Tweaks for Security and Performance
Security6 min read
wp-config.php Tweaks: 15 Hidden Settings Every WordPress Developer Should Know
How To9 min read
800K Sites Exposed: WPVivid Vulnerability Fix Guide
Critical WPVivid vulnerability (CVE-2026-1357) affects 800K WordPress sites. Check if you're exposed, fix steps, WP-CLI audit commands, and security hardening tips.
Security5 min read
What Is the Best Tool to Scan WordPress Site? Top Options Compared
Security7 min read
Best WordPress Security Plugins of 2021
Security6 min read
