File-Upload Flaw in a Plugin: How to Check and Clean
Patching a file upload vulnerability does not remove what was uploaded. Version, uploads and log checks for Bricksforge CVE-2026-85097 and Gravity Forms.
Security9 min read
WordPress Guides
Hardening a Site That Accepts Member Uploads: Server Risks Plugin Updates Do Not Cover
Plugin updates do not patch the image libraries your server uses. How to check your stack and harden member uploads, with libheif as the example.
Security14 min read
It Works in the Demo: The Checklist Between an AI-Built App and One You Can Put Customers On
Six checks to run before customers use an app an AI builder made: access rules, keys, dependencies, a tested restore, migrations, and monitoring.
Security15 min read
See What a PHP Upgrade Will Break Before Your Host Does It for You
Test a PHP upgrade on staging: debug log, money paths, forced cron and imports, reading the log, and a PHPCompatibilityWP scan.
Debugging & Profiling15 min read
Update the Same Day or Wait? A WordPress Update Policy for People Who Look After Many Sites
Security releases go out the same day, automatically, with proof. Feature releases get a copy first. A decision table, a three-step check and a rollback plan.
Security15 min read
The Hidden WordPress Admin Account: A 15-Minute Audit and What to Do If You Find One
Some attacks create an admin account the Users screen cannot show. Run this 15-minute WP-CLI and SQL audit, then clean up and prevent a repeat.
Security16 min read
Your WordPress Site's End-of-Year Upgrade Calendar: 7.2, PHP 8.2 and MySQL 8.0 in One Plan
A week-by-week staging plan for WordPress 7.2, the PHP 8.2 deadline and MySQL 8.0, from 12 October to early January, with commands and rollbacks.
Security14 min read
Your Host's Firewall Is Not the Patch: How to Test What Your Hosting Really Protects
A firewall filters requests that look like a known attack; an update removes the bug. Real WordPress releases where the bug needed a login, which layer filters what, how to test your own protection on staging, and a one-page response plan.
Security12 min read
WordPress Caching, Explained Layer by Layer: Every Popular Plugin, Every Host Cache, and Which to Use
The six cache layers from browser to database, what common managed hosts build in, what ten caching plugins include, and the right setup for each host type, with a three-header check to see which layer is answering.
Performance14 min read
Six WordPress Performance Problems PageSpeed Will Never Show You
PageSpeed Insights sends no cookies and never logs in, so it misses the slowest WordPress problems. Six of them, with the commands to measure each and the smallest fix.
Performance11 min read
AI-Written WordPress Code Snippets: 10 Checks Before You Paste
A ten-minute review for any AI-written WordPress code snippet: hooks, capability checks, nonces, escaping, $wpdb->prepare, autoloaded options, per-request cost, deprecated functions, PHP 8.x, where to put it, and how to roll it back.
Code Snippets14 min read
Fatal Error After Updating to WordPress 7.1.1 with Composer: What Broke and How to Fix It
The Composer package for WordPress 7.1.1 and 7.0.5 was published without wp-includes, so a deploy of the security release leaves every request fatal on wp-settings.php line 34. How to confirm it, three ways back online, and the build-time guard that stops the next one.
Debugging & Profiling11 min read
