Tweaks WP

WordPress login security hardening: rate limiting with transients, custom login URL via rewrite rules, and brute force protection code diagram on dark developer background

WordPress Login Security: Rate Limiting, Custom URL, and Brute Force Protection

Harden WordPress login with PHP rate limiting via transients, a custom login URL using rewrite rules, Application Password controls, and TOTP 2FA. No plugins required.

Varun Dubey · April 30, 2026 · 15 min read

WordPress file permissions chmod guide showing correct values: 400 for wp-config.php, 755 for directories, 644 for files, 444 for .htaccess

How To

Correct File Permissions for WordPress: chmod Guide for Every File and Folder

Set correct chmod values for wp-config.php, directories, files, uploads, and .htaccess. Includes one-liner fix commands and wp-config.php constants.

Varun Dubey · April 30, 2026 · 15 min read

Dark developer-themed featured image showing PHP code for disabling XML-RPC and blocking REST API user enumeration in WordPress

Backup and Security

How to Disable XML-RPC and Block REST API User Enumeration in WordPress

Disable XML-RPC, block REST API user enumeration, and stop ?author= redirects with exact PHP hooks, Apache/.htaccess, and Nginx config examples.

Varun Dubey · April 30, 2026 · 15 min read

WordPress security headers guide showing .htaccess code for CSP, HSTS, and X-Frame-Options on a dark background

Backup and Security

WordPress Security Headers: How to Add CSP, HSTS, and X-Frame-Options

A practical guide to adding HTTP security headers to your WordPress site using .htaccess, nginx config, and PHP. Covers Content Security Policy (CSP) without breaking Gutenberg, HSTS with preload submission, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy — plus how to test with securityheaders.com and Mozilla Observatory.

Varun Dubey · April 24, 2026 · 15 min read

WordPress wp-config.php environment configuration for dev, staging, and production showing server, settings, and file-code icons on dark navy background

Code Snippets

WordPress Environment Config: How to Set Up Dev/Staging/Production wp-config.php

Learn how to configure separate WordPress environments for dev, staging, and production using conditional constants, WP_ENVIRONMENT_TYPE, wp-config-local.php pattern, and .env file integration.

Varun Dubey · April 20, 2026 · 15 min read

WordPress database connection constants: DB_CHARSET, DB_COLLATE, MYSQL_CLIENT_FLAGS, and WP_ALLOW_REPAIR shown with a WP-CLI TLS verification terminal

Database Optimization

WordPress Database Connection: SSL, Charset, Collation, and Repair Constants

Master the wp-config.php database block: DB_CHARSET, DB_COLLATE, WP_ALLOW_REPAIR, MYSQL_CLIENT_FLAGS, a custom db.php drop-in for TLS pinning, and WP-CLI checks to verify encoding and SSL on every connection.

Varun Dubey · April 18, 2026 · 15 min read

WordPress Vulnerability Roundup featuring Ninja Forms, Kali Forms, and Perfmatters under active exploitation

Backup and Security

April 2026 WordPress Vulnerability Roundup: Ninja Forms, Kali Forms, and Perfmatters Under Active Exploitation

Three high-severity WordPress vulnerabilities are under active exploitation right now — Ninja Forms file upload, Kali Forms, and Perfmatters file deletion. Here is what got disclosed between April 6 and April 18, who is affected, and the exact steps to take in the next 10 minutes if you run any of them.

Varun Dubey · April 18, 2026 · 15 min read

Code Snippets

WordPress Multisite wp-config.php: Network Constants

A complete reference to every WordPress multisite wp-config.php constant: WP_ALLOW_MULTISITE, MULTISITE, SUBDOMAIN_INSTALL, DOMAIN_CURRENT_SITE, PATH_CURRENT_SITE, SITE_ID_CURRENT_SITE, BLOG_ID_CURRENT_SITE, NOBLOGREDIRECT, SUNRISE, COOKIE_DOMAIN, SITECOOKIEPATH, COOKIEHASH, and network tweaks that separate a working network from a production-grade one.

Varun Dubey · April 17, 2026 · 15 min read

Banner for Wordfence April 2026 Perfmatters Ninja Forms MW WP Form CVE

Security

Wordfence Weekly: 450K WordPress Sites at Risk (Perfmatters, Ninja Forms, MW WP Form)

Three major WordPress plugin vulnerabilities disclosed in early April 2026, Perfmatters (200K sites), Ninja Forms File Upload (50K sites), and MW WP Form (200K sites). What each vulnerability does, whether your site is affected, and the patched version numbers.

Varun Dubey · April 14, 2026 · 15 min read

Banner for moving WordPress content directory and uploads path

Migration & Backup

How to Move WordPress Content Directory (WP_CONTENT_DIR, UPLOADS, Plugin Paths)

Step-by-step guide to relocating WordPress wp-content, uploads, and plugin directories using WP_CONTENT_DIR, UPLOADS, and WP_PLUGIN_DIR constants, plus the gotchas that break themes and plugins after the move.

Varun Dubey · April 14, 2026 · 15 min read

bbPress tutorial 2026 featured image with 4-step setup guide: install and configure, create forums, theme integration, security and moderation

Blog

bbPress Tutorial 2026: Complete Setup Guide from Zero to Live Forum

Step-by-step bbPress tutorial for 2026. Install, configure, theme, secure, and launch a real WordPress forum — based on setting up bbPress on 50+ client sites.

Varun Dubey · April 11, 2026 · 15 min read

7 Best wpForo Alternatives 2026 showing migration path from wpForo to Jetonomy with theme.json integration, built-in importer, trust levels, and 4 space types

Blog

7 Best wpForo Alternatives for WordPress in 2026 (Tested Honestly)

I ran wpForo in production for 8 months before migrating off it. Here are the 7 wpForo alternatives that actually work in 2026 — tested honestly with real deployment experience.

Varun Dubey · April 11, 2026 · 15 min read

Latest Posts

WordPress Login Security: Rate Limiting, Custom URL, and Brute Force Protection

Correct File Permissions for WordPress: chmod Guide for Every File and Folder

How to Disable XML-RPC and Block REST API User Enumeration in WordPress

WordPress Security Headers: How to Add CSP, HSTS, and X-Frame-Options

WordPress Environment Config: How to Set Up Dev/Staging/Production wp-config.php

WordPress Database Connection: SSL, Charset, Collation, and Repair Constants

April 2026 WordPress Vulnerability Roundup: Ninja Forms, Kali Forms, and Perfmatters Under Active Exploitation

WordPress Multisite wp-config.php: Network Constants

Wordfence Weekly: 450K WordPress Sites at Risk (Perfmatters, Ninja Forms, MW WP Form)

How to Move WordPress Content Directory (WP_CONTENT_DIR, UPLOADS, Plugin Paths)

bbPress Tutorial 2026: Complete Setup Guide from Zero to Live Forum

7 Best wpForo Alternatives for WordPress in 2026 (Tested Honestly)