Website Security Archives

Dark red graphic reading five paths publish your usernames, four are core, with five numbered cards listing the REST users endpoint, the author id redirect, the core user sitemap, the oembed author name field and login error messages, and a footer noting 223 users with 16 exposed unauthenticated

Every Way Your WordPress Site Hands Out Usernames

WordPress publishes usernames through five separate paths, most of them core behaviour. Each one tested against a live install, with the fix, the fleet audit, and what to do first instead.

Varun Dubey · August 19, 2026 · 13 min read

Dark card for WordPress 7.0.4 security release listing three checkable preconditions: an Author or above account, Imagick in use rather than GD, and Ghostscript present on the server

How To

WordPress 7.0.4 Is a Security Release. Check Imagick.

An authenticated Author+ RCE via file upload on sites using Imagick and Ghostscript. Three checkable preconditions, the WP-CLI to answer each across a fleet, and what the CVE record does not yet say.

Varun Dubey · August 15, 2026 · 13 min read

Dark terminal card reading it says ClaudeBot, it is asking for your .env file, with three log lines showing a claimed crawler requesting .env, .git/config and a wp-config backup

AI

Someone Is Scanning Your Site Pretending to Be ClaudeBot

A reported campaign impersonates AI crawlers to scan for credential and config files left by AI coding tools. Why user-agent rules are theatre, how to verify a crawler properly, and the commands to check your own fleet.

Varun Dubey · August 14, 2026 · 13 min read

Dark terminal-style card reading discovery got faster, the fix still travels at your speed, with three clocks: discovery much faster, patch somewhat faster, distribution unchanged

AI

AI Finds WordPress Vulnerabilities Faster Than Fixes Ship

Discovery got faster on both sides. Distribution of the fix did not. What AI actually changed about finding plugin bugs, what it did not, and the WP-CLI commands to measure your own exposure window.

Varun Dubey · August 12, 2026 · 13 min read

Dark developer-themed featured image showing PHP code for disabling XML-RPC and blocking REST API user enumeration in WordPress

Backup and Security

How to Disable XML-RPC and Block REST API User Enumeration in WordPress

Disable XML-RPC, block REST API user enumeration, and stop ?author= redirects with exact PHP hooks, Apache/.htaccess, and Nginx config examples.

Varun Dubey · April 30, 2026 · 13 min read

WordPress Vulnerability Roundup featuring Ninja Forms, Kali Forms, and Perfmatters under active exploitation

Backup and Security

April 2026 WordPress Vulnerability Roundup: Ninja Forms, Kali Forms, and Perfmatters Under Active Exploitation

Three high-severity WordPress vulnerabilities are under active exploitation right now — Ninja Forms file upload, Kali Forms, and Perfmatters file deletion. Here is what got disclosed between April 6 and April 18, who is affected, and the exact steps to take in the next 10 minutes if you run any of them.

Varun Dubey · April 18, 2026 · 13 min read

Security

400,000 WordPress Sites at Risk: How to Check and Fix the Ally Plugin SQL Injection

A critical unauthenticated SQL injection vulnerability in the Ally accessibility plugin puts 400,000 WordPress sites at risk. How to check if you're affected, how to update, and what to do if you were already compromised.

Varun Dubey · March 22, 2026 · 13 min read

Blog

How to Audit Your WordPress Site Security in 5 Minutes

Seven concrete security checks you can run on any WordPress site in under 5 minutes: SSL certificate status, security headers, exposed sensitive files, PHP version, external JavaScript sources, user roles, and file permissions.

Varun Dubey · March 12, 2026 · 13 min read

Security

How to Protect Your WordPress Site from Malware and Crypto Miners (Complete Guide)

A practical guide for developers and site owners on hardening WordPress against malware infections and crypto mining scripts - covering server hardening, file monitoring, mu-plugin security, wp-config hardening, malware detection techniques, and signs your site has been compromised.

Varun Dubey · March 11, 2026 · 13 min read

Security

WordPress Vulnerability Roundup: February 23 to March 1 (Analysis and Action Items)

Weekly analysis of WordPress vulnerabilities reported between February 23 and March 1. Covers critical and high-severity issues, affected plugins, CVE details, and the action items site owners need to take immediately.

Varun Dubey · March 11, 2026 · 13 min read

Tag: Website Security

Every Way Your WordPress Site Hands Out Usernames

WordPress 7.0.4 Is a Security Release. Check Imagick.

Someone Is Scanning Your Site Pretending to Be ClaudeBot

AI Finds WordPress Vulnerabilities Faster Than Fixes Ship

How to Disable XML-RPC and Block REST API User Enumeration in WordPress

April 2026 WordPress Vulnerability Roundup: Ninja Forms, Kali Forms, and Perfmatters Under Active Exploitation

400,000 WordPress Sites at Risk: How to Check and Fix the Ally Plugin SQL Injection

How to Audit Your WordPress Site Security in 5 Minutes

How to Protect Your WordPress Site from Malware and Crypto Miners (Complete Guide)

WordPress Vulnerability Roundup: February 23 to March 1 (Analysis and Action Items)