The Hidden WordPress Admin Account: A 15-Minute Audit and What to Do If You Find One
Some attacks create an admin account the Users screen cannot show. Run this 15-minute WP-CLI and SQL audit, then clean up and prevent a repeat.
Security16 min read
Category: WordPress
Your WordPress Site's End-of-Year Upgrade Calendar: 7.2, PHP 8.2 and MySQL 8.0 in One Plan
A week-by-week staging plan for WordPress 7.2, the PHP 8.2 deadline and MySQL 8.0, from 12 October to early January, with commands and rollbacks.
Security14 min read
Your Host's Firewall Is Not the Patch: How to Test What Your Hosting Really Protects
A firewall filters requests that look like a known attack; an update removes the bug. Real WordPress releases where the bug needed a login, which layer filters what, how to test your own protection on staging, and a one-page response plan.
Security12 min read
WordPress Caching, Explained Layer by Layer: Every Popular Plugin, Every Host Cache, and Which to Use
The six cache layers from browser to database, what common managed hosts build in, what ten caching plugins include, and the right setup for each host type, with a three-header check to see which layer is answering.
Performance14 min read
Six WordPress Performance Problems PageSpeed Will Never Show You
PageSpeed Insights sends no cookies and never logs in, so it misses the slowest WordPress problems. Six of them, with the commands to measure each and the smallest fix.
Performance11 min read
AI-Written WordPress Code Snippets: 10 Checks Before You Paste
A ten-minute review for any AI-written WordPress code snippet: hooks, capability checks, nonces, escaping, $wpdb->prepare, autoloaded options, per-request cost, deprecated functions, PHP 8.x, where to put it, and how to roll it back.
Code Snippets14 min read
Fatal Error After Updating to WordPress 7.1.1 with Composer: What Broke and How to Fix It
The Composer package for WordPress 7.1.1 and 7.0.5 was published without wp-includes, so a deploy of the security release leaves every request fatal on wp-settings.php line 34. How to confirm it, three ways back online, and the build-time guard that stops the next one.
Debugging & Profiling11 min read
The Cookies Quietly Bypassing Your WordPress Page Cache
A 95 percent hit rate can hide the requests your cache was never allowed to see. How to measure the real bypass rate from logs and headers, find the cookie causing it, and rewrite the rules narrowly without serving one shopper's cart to another.
Performance11 min read
Allowed Memory Size Exhausted: Where a WordPress Request's Memory Goes
Raising the memory limit hides the real question: what in this request needed that much? How to measure peak memory per request and per plugin, the autoload and transient costs every page pays, the PHP array shape that multiplies memory, and the unbounded queries behind most fatals.
Performance11 min read
Outdated SQL Server in Site Health After WordPress 7.1
WordPress 7.1 raised its MariaDB recommendation from 10.6 to 10.11, so Site Health now flags servers that reached end of life in July. MySQL 8.0 is end of life too, but still passes. How to check what you run and upgrade safely.
Debugging & Profiling11 min read
WordPress HTTP Error on Media Upload: The Seven Real Causes
WordPress answers a failed upload with two words and no detail. Here are the seven causes that account for almost every case, the fingerprint each one leaves, and the three logs that hold the real error.
Debugging & Profiling12 min read
Your WordPress Snippets Are Not in Your Deploy
Code stored in a database row has no diff, no deploy and no review. Here are the WP-CLI commands that find every snippet, shortcode and unauthenticated AJAX action on a site you inherited, and the order to migrate them safely.
How To12 min read
