75 guides published Start a blog Fix my site How we test

Security

Hardening before it happens, and cleanup after it already did.

10published
Security Advanced

Security Headers for WordPress, and What Each One Actually Does

Six headers, what they protect against, and which ones will break your site if you set them carelessly.

19 Aug 2026 · 35 min
Security Beginner

Two-Factor on WordPress, Set Up So You Cannot Lock Yourself Out

The highest-value security change you can make, and the order of operations that keeps a way back in.

16 Aug 2026 · 20 min
Security Beginner

A Backup Routine You Will Actually Test

An untested backup is an assumption. Here is a schedule, a storage rule, and a quarterly drill that takes twenty minutes.

14 Aug 2026 · 20 min
Security Intermediate

WordPress File Permissions That Are Tight Enough But Still Let You Update

What each number means, the values to use, and why updates break when you get it wrong in either direction.

12 Aug 2026 · 20 min
Security Beginner

Should You Disable XML-RPC on WordPress?

It is genuinely used for brute-force amplification. It is also genuinely used by things you may rely on. Here is how to…

11 Aug 2026 · 10 min
Security Intermediate

Lock Down wp-admin Without Locking Yourself Out

IP rules, two-factor and login limits, in the order that leaves you a way back in at every step.

9 Aug 2026 · 25 min
Security Advanced

How to Find a Backdoor in functions.php

Injected code hides in plain sight at the bottom of a theme file. Here is what it looks like, how to confirm…

7 Aug 2026 · 45 min
Security Advanced

Clean a Hacked WordPress Site Without Reinstalling Everything

Find it, remove it, close the hole, then prove it is gone. The order matters more than the tools.

5 Aug 2026 · 3 hr
Security Beginner

Harden a Fresh WordPress Install in Thirty Minutes

Nine changes, ordered by how much each one actually buys you. No security plugin required, and nothing here will lock you out.

2 Aug 2026 · 30 min