Articles
WordPress security articles
Plain-spoken WordPress security articles: what attackers actually do, what to switch on, and what to do when something goes wrong.
RSS FeedLatest WordPress security articles
WordPress Content Security Policy: A Practical Guide
A Content Security Policy tells browsers which scripts, styles and frames your pages may use. Here is how to build one for WordPress, test it in report-only mode and roll it out safely.
Read articleHow to Manage Multiple WordPress Sites Without Losing Your Mind
Ten sites is a hobby, fifty is a job and two hundred is a system. Here is how to manage multiple WordPress sites with a standard stack, clear routines and fewer 2 a.m. surprises.
Read articleWordPress Comment Spam: How to Stop It for Good
Spam comments clutter your site, hurt your search standing and can hide malicious links. Here is how to stop them with core settings, filters, CAPTCHA, or by switching comments off.
Read articleWordPress Pharma Hack: How to Find and Fix It
The WordPress pharma hack fills your site with drug spam that only Google sees. Here is how to detect it, where it hides, the right cleanup order and how to get Google to recheck.
Read articleWordPress Phishing Emails: How to Spot Them and What to Do
Fake hosting notices, fake security patches, fake password resets and fake copyright claims all target WordPress owners. Here is how to spot them and what to do if you already clicked.
Read articleWordPress Application Passwords: How They Work and When to Turn Them Off
Application passwords give apps their own key to your site, and that key skips the sign-in page. Here is how they work, how to audit them, and when switching them off makes sense.
Read articleWordPress Staging Site: What It Is and How to Set One Up
A staging site is a private copy of your site where mistakes cost nothing. Here is how to create one, keep it from emailing customers or ranking in Google, and move changes back.
Read articleHow to Block Countries in WordPress (and When You Should Not)
Country blocking can cut attack noise for a local business, and it can also lock out real customers. Here is how to block countries in WordPress safely, and when to leave it alone.
Read articleWordPress REST API Security: What Is Exposed and How to Lock It Down
The WordPress REST API is on by default and parts of it are public. Here is what is exposed, how authentication works, and how to write and restrict endpoints without breaking the block editor.
Read articleGet new articles by email
One short email when a new article is out, plus the WordPress threats worth knowing about. No spam, unsubscribe any time.
Questions
WordPress security articles: questions
Who writes these WordPress security articles?
The Stack Mode team, who build Stack Guard and look after client WordPress sites every day. Each article is checked against how WordPress and Stack Guard really work.
Do I need Stack Guard to use the advice in these articles?
No. Every article explains the problem and the manual fix first. Where Stack Guard can do it for you, the article says how and on which plan.
How do I hear about new WordPress security articles?
Subscribe with the form on this page, or follow the RSS feed. One short email per new article, no spam.