HTML comments and generator tags: erase the traces of WordPress
SEO, analytics and cache plugins and page builders sign the source code with their name and version. The list plugin by plugin, how Masquerade Security removes…
Guides and analysis
WordPress security blog
Recent vulnerabilities, useful settings and best practices for protecting a WordPress site, explained clearly and backed by sources.
MalCare and WP Masquerade: off-server scanning and locked-down access
MalCare in detail (scanning on its servers, firewall, cleanup, plans), what WP Masquerade adds, which two-factor authentication to choose and the recommended setup for small hosting…
WordPress backups: a 3-2-1 strategy that holds up
A backup is only worth something on the day it saves you. Here is the 3-2-1 rule, the right frequency and the test that proves it…
Patchstack and WP Masquerade: virtual patches and less visible plugins
How Patchstack’s alerts and virtual patches work, what WP Masquerade adds upstream, the hardening options to keep on one side only and the HSTS question.
LiteSpeed Cache: two unauthenticated XSS flaws, patch in 7.9.2
A comment published without an account can get an administrator's browser to run JavaScript when LiteSpeed Cache font optimization or CDN rewriting is on. Version 7.9.2…
WordPress core vulnerabilities: security patches 2020 to 2026
From WordPress 5.4.1 to 7.1.3, the complete record of the 27 releases that fixed core vulnerabilities since 2020: dates, backported branches, CVEs, severity and documented attacks.
Sucuri and WP Masquerade: cloud firewall and a hidden WordPress
What Sucuri’s free plugin and paid firewall do, what WP Masquerade adds, the real IP address behind the firewall and the recommended setup.
The WordPress REST API: what is public and how to restrict it
The /wp-json/wp/v2/users route reveals your authors' usernames. Here is what is public by default and how to restrict it properly.
Wordfence and WP Masquerade: firewall, scanning and a smaller attack surface
Wordfence in detail (firewall, scanning, login, plans), what WP Masquerade adds, the overlapping features to enable in only one plugin and the recommended setup.
All-in-One WP Migration vulnerability probed: update to 7.110
Since September 10, Wordfence has been seeing attempts against CVE-2026-19949, the All-in-One WP Migration SQL injection fixed in 7.110. No compromises have been counted, but the…
TeamUpdraft hacked: backdoors installed through UpdraftPlus
UpdraftCentral keys stolen from TeamUpdraft were used to install backdoored plugins on WordPress sites. Here is how to tell whether yours is affected and what to…
Getting a secure WordPress site ready for GEO: robots.txt, llms.txt and structured data
What Google really says about GEO, the real status of llms.txt, the right use of robots.txt and structured data, and what not to open up to…
Rank Math PRO hacked: version 3.0.123 shipped with a backdoor
For eleven hours, trojanized copies of Rank Math PRO 3.0.123 were distributed by the developer. How to tell whether your site is affected, the published indicators…
Elementor vulnerabilities: exploits and patches since 2020
Elementor has 51 vulnerabilities published since 2020, mostly contributor XSS, but also file uploads leading to code execution. The documented attacks targeted Elementor Pro, up to…
Ocean Extra unauthenticated vulnerability: patch 2.6.1 came first
Disclosed on October 14, 2026, the Ocean Extra vulnerability CVE-2026-86803 allowed unauthenticated shortcode execution. The patch had existed since September 10: who is exposed, how to…
Blocksy Companion vulnerability: Dokan vendor with no account
A Blocksy Companion vulnerability lets an unauthenticated visitor become a Dokan vendor and be logged in automatically. Only Dokan stores are exposed; version 2.1.59 has fixed…
Critical Avada Builder vulnerability: update to 3.16.2 now
On October 9, 2026, Wordfence disclosed a critical vulnerability in Avada Builder: through a form, an unauthenticated visitor can make WordPress run actions, up to emptying…
Scanner bots in your logs: /.env, /phpmyadmin, how to read them and respond
Bots look for /.env, /wp-config.php.bak or /phpmyadmin on every site. Learn to read your logs and turn this noise into a signal.