---
title: "WordPress security blog"
description: "WordPress security guides and analysis: plugin and PHP vulnerabilities, brute force, hardening, hosting, monitoring. Sourced articles. Read the latest."
language: "en"
locale: "en-US"
type: "blog"
canonical: "https://www.wp-masquerade.com/security-blog/"
published: "2026-10-27T22:18:49+00:00"
modified: "2026-10-28T01:54:40+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/security-blog/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/blog/index.md"
  es-ES: "https://www.wp-masquerade.com/es/blog-seguridad/index.md"
  de-DE: "https://www.wp-masquerade.com/de/sicherheitsblog/index.md"
  it-IT: "https://www.wp-masquerade.com/it/blog-sicurezza/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/blog-seguranca/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/beveiligingsblog/index.md"
---

# WordPress security blog

Recent vulnerabilities, useful settings and best practices for protecting a WordPress site, explained clearly and backed by sources.

- [HTML comments and generator tags: erase the traces of WordPress](https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/) (2026-10-28): Yoast, Site Kit, Elementor and your cache plugin sign your pages, often with their version. What they print, how to remove it, how to check. Markdown: https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/index.md
- [MalCare and WP Masquerade: off-server scanning and locked-down access](https://www.wp-masquerade.com/malcare-and-wp-masquerade/) (2026-10-28): MalCare scans files and database on its servers, WP Masquerade hides WordPress and locks down the login: plans, overlaps and setup. Markdown: https://www.wp-masquerade.com/malcare-and-wp-masquerade/index.md
- [WordPress backups: a 3-2-1 strategy that holds up](https://www.wp-masquerade.com/wordpress-backups-3-2-1-strategy/) (2026-10-27): The 3-2-1 rule applied to WordPress: 3 copies, 2 media, 1 off-site, the right frequency and the restore test that proves it all. Markdown: https://www.wp-masquerade.com/wordpress-backups-3-2-1-strategy/index.md
- [Patchstack and WP Masquerade: virtual patches and less visible plugins](https://www.wp-masquerade.com/patchstack-and-wp-masquerade/) (2026-10-26): Patchstack blocks exploitation of known vulnerabilities, WP Masquerade makes WordPress and its plugins less visible: roles, overlaps and HSTS. Markdown: https://www.wp-masquerade.com/patchstack-and-wp-masquerade/index.md
- [LiteSpeed Cache: two unauthenticated XSS flaws, patch in 7.9.2](https://www.wp-masquerade.com/litespeed-cache-unauthenticated-xss-vulnerabilities/) (2026-10-25): Two stored XSS vulnerabilities rated 7.5 affect LiteSpeed Cache before 7.9.2 through comments. Settings involved, security checks and the patch. Markdown: https://www.wp-masquerade.com/litespeed-cache-unauthenticated-xss-vulnerabilities/index.md
- [WordPress core vulnerabilities: security patches 2020 to 2026](https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/) (2026-10-25): 27 WordPress core security releases since 2020: dates, backports, CVEs, severity, exploited vulnerabilities and the end of support for old branches. Markdown: https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/index.md
- [Sucuri and WP Masquerade: cloud firewall and a hidden WordPress](https://www.wp-masquerade.com/sucuri-and-wp-masquerade/) (2026-10-24): The Sucuri plugin monitors, its firewall filters before the server, WP Masquerade hides WordPress: who does what, and visitors’ real IP. Markdown: https://www.wp-masquerade.com/sucuri-and-wp-masquerade/index.md
- [The WordPress REST API: what is public and how to restrict it](https://www.wp-masquerade.com/wordpress-rest-api-security/) (2026-10-23): The WordPress REST API hands your account list to anonymous visitors. How to restrict it without breaking the block editor. Markdown: https://www.wp-masquerade.com/wordpress-rest-api-security/index.md
- [Wordfence and WP Masquerade: firewall, scanning and a smaller attack surface](https://www.wp-masquerade.com/wordfence-and-wp-masquerade/) (2026-10-22): Wordfence filters and scans, WP Masquerade hides WordPress and closes entry points: what each one covers, and the features to enable only once. Markdown: https://www.wp-masquerade.com/wordfence-and-wp-masquerade/index.md
- [All-in-One WP Migration vulnerability probed: update to 7.110](https://www.wp-masquerade.com/all-in-one-wp-migration-cve-2026-19949-probed/) (2026-10-21): Wordfence saw 1,440 requests targeting the All-in-One WP Migration SQL injection on 881 sites. What is known, how to check, the security patch. Markdown: https://www.wp-masquerade.com/all-in-one-wp-migration-cve-2026-19949-probed/index.md
- [TeamUpdraft hacked: backdoors installed through UpdraftPlus](https://www.wp-masquerade.com/teamupdraft-updraftplus-hack-backdoors/) (2026-10-21): UpdraftCentral keys stolen from TeamUpdraft: who is exposed, how to delete the key, spot backdoored plugins and clean up the hacked site. Markdown: https://www.wp-masquerade.com/teamupdraft-updraftplus-hack-backdoors/index.md
- [Getting a secure WordPress site ready for GEO: robots.txt, llms.txt and structured data](https://www.wp-masquerade.com/geo-secure-wordpress-llms-txt/) (2026-10-21): Be read by AI without exposing WordPress: what Google says about GEO, the real status of llms.txt, robots.txt, structured data and attack surface. Markdown: https://www.wp-masquerade.com/geo-secure-wordpress-llms-txt/index.md
- [Rank Math PRO hacked: version 3.0.123 shipped with a backdoor](https://www.wp-masquerade.com/rank-math-pro-3-0-123-backdoor/) (2026-10-20): Copies of Rank Math PRO 3.0.123 served on October 15 and 16, 2026 contained malware. Who is affected, official IoCs and security cleanup steps. Markdown: https://www.wp-masquerade.com/rank-math-pro-3-0-123-backdoor/index.md
- [Elementor vulnerabilities: exploits and patches since 2020](https://www.wp-masquerade.com/elementor-security-vulnerabilities/) (2026-10-20): Elementor vulnerabilities since 2020: 51 published by WPScan, the most severe ones explained, and the three exploited Elementor Pro vulnerabilities. Markdown: https://www.wp-masquerade.com/elementor-security-vulnerabilities/index.md
- [Ocean Extra unauthenticated vulnerability: patch 2.6.1 came first](https://www.wp-masquerade.com/ocean-extra-vulnerability-cve-2026-86803/) (2026-10-19): Ocean Extra up to 2.6.0 let visitors run shortcodes (CVE-2026-86803). Patched in 2.6.1 back in September: versions, security checks, actions. Markdown: https://www.wp-masquerade.com/ocean-extra-vulnerability-cve-2026-86803/index.md
- [Blocksy Companion vulnerability: Dokan vendor with no account](https://www.wp-masquerade.com/blocksy-companion-vulnerability-cve-2026-107645/) (2026-10-19): CVE-2026-107645: Blocksy Companion up to 2.1.58 lets a visitor become a Dokan vendor. Who is exposed, 9.1 or 4.8, and what to check. Markdown: https://www.wp-masquerade.com/blocksy-companion-vulnerability-cve-2026-107645/index.md
- [Critical Avada Builder vulnerability: update to 3.16.2 now](https://www.wp-masquerade.com/avada-builder-vulnerability-cve-2026-97670/) (2026-10-19): CVE-2026-97670 (9.1): an Avada form lets anonymous visitors run WordPress actions. Affected versions, security checks and the 3.16.2 patch. Markdown: https://www.wp-masquerade.com/avada-builder-vulnerability-cve-2026-97670/index.md
- [Scanner bots in your logs: /.env, /phpmyadmin, how to read them and respond](https://www.wp-masquerade.com/scanner-bots-in-your-logs/) (2026-10-19): Your logs are full of requests for /.env or /phpmyadmin. How to tell background noise from a real leak and respond without drowning. Markdown: https://www.wp-masquerade.com/scanner-bots-in-your-logs/index.md
- [LiteSpeed Cache vulnerabilities: history and exploits since 2020](https://www.wp-masquerade.com/litespeed-cache-security-vulnerabilities/) (2026-10-18): The 23 LiteSpeed Cache vulnerabilities from 2020 to October 2026: CVE-2023-40000, CVE-2024-28000 and CVE-2024-44000 exploited, fixed versions. Markdown: https://www.wp-masquerade.com/litespeed-cache-security-vulnerabilities/index.md
- [HTTPS, HSTS and security headers: what Google really takes into account](https://www.wp-masquerade.com/https-security-headers-seo-trust/) (2026-10-17): HTTPS is a light signal, security headers are not one at all. What Google documents, Core Web Vitals, HSTS and the mistakes that cost traffic. Markdown: https://www.wp-masquerade.com/https-security-headers-seo-trust/index.md
- [WPForms vulnerabilities: every security flaw and its patch](https://www.wp-masquerade.com/wpforms-security-vulnerabilities/) (2026-10-16): WPForms: 24 vulnerabilities published since 2020, including CVE-2024-11205 and the 2026 Stripe and PayPal payment flaws, fixed versions and protection. Markdown: https://www.wp-masquerade.com/wpforms-security-vulnerabilities/index.md
- [WordPress file permissions: 644, 755 and the wp-config.php case](https://www.wp-masquerade.com/wordpress-file-permissions/) (2026-10-15): WordPress file permissions: what 644 and 755 mean, why wp-config.php should be 400 or 440, and the values (like 777) you should never use. Markdown: https://www.wp-masquerade.com/wordpress-file-permissions/index.md
- [Every WooCommerce vulnerability since 2020: exploits and patches](https://www.wp-masquerade.com/woocommerce-security-vulnerabilities/) (2026-10-14): WooCommerce vulnerabilities from 2020 to 2026: the 2021 SQL injection and forced update, Store API, Shop Manager, fixed versions and protection. Markdown: https://www.wp-masquerade.com/woocommerce-security-vulnerabilities/index.md
- [Hiding WordPress and changing addresses: the real effects on SEO](https://www.wp-masquerade.com/hide-wordpress-seo-impact/) (2026-10-13): Does hiding WordPress affect SEO? Permalinks, canonical, images, cache, sitemaps: what changes, what does not, and the precautions to take. Markdown: https://www.wp-masquerade.com/hide-wordpress-seo-impact/index.md
- [PlanetHoster WordPress hosting review: The World plans and security](https://www.wp-masquerade.com/planethoster-wordpress-hosting-review/) (2026-10-12): PlanetHoster for WordPress: The World Web Projects, HybridCloud, prices without promotions, N0C panel, security, strengths, limits and first settings. Markdown: https://www.wp-masquerade.com/planethoster-wordpress-hosting-review/index.md
- [Jetpack security vulnerabilities: history and forced patches](https://www.wp-masquerade.com/jetpack-security-vulnerabilities/) (2026-10-12): Every Jetpack vulnerability since 2020: CVEs, affected versions, 102 then 101 versions patched at once, forced updates and how to protect your site. Markdown: https://www.wp-masquerade.com/jetpack-security-vulnerabilities/index.md
- [Really Simple Security CVE-2024-10924: the flaw that bypassed 2FA](https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/) (2026-10-11): CVE-2024-10924: a critical authentication bypass in Really Simple Security. Root cause, timeline and what this flaw reveals about 2FA. Markdown: https://www.wp-masquerade.com/really-simple-security-cve-2024-10924-2fa-bypass/index.md
- [Rank Math security vulnerabilities: the timeline since 2020](https://www.wp-masquerade.com/rank-math-security-vulnerabilities/) (2026-10-10): Unauthenticated privilege escalation in 2020, code execution, a burst of flaws in 2026: the verified Rank Math SEO history and how to protect your site. Markdown: https://www.wp-masquerade.com/rank-math-security-vulnerabilities/index.md
- [AI crawlers (GPTBot, ClaudeBot, PerplexityBot): allow them or block them?](https://www.wp-masquerade.com/ai-crawlers-gptbot-claudebot-block/) (2026-10-09): Training, AI search or on-demand visits: what GPTBot, ClaudeBot, PerplexityBot, Google-Extended and Applebot do, and the effect of blocking them. Markdown: https://www.wp-masquerade.com/ai-crawlers-gptbot-claudebot-block/index.md
- [All in One SEO vulnerabilities: exploits and patches since 2020](https://www.wp-masquerade.com/all-in-one-seo-security-vulnerabilities/) (2026-10-08): The 2021 privilege escalation, SQL injections, flaws in the AI features: the verified All in One SEO vulnerability timeline and how to protect your site. Markdown: https://www.wp-masquerade.com/all-in-one-seo-security-vulnerabilities/index.md
- [Cleaning up a hacked WordPress site: the step-by-step procedure](https://www.wp-masquerade.com/clean-hacked-wordpress-site/) (2026-10-07): Isolate, preserve evidence, regain access, clean up, find the flaw, reopen: the complete procedure after a WordPress hack. Markdown: https://www.wp-masquerade.com/clean-hacked-wordpress-site/index.md
- [Astra theme security: every vulnerability since 2020](https://www.wp-masquerade.com/astra-theme-security-vulnerabilities/) (2026-10-06): The Astra theme has only 4 vulnerabilities since 2020. The Brainstorm Force plugins installed with it have had far more severe ones: the full record. Markdown: https://www.wp-masquerade.com/astra-theme-security-vulnerabilities/index.md
- [Site flagged as dangerous by Google: understanding Safe Browsing and getting off the list](https://www.wp-masquerade.com/google-dangerous-site-warning/) (2026-10-05): Red screen, warning in Google: causes of a Safe Browsing flag, browsers affected, reviews at Google, Microsoft and Bing, stated time frames. Markdown: https://www.wp-masquerade.com/google-dangerous-site-warning/index.md
- [Avada and Avada Builder: vulnerabilities and patches since 2020](https://www.wp-masquerade.com/avada-theme-security-vulnerabilities/) (2026-10-04): 51 vulnerabilities in Avada, Avada Builder and Avada Core since 2020, including unauthenticated code execution in 2026: timeline and safe versions. Markdown: https://www.wp-masquerade.com/avada-theme-security-vulnerabilities/index.md
- [Cloudflare in front of WordPress: real IP, WAF and mistakes to avoid](https://www.wp-masquerade.com/cloudflare-wordpress-real-visitor-ip/) (2026-10-03): Behind Cloudflare, WordPress sees the wrong IPs. Restore CF-Connecting-IP safely, protect the origin and write useful WAF rules. Markdown: https://www.wp-masquerade.com/cloudflare-wordpress-real-visitor-ip/index.md
- [Divi theme: security vulnerability history and fixes](https://www.wp-masquerade.com/divi-theme-security-vulnerabilities/) (2026-10-02): The 14 Divi theme vulnerabilities published since 2020: Divi, Extra and Divi Builder affected, Divi 5, fixed versions and the role of the license. Markdown: https://www.wp-masquerade.com/divi-theme-security-vulnerabilities/index.md
- [Hacked WordPress site and SEO: spam, deindexing and review](https://www.wp-masquerade.com/hacked-wordpress-site-seo-spam-deindexing/) (2026-10-01): Japanese keyword hack, pharma spam, cloaking: how a hacked WordPress site loses its rankings, and how to get Google to review it. Markdown: https://www.wp-masquerade.com/hacked-wordpress-site-seo-spam-deindexing/index.md
- [Infomaniak WordPress hosting review: Swiss plans, prices and security](https://www.wp-masquerade.com/infomaniak-wordpress-hosting-review/) (2026-09-30): Infomaniak for WordPress: plans and prices in Swiss francs, data centers in Switzerland, ModSecurity, backups, limits and WP Masquerade settings. Markdown: https://www.wp-masquerade.com/infomaniak-wordpress-hosting-review/index.md
- [PHP deserialization and object injection explained](https://www.wp-masquerade.com/php-deserialization-object-injection/) (2026-09-29): PHP object injection explained: how unserialize() and POP chains lead to code execution, with real WordPress cases and the defenses that work. Read on. Markdown: https://www.wp-masquerade.com/php-deserialization-object-injection/index.md
- [Really Simple Security vulnerabilities and patches since 2024](https://www.wp-masquerade.com/really-simple-security-vulnerabilities/) (2026-09-27): The 13 Really Simple Security (formerly Really Simple SSL) vulnerabilities from 2024 to September 2026: CVE-2024-10924, 2FA bypasses, fixed versions. Markdown: https://www.wp-masquerade.com/really-simple-security-vulnerabilities/index.md
- [Changing the wp-login.php URL: real benefits and pitfalls](https://www.wp-masquerade.com/change-wp-login-url/) (2026-09-25): Changing the WordPress login URL cuts bot traffic. The doors left open, caching, WooCommerce, lost passwords: how to do it safely. Markdown: https://www.wp-masquerade.com/change-wp-login-url/index.md
- [All-in-One WP Migration vulnerabilities, exploits, patches](https://www.wp-masquerade.com/all-in-one-wp-migration-security-vulnerabilities/) (2026-09-23): The 13 All-in-One WP Migration vulnerabilities published since 2020, the August 2026 SQL injection, the cloud extensions hit in 2023 and safe versions. Markdown: https://www.wp-masquerade.com/all-in-one-wp-migration-security-vulnerabilities/index.md
- [WooCommerce Payments CVE-2023-28121: the header that unlocked the admin](https://www.wp-masquerade.com/woocommerce-payments-cve-2023-28121-explained/) (2026-09-21): CVE-2023-28121: one HTTP header let attackers impersonate a WooCommerce store admin. How it worked, the timeline, and what to check. Markdown: https://www.wp-masquerade.com/woocommerce-payments-cve-2023-28121-explained/index.md
- [Kinsta WordPress hosting review: managed hosting, prices and security](https://www.wp-masquerade.com/kinsta-wordpress-hosting-review/) (2026-09-18): Kinsta for WordPress: plans and prices, Nginx and Cloudflare, banned plugins, backups, security and WP Masquerade settings. Markdown: https://www.wp-masquerade.com/kinsta-wordpress-hosting-review/index.md
- [Has my WordPress site been hacked? Signs, checks and tools](https://www.wp-masquerade.com/wordpress-site-hacked-signs/) (2026-09-17): Redirects, indexed spam, unknown admin: the signs of a hacked WordPress site and the WP-CLI, Search Console and log checks to confirm it. Markdown: https://www.wp-masquerade.com/wordpress-site-hacked-signs/index.md
- [Site Kit by Google vulnerabilities: the history since 2020](https://www.wp-masquerade.com/site-kit-by-google-security-vulnerabilities/) (2026-09-15): Site Kit by Google: 3 vulnerabilities since 2020, including the one that gave a subscriber the Search Console, what the plugin stores and how to stay safe. Markdown: https://www.wp-masquerade.com/site-kit-by-google-security-vulnerabilities/index.md
- [How to set up HTTP security headers on WordPress: CSP, HSTS and the rest](https://www.wp-masquerade.com/http-security-headers-wordpress/) (2026-09-13): CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy: what WordPress already sends, safe values and how to test them. Markdown: https://www.wp-masquerade.com/http-security-headers-wordpress/index.md
- [Ultimate Member CVE-2023-3460: administrators created through the registration form](https://www.wp-masquerade.com/ultimate-member-cve-2023-3460-administrators/) (2026-09-09): CVE-2023-3460: how Ultimate Member let attackers create administrators, the timeline, the indicators to check and the lessons learned. Markdown: https://www.wp-masquerade.com/ultimate-member-cve-2023-3460-administrators/index.md
- [How bots and detection tools recognize WordPress, and which clues to remove](https://www.wp-masquerade.com/wordpress-fingerprinting-detection/) (2026-09-05): Generator tag, wp-content paths, headers, JavaScript, readme.txt: the signals that give WordPress away and how to reduce them. Markdown: https://www.wp-masquerade.com/wordpress-fingerprinting-detection/index.md
- [o2switch WordPress hosting review: plans, prices and security](https://www.wp-masquerade.com/o2switch-wordpress-hosting-review/) (2026-09-04): o2switch for WordPress: Grow., Cloud. and Pro. plans, real renewal prices, TigerProtect, backups, WPTiger, strengths and limits. Markdown: https://www.wp-masquerade.com/o2switch-wordpress-hosting-review/index.md
- [CVE-2024-2961: the glibc iconv flaw that targets PHP](https://www.wp-masquerade.com/glibc-iconv-cve-2024-2961-php-flaw/) (2026-09-01): CVE-2024-2961: the glibc iconv flaw that turns a PHP file read into code execution. Who is affected, versions and fixes. Markdown: https://www.wp-masquerade.com/glibc-iconv-cve-2024-2961-php-flaw/index.md
- [How to migrate a WordPress site to a new host without downtime](https://www.wp-masquerade.com/migrate-wordpress-to-new-host/) (2026-08-30): Moving WordPress from one host to another: timeline, TTL, copy, hosts file test, DNS switch, checks, SEO and a rollback plan. Markdown: https://www.wp-masquerade.com/migrate-wordpress-to-new-host/index.md
- [How to choose and roll out two-factor authentication on WordPress](https://www.wp-masquerade.com/wordpress-two-factor-authentication/) (2026-08-28): TOTP, backup codes, passkeys, email or SMS: which two-factor authentication to choose for WordPress and how to roll it out by role. Markdown: https://www.wp-masquerade.com/wordpress-two-factor-authentication/index.md
- [Hostinger WordPress hosting review: real prices, plans and security](https://www.wp-masquerade.com/hostinger-wordpress-hosting-review/) (2026-08-25): Hostinger for WordPress: plans, renewal prices, LiteSpeed, data centers, built-in security and the first settings to get started safely. Markdown: https://www.wp-masquerade.com/hostinger-wordpress-hosting-review/index.md
- [wp-config.php: the security settings that really matter](https://www.wp-masquerade.com/wp-config-security-settings/) (2026-08-24): Keys and salts, DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS, FORCE_SSL_ADMIN, WP_DEBUG in production, file location: what protects and what backfires. Markdown: https://www.wp-masquerade.com/wp-config-security-settings/index.md
- [How to duplicate a WordPress site: tools, manual method and pitfalls](https://www.wp-masquerade.com/duplicate-wordpress-site/) (2026-08-24): Duplicate a WordPress site with Duplicator, All-in-One WP Migration, WPvivid or WP-CLI: tools compared, serialized data and what to switch off. Markdown: https://www.wp-masquerade.com/duplicate-wordpress-site/index.md
- [UpdraftPlus vulnerabilities: backup security flaws since 2021](https://www.wp-masquerade.com/updraftplus-security-vulnerabilities/) (2026-08-22): The 11 UpdraftPlus vulnerabilities published since 2020: backups downloadable by a subscriber in 2022, UpdraftCentral bypassed in 2026, safe versions. Markdown: https://www.wp-masquerade.com/updraftplus-security-vulnerabilities/index.md
- [How to limit login attempts on WordPress: thresholds, durations and pitfalls](https://www.wp-masquerade.com/limit-login-attempts-wordpress/) (2026-08-20): Threshold, duration, counting by IP or by account, proxies and shared IPs: set up WordPress login limiting without locking out your users. Markdown: https://www.wp-masquerade.com/limit-login-attempts-wordpress/index.md
- [WordPress cookie consent plugins compared: which one to choose?](https://www.wp-masquerade.com/wordpress-cookie-consent-plugins-compared/) (2026-08-18): Complianz, CookieYes, Borlabs, Real Cookie Banner, tarteaucitron, Axeptio, iubenda: Consent Mode v2, TCF, proof of consent, prices and picks. Markdown: https://www.wp-masquerade.com/wordpress-cookie-consent-plugins-compared/index.md
- [LiteSpeed Cache: the 2024 privilege escalation flaws](https://www.wp-masquerade.com/litespeed-cache-privilege-escalation-flaws/) (2026-08-16): CVE-2024-28000, CVE-2024-44000, CVE-2024-50550: what made LiteSpeed Cache vulnerable, who was exposed, fixed versions and what to check. Markdown: https://www.wp-masquerade.com/litespeed-cache-privilege-escalation-flaws/index.md
- [Amen WordPress hosting review: plans, prices and security](https://www.wp-masquerade.com/amen-wordpress-hosting-review/) (2026-08-13): WordPress hosting at Amen: plans and prices without promotions, managed WordPress option, backups, security, limits and WP Masquerade settings. Markdown: https://www.wp-masquerade.com/amen-wordpress-hosting-review/index.md
- [End-of-life PHP versions: schedule, risks and migration](https://www.wp-masquerade.com/end-of-life-php-versions/) (2026-08-12): PHP 8.1 gets no more fixes and PHP 8.2 ends in late 2026. The official schedule, real risks for a WordPress site and a safe migration path. Markdown: https://www.wp-masquerade.com/end-of-life-php-versions/index.md
- [Understanding WordPress errors and debugging your site](https://www.wp-masquerade.com/wordpress-errors-debugging-guide/) (2026-08-12): White screen, critical error, 500, database, memory, stuck maintenance: understand WordPress errors, recovery mode and WP_DEBUG, and debug your site safely. Markdown: https://www.wp-masquerade.com/wordpress-errors-debugging-guide/index.md
- [How to disable XML-RPC on WordPress: risks, uses and the right method](https://www.wp-masquerade.com/wordpress-xml-rpc-risks/) (2026-08-08): xmlrpc.php on WordPress: what it is still used for, brute force and pingback risks, what closing it breaks (Jetpack, apps) and the right method. Markdown: https://www.wp-masquerade.com/wordpress-xml-rpc-risks/index.md
- [Yoast SEO vulnerabilities: security history since 2020](https://www.wp-masquerade.com/yoast-seo-security-vulnerabilities/) (2026-08-06): Every Yoast SEO and Yoast SEO Premium vulnerability published since 2020: affected versions, patches, CVSS scores and how to protect your site. Markdown: https://www.wp-masquerade.com/yoast-seo-security-vulnerabilities/index.md
- [WordPress maintenance contract: scope, pricing and pitfalls to avoid](https://www.wp-masquerade.com/wordpress-maintenance-contract-pricing/) (2026-08-06): WordPress maintenance contract: what it should include, prices observed in France, guaranteed response time (SLA), red flags and how to choose a provider. Markdown: https://www.wp-masquerade.com/wordpress-maintenance-contract-pricing/index.md
- [WordPress plugin vulnerabilities by the numbers](https://www.wp-masquerade.com/wordpress-plugin-vulnerabilities-statistics/) (2026-08-04): 11,334 vulnerabilities in 2025, 91% in plugins, 46% unpatched at disclosure: what the Patchstack and Wordfence reports really say and what to do. Markdown: https://www.wp-masquerade.com/wordpress-plugin-vulnerabilities-statistics/index.md
- [LWS WordPress hosting review: plans, real prices and security](https://www.wp-masquerade.com/lws-wordpress-hosting-review/) (2026-08-02): LWS for WordPress: Perso, Starter and Performance plans, real prices without the discount, limits, WP Manager, security and first settings. Markdown: https://www.wp-masquerade.com/lws-wordpress-hosting-review/index.md
- [How to stop WordPress user enumeration](https://www.wp-masquerade.com/wordpress-user-enumeration/) (2026-07-31): ?author=, REST API, sitemap, oEmbed, error messages: where WordPress usernames leak, how to check your own site and the defenses that work. Markdown: https://www.wp-masquerade.com/wordpress-user-enumeration/index.md
- [Building a WordPress site with online booking: plugins and best practices](https://www.wp-masquerade.com/wordpress-booking-website-plugins/) (2026-07-31): Build a WordPress booking website: Amelia, Bookly, FluentBooking and WooCommerce Bookings compared, plus payments, GDPR, caching and security. Markdown: https://www.wp-masquerade.com/wordpress-booking-website-plugins/index.md
- [Ultimate Addons for Elementor vulnerabilities since 2021](https://www.wp-masquerade.com/ultimate-addons-elementor-security-vulnerabilities/) (2026-07-29): The 13 vulnerabilities in the free Ultimate Addons for Elementor plugin, the fixed versions and the 2020 attack exploiting its premium version. Markdown: https://www.wp-masquerade.com/ultimate-addons-elementor-security-vulnerabilities/index.md
- [CVE-2024-4577: the PHP-CGI flaw on Windows explained](https://www.wp-masquerade.com/php-cgi-cve-2024-4577-windows-flaw/) (2026-07-27): CVE-2024-4577: who is affected (PHP-CGI on Windows, XAMPP), mass exploitation, fixed versions and what to check on a WordPress site. Markdown: https://www.wp-masquerade.com/php-cgi-cve-2024-4577-windows-flaw/index.md
- [Build a WordPress membership site and manage roles and users](https://www.wp-masquerade.com/wordpress-membership-site-roles-users/) (2026-07-25): How to build a WordPress membership site: plugins compared with prices, roles vs membership levels, spam-free registration and two-factor authentication. Markdown: https://www.wp-masquerade.com/wordpress-membership-site-roles-users/index.md
- [How to spot and stop a brute force attack on WordPress](https://www.wp-masquerade.com/wordpress-brute-force-attacks-explained/) (2026-07-23): A guide to spotting brute force attacks on WordPress in your logs (dictionary, credential stuffing, botnets) and the protections that stop them. Markdown: https://www.wp-masquerade.com/wordpress-brute-force-attacks-explained/index.md
- [IONOS WordPress hosting review: plans, real prices and security](https://www.wp-masquerade.com/ionos-wordpress-hosting-review/) (2026-07-22): WordPress hosting at IONOS: Start to E-Commerce plans, prices after the promotion, automatic updates, vulnerability scanning, backups and settings. Markdown: https://www.wp-masquerade.com/ionos-wordpress-hosting-review/index.md
- [WordPress site audit: the 12 key checks](https://www.wp-masquerade.com/wordpress-site-audit-checklist/) (2026-07-19): WordPress site audit checklist: speed, mobile, SSL, updates, plugins, sitemap, 404s, cookies, backups, security, accessibility and logs. Markdown: https://www.wp-masquerade.com/wordpress-site-audit-checklist/index.md
- [Blocksy theme and Blocksy Companion vulnerabilities since 2020](https://www.wp-masquerade.com/blocksy-theme-security-vulnerabilities/) (2026-07-14): The 14 Blocksy theme vulnerabilities since 2020, those in Blocksy Companion and the critical Companion Pro flaws of 2026, with the safe versions. Markdown: https://www.wp-masquerade.com/blocksy-theme-security-vulnerabilities/index.md
- [WordPress site hacked: how to respond and fix it](https://www.wp-masquerade.com/wordpress-site-hacked-what-to-do/) (2026-07-13): WordPress site hacked: contain the attack, copy the hacked state, regain access, repair, get off blocklists and notify your regulator within 72 hours. Markdown: https://www.wp-masquerade.com/wordpress-site-hacked-what-to-do/index.md
- [DreamHost WordPress hosting review: DreamPress prices and security](https://www.wp-masquerade.com/dreamhost-wordpress-hosting-review/) (2026-07-11): DreamHost for WordPress: shared hosting, DreamPress, VPS, renewal prices, mod_security, backups, incidents and WP Masquerade settings. Markdown: https://www.wp-masquerade.com/dreamhost-wordpress-hosting-review/index.md
- [ACF security vulnerabilities: timeline, exploits and patches](https://www.wp-masquerade.com/advanced-custom-fields-security-vulnerabilities/) (2026-07-07): Advanced Custom Fields: 18 vulnerabilities with a CVE since 2020, the XSS attacked in 2023, the 2024 Secure Custom Fields fork and how to protect sites. Markdown: https://www.wp-masquerade.com/advanced-custom-fields-security-vulnerabilities/index.md
- [Connect Claude Desktop to WordPress MCP: the step-by-step guide](https://www.wp-masquerade.com/connect-claude-desktop-wordpress-mcp/) (2026-07-07): MCP Adapter, application password, claude_desktop_config.json, curl test, troubleshooting and security: connect Claude Desktop to your WordPress site. Markdown: https://www.wp-masquerade.com/connect-claude-desktop-wordpress-mcp/index.md
- [Scaleway and Online.net (Dedibox) WordPress hosting: plans and security](https://www.wp-masquerade.com/scaleway-online-net-wordpress-hosting-review/) (2026-07-01): WordPress hosting at Scaleway, formerly Online.net: what became of Dedibox and web hosting, plans, prices excl. VAT, technical setup and security. Markdown: https://www.wp-masquerade.com/scaleway-online-net-wordpress-hosting-review/index.md
- [How to install WordPress multisite and create a network of sites](https://www.wp-masquerade.com/install-wordpress-multisite-network/) (2026-07-01): Create a WordPress multisite network: subdomains or subdirectories, wp-config.php, .htaccess, domains, plugins, backups, pros and risks. Markdown: https://www.wp-masquerade.com/install-wordpress-multisite-network/index.md
- [Popular WordPress themes: few vulnerabilities, but their plugins?](https://www.wp-masquerade.com/popular-wordpress-themes-security-vulnerabilities/) (2026-06-30): Hello Elementor, Kadence, GeneratePress, Neve, Twenty Twenty-Five: almost no vulnerabilities since 2020. Why, and the flaws in their companion plugins. Markdown: https://www.wp-masquerade.com/popular-wordpress-themes-security-vulnerabilities/index.md
- [The best WordPress page builders compared: Gutenberg, Elementor, Divi, Bricks and more](https://www.wp-masquerade.com/best-wordpress-page-builders-compared/) (2026-06-25): Gutenberg, Elementor, Divi, Bricks, Breakdance, Beaver Builder: price, performance, lock-in and vulnerabilities compared, and the right pick for your profile. Markdown: https://www.wp-masquerade.com/best-wordpress-page-builders-compared/index.md
- [OVHcloud WordPress hosting review: plans, real prices and security](https://www.wp-masquerade.com/ovhcloud-wordpress-hosting-review/) (2026-06-19): WordPress hosting at OVHcloud: shared and managed plans, real prices without promotions, Apache and PHP, backups, security and first settings. Markdown: https://www.wp-masquerade.com/ovhcloud-wordpress-hosting-review/index.md
- [How to choose a WordPress theme: 7 criteria and a scoring grid](https://www.wp-masquerade.com/how-to-choose-wordpress-theme/) (2026-06-19): Block or classic theme, performance, code, compatibility, mobile, updates, security: the method and the 100-point grid to choose a WordPress theme. Markdown: https://www.wp-masquerade.com/how-to-choose-wordpress-theme/index.md
- [OceanWP theme: vulnerability history and patches](https://www.wp-masquerade.com/oceanwp-theme-security-vulnerabilities/) (2026-06-16): The 6 vulnerabilities in the OceanWP theme and the 20 in its Ocean Extra plugin since 2020: affected versions, patches, fix times and protections. Markdown: https://www.wp-masquerade.com/oceanwp-theme-security-vulnerabilities/index.md
- [MCP in WordPress: what the Model Context Protocol changes and how to make the most of it](https://www.wp-masquerade.com/wordpress-mcp-model-context-protocol/) (2026-06-13): Abilities API, MCP Adapter, WordPress.com: what MCP really lets you do on WordPress in 2026, the use cases worth it and the risks to control. Markdown: https://www.wp-masquerade.com/wordpress-mcp-model-context-protocol/index.md
- [EasyHoster WordPress hosting review: plans, prices and security](https://www.wp-masquerade.com/easyhoster-wordpress-hosting-review/) (2026-06-08): WordPress hosting at EasyHoster: the company, OVHcloud servers, cPanel plans and prices, Imunify360, the April 2026 incident and WP Masquerade settings. Markdown: https://www.wp-masquerade.com/easyhoster-wordpress-hosting-review/index.md
- [How to secure the WordPress login page: the complete guide](https://www.wp-masquerade.com/secure-wordpress-login-page/) (2026-06-07): Passwords, 2FA, login attempt limits, a moved URL, XML-RPC: the 7 protections for the WordPress login, ranked by priority and by type of site. Markdown: https://www.wp-masquerade.com/secure-wordpress-login-page/index.md
- [Contact Form 7 vulnerabilities: history and patches](https://www.wp-masquerade.com/contact-form-7-security-vulnerabilities/) (2026-06-02): Contact Form 7: the 5 vulnerabilities published since 2020, including CVE-2020-35489, how they work, the fixed versions and how to protect your forms. Markdown: https://www.wp-masquerade.com/contact-form-7-security-vulnerabilities/index.md
- [The best WordPress image optimization plugins in 2026](https://www.wp-masquerade.com/best-wordpress-image-optimization-plugins/) (2026-06-01): Imagify, ShortPixel, EWWW, Optimole, Smush, Converter for Media: compression, WebP and AVIF, CDN, quotas and prices compared to pick your image plugin. Markdown: https://www.wp-masquerade.com/best-wordpress-image-optimization-plugins/index.md
- [GoDaddy WordPress hosting review: plans, real prices and security](https://www.wp-masquerade.com/godaddy-wordpress-hosting-review/) (2026-05-27): WordPress hosting at GoDaddy: managed plans, real prices without promotions, Nginx platform, declared security incidents and settings to plan for. Markdown: https://www.wp-masquerade.com/godaddy-wordpress-hosting-review/index.md
- [The danger of abandoned WordPress plugins: real cases and defences](https://www.wp-masquerade.com/abandoned-wordpress-plugins-danger/) (2026-05-26): Abandoned, closed or sold WordPress plugins: why they put your site at risk, three real cases, the command to find them and a decision grid. Markdown: https://www.wp-masquerade.com/abandoned-wordpress-plugins-danger/index.md
- [How to optimize WordPress SEO: the practical guide](https://www.wp-masquerade.com/optimize-wordpress-seo-guide/) (2026-05-20): Optimize WordPress SEO: core settings, SEO plugin, search intent, internal linking, speed, structured data, noindex and security, with a 90-day plan. Markdown: https://www.wp-masquerade.com/optimize-wordpress-seo-guide/index.md
- [HostGator WordPress hosting review: renewal prices and security](https://www.wp-masquerade.com/hostgator-wordpress-hosting-review/) (2026-05-16): HostGator for WordPress: plans, renewal prices in dollars, servers in the United States, backups, security, and what to know for a European site. Markdown: https://www.wp-masquerade.com/hostgator-wordpress-hosting-review/index.md
- [How to tell if my WordPress site is hacked: 8 infections to hunt down](https://www.wp-masquerade.com/detect-hacked-wordpress-site/) (2026-05-14): Japanese spam, mobile redirects, PHP in uploads, hidden admins, cron, database: how to detect each WordPress infection, with the commands to run. Markdown: https://www.wp-masquerade.com/detect-hacked-wordpress-site/index.md
- [How to run a WordPress SEO audit: 6-step method and tools](https://www.wp-masquerade.com/wordpress-seo-audit/) (2026-05-08): Run a WordPress SEO audit in 6 steps: indexing, crawl, Core Web Vitals, content, internal links and security. Free tools, common mistakes, priorities. Markdown: https://www.wp-masquerade.com/wordpress-seo-audit/index.md
- [Bluehost WordPress hosting review: plans in euros, backups and security](https://www.wp-masquerade.com/bluehost-wordpress-hosting-review/) (2026-05-05): Bluehost for WordPress: plans and renewal prices in euros, data centers in Paris, backups, English-language support and security. Markdown: https://www.wp-masquerade.com/bluehost-wordpress-hosting-review/index.md
- [How to secure a WordPress site: the complete 7-layer method](https://www.wp-masquerade.com/how-to-secure-wordpress-site/) (2026-05-02): Secure WordPress in the right order: hosting, access, updates, attack surface, monitoring, backups and response. Method, priorities and a 30-day plan. Markdown: https://www.wp-masquerade.com/how-to-secure-wordpress-site/index.md