Tag
Keeping a WordPress site from getting hacked.
Troubleshooting
Current WordPress prints "Sorry, you are not allowed to upload this file type"; the older wording still fills tutorials and old installs. Both come from the same check, and the fix depends on whether the type is disallowed or the file is not what its extension says.
WordPress Tutorials
The filter receives a context, and the context is the whole point: widening the post context affects every call to wp_kses_post across the site, including places that trusted it to strip exactly what you just allowed.
WordPress Tutorials
The filter receives the user on success and a WP_Error on failure, and every role-based snippet that forgets the second case throws a fatal error on a wrong password. It also only covers the standard login form, which is not the form most plugins use.
WordPress Tutorials
The constant governs core and only core. Setting it to false stops security releases arriving on their own, which is a decision worth making deliberately rather than inheriting from a snippet.
WordPress Tutorials
One line removes the built-in code editor from the dashboard. It does not stop an administrator installing a plugin that edits the same files, which is why it is a hardening step rather than a lock.
WordPress Tutorials
Adding a type to this array is half the job. WordPress checks the real contents of the file separately, and a file whose innards do not match its extension is rejected even after the type is allowed.
WordPress Tutorials
WordPress does this without a plugin, in about fifteen seconds. What matters is knowing exactly what that protection covers, because it does not cover the images on the page.
WordPress Tutorials
Two separate jobs get conflated here: putting a certificate on the server, and telling WordPress to use it. The second one is where sites break, and a plugin only papers over it.
Troubleshooting
Removing malware is the easy half. The half people skip is proving it is gone, and every scanner type is blind to something the others catch.
Website Tools
Automation platforms let a form submission become a CRM record, an invoice and a calendar event without a developer. They also put business logic somewhere nobody documents and everybody forgets.
Plugins
MainWP is a self-hosted dashboard that updates, backs up and monitors your other WordPress sites. Owning the dashboard is the point, and it is also the risk you take on.
Plugins
Forminator gives away features that competing form plugins charge for — payments, calculations, quizzes and polls — and stores every submission in your database, which is a benefit and an obligation.