Tag
Keeping a WordPress site from getting hacked.
Website Building
Most compromises come from outdated extensions, weak credentials and abandoned plugins. Fix those three first — the exotic hardening tips matter far less than people claim.
WordPress Tutorials
WordPress auto-updates core, and optionally plugins and themes. Turn off what you genuinely need to control — and keep security releases automatic unless something depends on it.
WordPress Tutorials
One file holds the database credentials, the salts and every constant that changes how WordPress behaves. Know where it lives, what belongs in it, and how to keep it unreadable.
WordPress Tutorials
Roles are named bundles of capabilities, stored per user in the database. Understand the six defaults, then add or restrict capabilities without handing out administrator access.
WordPress Tutorials
Locked out with only database access? Insert a row into wp_users, then two rows into wp_usermeta that grant the administrator role. Both halves are required.
WordPress Tutorials
Five ways in, ordered by how little access they need: the reset email, WP-CLI, phpMyAdmin, a functions.php snippet and a temporary must-use plugin.
Troubleshooting
The warning means the browser did not get a valid certificate, or the page loaded insecure assets. Fix the certificate first, then the mixed content, then force HTTPS everywhere.
Troubleshooting
Cleaning malware is only half the job. Contain the site, replace core and extensions with clean copies, close the entry point, and rotate every credential before going public again.
Website Tools
Inspect response and request headers with browser developer tools or curl to diagnose redirects, caching, content types and common security settings.
Plugins
Use backups, changelog review, staging and focused post-update tests to update WordPress plugins without turning routine maintenance into an outage.
Plugins
Install a WordPress plugin from the official directory, upload a ZIP, use WP-CLI or SFTP, then verify it without creating security or compatibility problems.
Troubleshooting
Log WordPress PHP errors without showing them to visitors, reproduce the problem once, read the relevant entries and disable or secure logging afterward.