WordPress REST API: User Enumeration and Exposed Endpoints
What /wp-json/wp/v2/users, ?author=N, sitemaps and oEmbed reveal, how to map plugin routes, and how to limit the user list without breaking the editor.
Read the article
BLOG · WORDPRESS SECURITY
Analysis and deep dives
on WordPress security.
How malware gets in, where it hides and how to really remove it: files, database, cron jobs, processes and logs.
-
-
Two-Factor Authentication on WordPress: TOTP, Passkeys, and Application Passwords
TOTP, passkeys, email codes, and recovery codes: how to protect WordPress logins, and why application passwords bypass the second factor.
Read the article
-
WordPress Theme Malware: functions.php, Modified Templates and Compromised Child Themes
Where malware hides in WordPress themes, why reinstalling the theme is not enough with child themes, and how to compare your files against the originals.
Read the article
-
Files Exposed by Mistake: .git, .zip Backups, wp-config.php.bak and debug.log
.git folders, site archives, copies of wp-config.php and debug.log served to anyone: what they reveal, how to find and block them, and what to do if they were…
Read the article
-
WordPress Security Advisories: Staying Current with Wordfence Intelligence, WPScan, Patchstack and CVE
Wordfence Intelligence, WPScan, Patchstack, CVE and CVSS: how to read an advisory, cross-check it against your installed plugins and get only the alerts that matter.
Read the article
-
WAF for WordPress: what Cloudflare, Sucuri and ModSecurity really protect, and the risks they introduce
Cloud, server and plugin WAFs: what they block, what they cannot see, and how to avoid an exposed origin, spoofable IPs, false positives and cleartext data handed to…
Read the article
-
Read-Only WordPress Site: Making Files Immutable with chattr +i
With chattr +i, core, plugins, and wp-config.php become untouchable for PHP: what to lock, what to leave writable, how to update, and where the lock is not enough.
Read the article
-
After Cleanup: A Hardening Checklist for WordPress, PHP and the Web Server
Updates, credentials and 2FA, one PHP-FPM pool per site, login limits, off-site backups and monitoring: the hardening checklist to follow after a cleanup.
Read the article
-
Log Analysis with Local AI: Qwen and DeepSeek for Reconstructing an Attack
Apache, NGINX, LiteSpeed, and PHP-FPM logs to reconstruct the attack vector, and open Qwen and DeepSeek models run locally to triage anomalous cases.
Read the article
THE NEXT STEP
Is your site
infected?
Every hour counts: the malware keeps hitting visitors and customers, and Google, your host and the blacklists won’t wait. Choose a plan, pay online and share your access: the cleanup starts right away, at a fixed price and with guaranteed times.
Request a cleanupTakes you to the plans: cleanup within 6, 12 or 24 hours of receiving access.
MANAGED SERVER S.R.L.info@malwarecleanup.com +39 02 5656 9681
Monday – Friday · 9:30am – 7:30pm Italian time (CET)
Prefer an online form?
Contact us at managedserver.it ↗
Contact us at managedserver.it ↗