Server security

Addon domains in the same account, separate accounts under a reseller, Plesk subscriptions and CageFS: where the real boundary between one site and another lies.

Supported PHP versions, the risks of an end-of-life version, and a migration method: PHPCompatibility, a test copy, side-by-side PHP-FPM, and rollback.

The 3-2-1-1-0 rule, pull backups, Object Lock, append-only restic and borg, consistent dumps and restore tests: backups an attacker cannot delete.

A CSP stops skimmers and injected scripts in the browser: how to introduce it in Report-Only, nonces or hashes with WordPress, a wp-admin policy, and what breaks.

What /wp-json/wp/v2/users, ?author=N, sitemaps and oEmbed reveal, how to map plugin routes, and how to limit the user list without breaking the editor.

TOTP, passkeys, email codes, and recovery codes: how to protect WordPress logins, and why application passwords bypass the second factor.

.git folders, site archives, copies of wp-config.php and debug.log served to anyone: what they reveal, how to find and block them, and what to do if they were…

Cloud, server and plugin WAFs: what they block, what they cannot see, and how to avoid an exposed origin, spoofable IPs, false positives and cleartext data handed to…

With chattr +i, core, plugins, and wp-config.php become untouchable for PHP: what to lock, what to leave writable, how to update, and where the lock is not enough.