Everything I
have checked.
- Hardening wp-admin: What Actually Costs an Attacker Something Six standard hardening measures ranked by whether they change an attacker's work. Two are real, two depend on implementation, two are mostly noise reduction.
- Finding the Slow Query in WordPress: EXPLAIN, the Slow Log, and What They Each Miss Rows_sent 12, Rows_examined 138,343. I built the real WordPress schema in Docker and measured what EXPLAIN tells you and what it cannot.
- A CDN for WordPress: What Actually Helps, and the Layer My Own Site Is Failing My HTML is cf-cache-status DYNAMIC at 1.0s. A CSS file on the same domain is HIT at 0.22s. Here is the mechanism and what makes edge…
- AI Memory Platform Comparison: Eleven Projects, Six Columns, Every Cell Sourced LightRAG's own README says its default storage is not for production. Storage, persistence, retrieval, licence and release date for eleven projects.
- WordPress Capabilities and Roles, Read From the Source Administrator holds 61 capabilities, editor 34, subscriber 2. And edit_post is not stored anywhere, because map_meta_cap computes it per post at check time.
- The WordPress Autoload Set: What Loads on Every Request, and the Guard That Usually Does Not Apply The 150,000 byte autoload guard added in 6.6 sits on a filter that four common call styles never reach, and existing 'yes' rows are never re-evaluated.
- WordPress Plugin Supply Chain: What Actually Happened in the Documented Incidents Five incidents with primary sources and dates. In four of them the code was fine and the delivery channel was compromised.
- Why WordPress Malware Scanners Miss Cloaked Spam, and How to Actually Check A scanner reads files on disk. Cloaked spam is a decision made at request time. Here is the mechanism, and the check that settles it.
- Application Passwords in WordPress: The Security Model, and Where It Leaks 24 characters, no scope, no expiry, and an admin key can install plugins over REST. What core actually does, read from the source.
- Reading Your WordPress Access Logs for the Things Scanners Will Not Tell You A scanner reports on files. The access log reports on events. Seven tested queries that separate a real compromise from the daily noise.
- Structured Data and AI Answers: What Schema Is Actually Doing for You Now Google says schema is not required for generative AI search. What it does document, what practitioners assume, and how to audit your own graph.
- robots.txt for AI Crawlers: The Actual User-Agent Strings, and What Each One Honours GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended and Bingbot, with the real strings and the RFC rule that breaks most AI blocks.