Cyber Security
WordPress and server security from the operator side. Malware that scanners miss, hardening that survives an update, and audits run against sites that are actually live.
- Bitwarden Chrome Extension Setup: Install, Autofill, Defaults How to install the Bitwarden Chrome extension, make it the default, turn off Chrome's own saver and autofill your first login, from Bitwarden's help pages.
- WordPress File Permissions That Actually Matter Core does not read 644 or 755 to decide if it can update itself. It compares file owners. Plus the three permission mistakes that end in…
- What a WordPress Backup Has to Contain Before a Restore Will Work UpdraftPlus free does not archive wp-config.php. Read from three plugins' source: what is in the archive, what is not, and the restore rehearsal that finds out.
- Hardening wp-admin: What Actually Costs an Attacker Something Six standard hardening measures ranked by whether they change an attacker's work. Two are real, two depend on implementation, two are mostly noise reduction.
- WordPress Capabilities and Roles, Read From the Source Administrator holds 61 capabilities, editor 34, subscriber 2. And edit_post is not stored anywhere, because map_meta_cap computes it per post at check time.
- WordPress Plugin Supply Chain: What Actually Happened in the Documented Incidents Five incidents with primary sources and dates. In four of them the code was fine and the delivery channel was compromised.
- Why WordPress Malware Scanners Miss Cloaked Spam, and How to Actually Check A scanner reads files on disk. Cloaked spam is a decision made at request time. Here is the mechanism, and the check that settles it.
- Application Passwords in WordPress: The Security Model, and Where It Leaks 24 characters, no scope, no expiry, and an admin key can install plugins over REST. What core actually does, read from the source.
- Reading Your WordPress Access Logs for the Things Scanners Will Not Tell You A scanner reports on files. The access log reports on events. Seven tested queries that separate a real compromise from the daily noise.
- The Scanner Said Clean. The Site Was Serving Spam to Googlebot. A client site was cloaking spam to search engines while every commercial security plugin reported no threats. Why signature scanners miss this, and the agent I…