Cyber Security
WordPress and server security from the operator side. Malware that scanners miss, hardening that survives an update, and audits run against sites that are actually live.
- Which YubiKey Should I Buy? Models, Prices and Firmware Compared A buying guide from Yubico's own pages: Security Key at $29 or YubiKey 5 at $58, which connector, why two keys, and why firmware matters. Read…
- Bitwarden Chrome Extension Setup: Install, Autofill, Defaults How to install the Bitwarden Chrome extension, make it the default, turn off Chrome's own saver and autofill your first login, from Bitwarden's help pages.
- YubiKey vs Passkey: Why You Are Comparing the Wrong Things A passkey is a credential. A YubiKey is a device that can hold one. Here is what each does, where passkeys can live, and which setup…
- WordPress File Permissions That Actually Matter Core does not read 644 or 755 to decide if it can update itself. It compares file owners. Plus the three permission mistakes that end in…
- What a WordPress Backup Has to Contain Before a Restore Will Work UpdraftPlus free does not archive wp-config.php. Read from three plugins' source: what is in the archive, what is not, and the restore rehearsal that finds out.
- Hardening wp-admin: What Actually Costs an Attacker Something Six standard hardening measures ranked by whether they change an attacker's work. Two are real, two depend on implementation, two are mostly noise reduction.
- WordPress Capabilities and Roles, Read From the Source Administrator holds 61 capabilities, editor 34, subscriber 2. And edit_post is not stored anywhere, because map_meta_cap computes it per post at check time.
- WordPress Plugin Supply Chain: What Actually Happened in the Documented Incidents Five incidents with primary sources and dates. In four of them the code was fine and the delivery channel was compromised.
- Why WordPress Malware Scanners Miss Cloaked Spam, and How to Actually Check A scanner reads files on disk. Cloaked spam is a decision made at request time. Here is the mechanism, and the check that settles it.
- Application Passwords in WordPress: The Security Model, and Where It Leaks 24 characters, no scope, no expiry, and an admin key can install plugins over REST. What core actually does, read from the source.