Category
WordPress
WordPress at scale: performance, Core Web Vitals, the block editor, hosting and the plugin ecosystem, measured on real sites rather than on a staging demo.
- 01 WordPress Plugin Supply Chain: What Actually Happened in the Documented Incidents Five incidents with primary sources and dates. In four of them the code was fine and the delivery channel was compromised.
- 02 Why WordPress Malware Scanners Miss Cloaked Spam, and How to Actually Check A scanner reads files on disk. Cloaked spam is a decision made at request time. Here is the mechanism, and the check that settles it.
- 03 Application Passwords in WordPress: The Security Model, and Where It Leaks 24 characters, no scope, no expiry, and an admin key can install plugins over REST. What core actually does, read from the source.
- 04 Reading Your WordPress Access Logs for the Things Scanners Will Not Tell You A scanner reports on files. The access log reports on events. Seven tested queries that separate a real compromise from the daily noise.
- 05 Structured Data and AI Answers: What Schema Is Actually Doing for You Now Google says schema is not required for generative AI search. What it does document, what practitioners assume, and how to audit your own graph.
- 06 robots.txt for AI Crawlers: The Actual User-Agent Strings, and What Each One Honours GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended and Bingbot, with the real strings and the RFC rule that breaks most AI blocks.
- 07 How to Measure Whether AI Search Sends You Anything Three partial signals and no complete one. Server logs, the new Search Console generative AI report, Bing AI Performance, and each one's limits.
- 08 llms.txt for WordPress: What the Spec Actually Says and Whether Anything Reads It Google says Search does not use llms.txt. What the v2 spec asks for, what WordPress plugins generate instead, and what is still untested.
- 09 Elementor vs Gutenberg in 2026: An Honest Read for People Who Ship WordPress 7.1 loads 140KB of block CSS on every page by default. That is more than Elementor's entire stylesheet. Weight is not the argument.
- 10 Why Elementor Blocks SVG Uploads, and the Security Tradeoff You Are Actually Making I ran Elementor's SVG sanitizer against real payloads. It stops script. It also deletes your blur filters and lets a page-wide style block through.
Agents in Production