Blog · Field-tested knowledge
Field-informed articles about malware behavior, hacked-site recovery, WordPress errors, maintenance, development, and safer website ownership.
Bricksforge CVE-2026-85097 was exploited to upload files without authentication. Check affected versions, suspicious uploads, users, and persistence.
Read blogUpdraftCentral security incident: check revoked keys, hidden plugins and admin accounts, then follow a practical WordPress backdoor cleanup checklist.
Read blogTwo critical PHP vulnerabilities have triggered an emergency security response across the internet. Government agencies in several European countries have temporarily taken websites offline, while security companies and hosting providers are rushing to protect their infrastructure. Even Wordfence, one of the most recognized names in WordPress security, temporarily took its own website and several services […]
Read blog
WordPress security through obscurity is often discussed as if it were either a complete solution or completely useless. The truth is more practical: hiding a login URL or removing a version label can reduce low-effort noise, but neither replaces access control, updates, backups, or proper monitoring. Security through obscurity means depending on an attacker not […]
Read blog
The Symptoms: Thousands of blank admin users in the dashboard, and a “critical error” that crashes the Posts page. The Cause: Advanced database malware stripping primary key constraints to inject spam and rogue accounts using an ID of 0. The Fix: Executing targeted SQL queries via phpMyAdmin to purge the zero-ID records and repair the […]
Read blog
A WordPress malware scanner reports that everything is clean. However, visitors are still being redirected, unfamiliar scripts continue loading, or the infection returns shortly after suspicious files are removed. This does not necessarily mean that the scanner is broken. It usually means that the investigation has been limited to only one part of the website. […]
Read blog
Spam on WordPress does not always look the same. One website may receive hundreds of promotional comments. Another may get nonsense messages through its contact form. An online store may suddenly receive fake WooCommerce orders, while a membership site may fill up with bot-generated user accounts. The mistake I often see is treating every type […]
Read blog
During a recent WordPress malware investigation, I found this code at the beginning of a plugin file: <?php if (file_exists(dirname(__FILE__) . ‘/class.plugin-modules.php’)) { include_once(dirname(__FILE__) . ‘/class.plugin-modules.php’); } ?> It is only one short line, and the rest of the file looked like normal plugin code. But the referenced file name immediately stood out: class.plugin-modules.php This […]
Read blog
Quick answer: Yes, you can secure WordPress without any security plugins. Most real protection comes from two layers you control directly: application hardening (wp-config.php rules, correct file permissions, disabled file editing) and server-level controls (a web-server firewall, blocked PHP execution, least-privilege database access). Plugins add convenience and monitoring, not the foundation. After manually cleaning more […]
Read blog
Quick Answer: Can a file that looks like an image, PDF, or CSS contain malware on a WordPress site? Yes. On a hacked WordPress site, attackers routinely hide PHP backdoors, JavaScript redirects, and webshells inside files that look harmless — .jpg, .png, .gif, .ico, .svg, .pdf, .css, and even .txt or .log. The file extension […]
Read blog