Tag: Security

David Explains the OWASP Top Ten

While writing WordPress Security with Confidence last year, I spent a lot of time waiting for the latest revision of the OWASP Top Ten, the 2017 version. They ended up taking too much too long to publish, and I made the course focusing on the 2013 version, which was the most-recent-finalized iteration at the time the course went live. I don’t regret that choice, but I wanted to make sure I was well acquainted with the 2017 iteration.


How to Compare the Features of WordPress Security Plugins (and Services)

As a part of WordPress Security with Confidence, I built a feature that I felt a lot of people were hungry for. It’s a comparison table of WordPress security plugins. It starts to take people along the journey from “security is a serious topic that I have no idea how to handle” and toward “security is a set of problems I can solve in a variety of ways.” That transition is my motivation for the course, and it’s also the motivation for something I just made free: WPSecurityCompared.com. Which, well, makes it easy to compare WordPress security plugins.




A Comparison of WordPress Two-Factor Options

I’ve been thinking hard about two-factor authentication in the last few months. I think it’s great, but you can’t deny the hassle. So while I’ve enabled it on small number of my most valuable accounts, I admit that I’ve not put it everywhere. I don’t have it on my WordPress sites–partly from avoidance of the (admittedly, relatively minor) hassle it represents, more just out of inertia. Helpfully, I just found this solid article from the folks over at WP WhiteSecurity about what options exist for turning on two factor for WordPress.



Principles of Secure WordPress Code

Security is a very important topic. To secure WordPress, you must have responsible users making use of an instance of WordPress that is only executing secure code (maybe helped by some extra “hardening”) on a secured server. But a compromise of any part of that can invalidate on all your work on any other part. There is no single solution to having a secure WordPress site.


Limit Login Attempts to Prevent Brute Force Attacks

zombies at gate

Many people are worried about WordPress security. The core project is secure (if updated) but that doesn’t stop people form worrying. That said, it doesn’t mean that there is no benefit from taking steps to harden the base configuration. I personally dislike most “security” plugins–they feel too big to me and the benefits they confer are small or unknown.



The WPShout Pro Community is here! One-to-one help. Never be stuck again. Master WordPress development. Take a look
Hello. Add your message here.