WordPress Security Update: How AI Found a Critical Flaw and What NZ Business Owners Should Do

AI helped a researcher uncover a critical WordPress flaw. What every NZ business owner needs to know about WordPress security updates and AI.

IQ Block Country preventing access to WordPress admin?

A recent update to the excellent WordPress plugin IQ Block Country has resulted in a problem – IQ Block Country preventing access to WordPress admin. The symptoms are that you can see your main website, but that your admin gives a blank screen. I am not sure if it is related to an update of […]

WordPress WebSite Manager – Why You Need One

What is a WordPress WebSite Manager?  Why do you need one? There is a pattern to a successful web site. First you get a great idea.  You hire a web site builder, or build it yourself, and create a new WordPress web site.  You probably try to spend as little money on this as possible, […]

WordPress Security Tips: Check if the login form is protected by captcha test

Wordpress Security: Using a captcha test on your login form to prevent brute-force attacks and prevent some 0-day exploits from gaining access to your site.

WordPress Security Tips: Check if all security keys and salts have proper values

Security keys are used to ensure better encryption of information stored in the user’s cookies and hashed passwords. You don’t have to remember these keys. In fact once you set them you’ll never see them again. Therefore there’s no excuse for not setting them properly. Security keys (there are eight) are defined in wp-config.php as […]

WordPress Security Tips: Check for display of unnecessary information on failed login attempts

By default on failed login attempts WordPress will tell you whether username or password is wrong. An attacker can use that to find out which usernames are active on your system and then use brute-force methods to hack the password. The solution to this problem is simple. Whether user enters wrong username or wrong password […]

WordPress Security Tips: Check if server response headers contain detailed PHP version info

As with the WordPress version it’s not wise to disclose the exact PHP version you’re using because it makes the job of attacking your site much easier. This issue is not directly WP related but it definitely affects your site. You’ll most probably have to ask your hosting company to configure the HTTP server not […]

WordPress Security Tips: Check if WordPress readme.html file is accessible via HTTP on the default location

You should be proud that your site is powered by WordPress but also hide the exact version you’re using. readme.html contains WP version info and if left on the default location (WP root) attackers can easily find out your WP version. This is a very easy problem to solve. Rename the file to something more […]

WordPress Security Tips: Check if full WP version info is revealed in page’s meta data

You should be proud that your site is powered by WordPress and there’s no need to hide that information. However disclosing the full WP version info in the default location (page header meta) is not wise. People with bad intentions can easily use Google to find site’s that use a specific version of WordPress and […]

WordPress Security Tips: Check if themes are up to date

As with the WordPress core, keeping the theme up to date is one of the most important and easier way to keep your site secure. Since many themes are free and therefore their code is available to anyone, having the latest version will ensure you’re not prone to attacks based on known vulnerabilities. If you […]

Help! I Need My WordPress Site To Be Safe From Hackers!

Did you know that around 75% of all WordPress sites are easy to hack?  This is usually because whoever set up the site didn’t understand the tweaks that are required to strengthen WordPress.  Please see our famous WordPress Hack Prevention Checklist for a list of what these tweaks are, if you want to do this […]

WordPress Security Tips: Test the strength of WordPress database password

There is no such thing as an “unimportant password”! The same goes for WordPress database password. Although most servers are configured so that the database can’t be accessed from other hosts that doesn’t mean your database passsword should be “12345”. Choose a proper password, at least 8 characters long with a combination of letters, numbers […]