Security & Malware
How threat actors purchase abandoned WordPress plugins and push malicious updates into trusted websites, plus how human update vetting protects your site.
Quick Answer: In a WordPress supply-chain attack, buyers acquire legitimate plugins from their original developers and push updates containing backdoors or spam links. Unattended auto-updates install those payloads right away. HackGuard prevents this by checking plugin ownership changes and testing updates by hand each week.
Read full guide
Security & Malware
How to run a multi-author or community WordPress blog safely by using Contributor or Author roles and reviewing uploads.
Quick Answer: When inviting guest writers or community contributors to a WordPress site, do not give them Administrator or Editor accounts. Assign Contributor or Author roles, require strong passwords with two-factor authentication, and review media and links before publishing.
Read full guide
Security & Malware
Why botnets target wp-login.php, why replacing the default "admin" username is necessary, and how login lockouts stop password guessing.
Quick Answer: Brute-force botnets hit wp-login.php with thousands of username and password guesses per minute, maxing out server CPU and breaking into weak accounts. Stop them by replacing any default "admin" username, using 16+ character passwords, and adding server-level login lockouts.
Read full guide
Security & Malware
Jim Walker's four-part BUMM routine for WordPress care: Backup offsite, Update weekly by hand, Maintain the database, and Monitor 24/7.
Quick Answer: BUMM stands for Backup, Update, Maintain, and Monitor. Any WordPress site skipping one of these four steps is open to malware infections, broken plugin updates, or lost data.
Read full guide
Security & Malware
Lessons from 25+ years of cleaning hacked websites: why bots target small sites, why SSL certificates do not stop malware, and why manual oversight matters.
Quick Answer: Most WordPress attacks are automated bot sweeps that hit sites of every size regardless of traffic. An HTTPS padlock only encrypts traffic in transit; it does not block plugin exploits, stolen admin passwords, or shared-hosting cross-contamination.
Read full guide
Security & Malware
A practical look at free uptime ping tools and page-change monitors compared with 24/7 human-managed WordPress security monitoring.
Quick Answer: Free uptime monitors only alert you when your homepage returns an HTTP 500 error or times out. They miss hidden SEO spam links, unauthorized administrator accounts, and conditional redirects that only fire for visitors coming from Google Search.
Read full guide
Security & Malware
How Jim Walker pairs 25+ years of hands-on malware cleanup experience with AI tools for faster code review, research, and client security reporting.
Quick Answer: AI tools speed up code review, log inspection, and security report drafting, but they cannot replace 25+ years of hands-on troubleshooting. HackGuard combines modern analysis tools with weekly manual site checks by Jim Walker.
Read full guide
Security & Malware
Common WordPress plugins that cause high server load, database bloat, or security risks, plus lighter alternatives.
Quick Answer: Avoid plugins that run continuous background scans (like Broken Link Checker), load scripts on every page unnecessarily, duplicate your host backups locally, or leave outdated code on your server. Keep your active plugin count low and delete deactivated plugins.
Read full guide
Security & Malware
How attackers abuse WordPress xmlrpc.php for amplified password-guessing and DDoS pingback floods, plus the .htaccess rule to block it.
Quick Answer: The xmlrpc.php file lets attackers test hundreds of passwords in a single HTTP request using system.multicall and launch pingback DDoS floods. Unless you use mobile or remote publishing apps that need it, block access to xmlrpc.php in .htaccess or Cloudflare WAF.
Read full guide
Security & Malware
Where your web hosting company's security job ends and where your WordPress application security responsibility begins.
Quick Answer: Your web host secures the data center and server operating system, while you are responsible for securing the WordPress application itself, including plugins, themes, administrator logins, and file permissions.
Read full guide
