Threat research, walkthroughs of real-world WordPress compromises (anonymised), plain-English explainers for site owners, and field notes from the RedSecLabs team. New posts roughly fortnightly.
Every WordPress security plugin before 2024 worked the same way: maintain a database of known malware signatures, compare your files against it,…
Wordfence is the leading free WordPress security plugin, but its in-process scanner has limitations that modern malware can exploit. Here's…
Think your WordPress site has been hacked? Learn how to confirm the infection, clean every compromised file and database entry,…
WordPress casino spam is a black-hat SEO infection that injects gambling, betting, and “free spins” content into your site but…
In this guide, we'll show you how to scan WordPress for malware using the free Guardian Gaze plugin and explain…
Learn how to perform a complete WordPress security audit with this step-by-step guide. Check for vulnerabilities and keep your WordPress…
Two of the most common entry points for WordPress compromises aren’t exotic zero-days or sophisticated attacks. They’re plugins that stopped…
A WordPress brute force attack is an automated attempt to log into your site by guessing username and password combinations…
If Google is showing “This site may be hacked” under your search result, Google has detected spam, malware, or unauthorized…
The Japanese SEO spam hack (also called the Japanese keyword hack) injects thousands of auto-generated Japanese-language pages into your WordPress…
One email per post. Threat walkthroughs, agency playbooks, and product updates. Unsubscribe anytime.