Information disclosure, also known as data breach is the unintentional exposure of sensitive information. This sensitive information can be anything from technical information such as plugin versions or hosting plan limits, to users information that should not be made public. Information disclosure is not a hack but allows an attacker to obtain sensitive information that … Read full article →
Security is a result of security “practices” rather than plugin “functionality”. No security plugin is perfect, but we make do, and that, like everything else in life, is what defines the outcome. Here’s a simple diagram of how an attacker tries to get inside your website. There are 4 levels that each request has to … Read full article →
File inclusion vulnerabilities allow an attacker to read (and sometimes execute) files on the WordPress website, gain unauthorized access to sensitive information and inject malicious files through the “include” functionality. This can be very dangerous because if the webserver is misconfigured the attacker may gain access to sensitive user information and even execute arbitrary commands. There … Read full article →
🐱💻 Denial-of-Service or DoS attack in short, a DoS attacks tries to create fake traffic to overload your WordPress website, so much so that it becomes unavailable due to hositng/server limits. An extension to DoS is the DDoS attack with stands for Distributed Denial of Service. This one originates from multiple IP addresses. Types of … Read full article →
The most regularly seen attack type is script injection (XSS attack), rogue scripts are injected into the webpage for malicious purposes. This includes redirects to third-party websites, collecting user data, downloading malware to visitors, etc. WordPress has a bunch of useful developer functions that are used to sanitize data (Validating Sanitizing and Escaping User Data) … Read full article →
wp_postmeta table should be the biggest table in your database, if not, there is a problem. Read wp_actionscheduler_actions & wp_actionscheduler_logs tables When you install WordPress for the first time, tables are created in the database, for example for the wp_postmeta table: the problem? solution: On an existing tables, We can add high-performance keys that match … Read full article →
SQL (Structured Query Language) is a language that allows code to interact with databases. Injecting SQL commands into a vulnerable user input section on your WordPress website such as a contact form or search box is considered an SQL Injection attack. Depending on the actual SQL command, this could purge the database, send the data … Read full article →
Google’s PageSpeed Insights tool gives you a score between 0-100, with 100 being the fastest loading time. Slow websites rank lower in Google, have lower conversion rates, and generate less revenue with higher expenses. In this guide We will first check what is actually showing down a WordPress website by running a test for a … Read full article →
Cross-Site Request Forgery (CSRF) is an attack that forces logged-in users to submit a request to a WordPress website where they are currently authenticated. CSRF attacks exploit the trust a WordPress website has in an authenticated user. CSRF attacks are aimed at your WordPress website users to make them do various actions on your website: … Read full article →
Full path disclosure (FPD) is a software bug that results in the full path to the webroot directory of the server being exposed. This is not necessarily a security risk, but can be used in combination with other vulnerabilities to create a real issue. In this guide We will explain the importance of Full Path … Read full article →