WordPress REST API Authentication for Headless and APIs
The authentication options for the WordPress REST API from outside: cookies and nonces, application passwords, JWT, OAuth and custom keys.
Writing
Security: what we have had to fix
6 write-ups from production, newest first. Each one is a problem hit on a real project and how it was diagnosed and fixed.
WordPress Security Hardening That Is Not a Plugin
Security that lives in the server, configuration and process rather than a plugin: file permissions, disabled file editing, user hygiene, edge filtering.
Security Scanning Explained: What It Catches and Misses
What a website security scan actually does, the problems it finds and the ones it misses, why a clean scan is not a secure site, and what else a care plan does.
'Not Secure' Warning: What the Padlock Means and the Fix
What the Not Secure warning in the browser means, why it appears, how it affects visitors and search, and the steps that restore the padlock.
Hacked Website: The First 24 Hours, in Plain Words
What to do in the first 24 hours after your website is hacked, in plain words: contain it, tell people, clean it, and stop it happening again.
Daily Website Backups: Storage, Testing and Restoring
How daily website backups should work: where they are stored, how often they are tested, how long they are kept, and how a restore actually happens.