Notes on WordPress Security.
WordPress incidents from start to finish: compromises and cleanups, the spam left behind, locking the sites down, and the load that followed.
WordPress Security
6 Notes
- When Scanners Overwhelmed WordPress How scanner traffic overwhelmed a shared WordPress server, why queued PHP requests prolonged the outage, and how capacity limits and early NGINX rejection restored service.
- Locking and Watching WordPress How I made the code of about 50 WordPress sites immutable with chattr, what that broke, the two protections that had silently never run, and a daily Telegram report built to have almost no false alarms.
- Spam That Outlives the Hack Why Google kept almost a million gambling spam URLs after the WordPress sites were clean, and how I mapped them from access logs, answered them with a tested 410 rule, and told Search Console to drop them.
- When the Server Fell Over How a Facebook crawler flood took every WordPress site on a shared server down, why a full opcache looked like an attack, and the caps, crawler caching, and checks that keep one site from sinking the rest.
- Two Servers, 50 Sites, One Bug How wp2shell, a WordPress Core exploit, reached about 30 old WordPress sites across two RunCloud servers, what the attacker left behind, how I cleaned up and contained it, and the hardening I now recommend.
- Cleaning Up a wp2shell Compromise How an unauthenticated WordPress Core exploit spread across seven sites on one RunCloud server, the signs it leaves behind, the cleanup recipe I repeated on each site, and the changes that stop it from happening again.
Other Topics
- Measurement Notes on Google Tag Manager, Google Analytics 4, Consent Mode V2, and Google Ads conversions: how a measurement setup should work, and how this site is tracked.
- AI Workflow How I build with AI tools every day, from Copilot to GPT and Opus: what each changed in my work, and why the responsibility stays mine.
- Engineering Write-ups of systems I built: a headless CMS, a deployment pipeline, a circuit breaker for Amazon SES, and an ERP that replaced a paid CRM.
Next step
Have a project in mind? Let's talk.
Tell me what you have and what you need. I usually reply within one working day with how I'd approach it.