Mixed Content Warning? 8 Hidden Causes and Simple Fixes
A mixed content warning means the page requested HTTP over HTTPS. Eight hidden causes, the curl that finds them, and the search-replace that fixes it.
· 14 min readInsights
Security guides for WordPress sites.
WordPress security in practice: how sites actually get compromised, what to do in the first hour after one is, and which of the standard hardening advice is worth the friction. Includes the recovery steps — because the plugin that promised to prevent it is rarely the thing you need at 2am.
- Written from client work, not rewritten documentation
- Runnable commands and real numbers, not vague advice
- We say where the other option wins
Locked Out of WordPress Admin? 9 Simple Ways Back In
Locked out of WordPress admin? Match your symptom to the cause, then reset the password, fix the site URL or disable the plugin — all without wp-admin.
· 13 min read
How to tell if your WordPress site has been hacked
Most compromises stay quiet. Five checks that find one — core checksums, PHP in uploads, changed files, unknown admins — and what not to do first.
· 6 min read
How to clean a hacked WordPress site, step by step
Removing malware is the easy half; removing the attacker's access is the half that counts. The ordered cleanup, with the salt rotation people skip.
· 6 min read
How to harden WordPress: a practical security checklist
Hardening that earns its keep, in order of impact — plus the widely repeated advice that stops nobody and is not worth your time.
· 6 min read
How to stop brute-force attacks on your WordPress login
You cannot stop the bots trying, only make trying pointless. Rate limiting, two-factor, the XML-RPC multiplier — and what is only noise reduction.
· 6 min read
What to do after a WordPress security breach
Cleanup is half the job. Work out what was reachable, rotate every credential, meet your notification duties, and watch for thirty days — not one.
· 7 min read