Login Security

WordPress core still doesn’t ship passkey login out of the box. If you want it, you need a plugin, and the specific plugin you pick matters more than it looks like on the surface. Here’s a fact worth knowing before you install anything: the WordPress core team’s own recommended 2FA…

Every year, Verizon publishes the Data Breach Investigations Report, the closest thing the security industry has to a definitive account of how breaches actually happen. In the 2026 edition, something changed for the first time in the report’s 19-year history: exploiting a software vulnerability overtook stolen credentials as the single…