WordPress Security

The last post covered architecture-level decisions. This one’s narrower: specific choices inside the code itself, the kind of thing that only shows up if you actually read the implementation rather than the feature list. 1. CSRF protection during a window where nonces don’t apply WordPress’s nonce system is built around…

Every plugin’s pricing page calls itself “free” for something. The word’s stopped meaning much on its own. Here’s what’s actually included, checked against real current pricing and real plugin documentation, not assumed from memory. Login security Wordfence added passkeys and 2FA to its free tier in version 9.0.0, genuinely worth…