Blog
Security notes, hardening guides and attack breakdowns from the DefendMyWP team.
WordPress file integrity monitoring: catch changes before they hurt
Almost every WordPress compromise changes a file. Integrity monitoring catches those changes in hours — including the custom backdoors signature scans miss.
How to scan a WordPress site for malware
The kind of scan you run decides what it can find. Online, signature, and integrity scanning compared — and how to act on what a scan reports.
What is virtual patching for WordPress (and why you need it)
Virtual patching blocks a known vulnerability from being exploited without changing the vulnerable code — protecting you in the gap before a real patch lands.
Is Cloudflare enough to protect WordPress?
Cloudflare is excellent at what it does — but some of the most common WordPress attacks pass through it untouched. What a CDN covers, and what it can’t.
Why your WordPress site keeps getting hacked (and how to stop it)
Reinfection almost always means the clean-up removed the symptom but left the backdoor. Here’s where persistence hides and how to break the cycle for good.
My WordPress site is hacked: what to do right now
A calm, step-by-step emergency plan for a hacked WordPress site: contain it, find the entry point and backdoors, clean it properly, and stop it recurring.
WordPress zero-day attacks: how to protect a site before a patch exists
You can’t patch a zero-day until a fix exists. Here’s what actually protects a WordPress site during the gap — and how to know fast if you were hit.
How to harden WordPress: the changes that actually matter
Most WordPress hardening advice is busywork. Here are the changes that actually shrink your attack surface and stop real attacks — plus the one layer a checklist structurally cannot give you.
What a WordPress firewall actually does (and what it can’t)
A firewall is your first line of defence, but the word gets stretched. Here is what an application firewall really blocks, and where it stops.
One-click hardening: the WordPress settings every site should lock down
A few built-in WordPress behaviours quietly widen your attack surface. Here are the ones worth disabling, all reversible and no code required.
