Articles
Every tool you sign into gets a look at something private. Most of us decide whether to trust one based on how the login screen looks. Five better questions, from having had to answer them ourselves.
Four million WordPress sites installed a plugin whose entire job was to make them safer. In November 2024 it turned out to let anyone log in as the administrator. Every protective plugin is also code running with high privilege.
In early 2025 around thirty WordPress plugins were sold on a marketplace to an anonymous buyer. The plugins kept working. Nobody who had them installed heard a thing. Eight months later they woke up.
WordPress maintenance plans range from "we ran an update" to no one looking until something breaks. Here is what actually matters, what you can safely skip, and how to read a plan before you sign it.
Most of the WordPress sites we take on were not built by us. They arrive because something broke, and the person who built them is long gone. Here is what we usually find, and why none of it is the owner's fault.
Patchstack puts the median gap between a WordPress vulnerability going public and being mass-exploited at around five hours. Most maintenance plans run monthly. That arithmetic changes what maintenance is for.
Updating your site closes the door. It does not tell you whether anybody came through it first. This is the check we run, written so you or your developer can work through it in an afternoon.
The usual advice about WordPress security is to keep your plugins few and keep them updated. This time it did not help, because the flaw was in WordPress itself, and it had been in there long before July made it news. Which versions were exposed, and what to take from it.
Website security specifications tend to look impressive. Detailed requirements. Specific technical measures. Named plugins and configuration steps. It all reads...
Every SaaS platform you use holds your data. Customer records, project notes, invoices, email history, documents, task lists. Over time, that data becomes the w...
It's been about a year since new rules came into force that changed what's legally acceptable on a UK business website. They cover two things: fake reviews and...
Think your tiny website isn’t worth a hacker’s time? Think again. Here’s the thing—cybercriminals aren’t picky. In fact, small sites are often the first target...