Security tips
How holes get in, how we clean them, and what to update. Written by the people who maintain the sites.
Rank Math PRO 3.0.123 Malware: Why 3.0.124 Alone Won’t Clean Your Site
Some Rank Math PRO 3.0.123 downloads carried malware for about 11 hours. Here's how to check your copy and why version 3.0.124 alone won't clean an affected site....Read…
Read more October 17, 2026The EU withdrawal button: setting up WooCommerce Order Withdrawal
An “email us” returns page isn't enough for every EU WooCommerce shop. Here's what the withdrawal button needs to do, how to enable Order Withdrawal, and what to…
Read more October 16, 2026A Backup Restore Could Hand Over Your WordPress Site
UpdraftPlus and Backuply fixed flaws that could turn a backup restore into a site takeover. Here's what to update and what to check afterward....Read More...
Read more October 13, 2026Is your WordPress plugin abandoned? How to check if it still gets security updates
A plugin can sit on your site long after its developer stops fixing it. Here’s how to check its update and security history, then replace it without breaking…
Read more October 12, 2026Avada Form Bug Can Empty Your WordPress Trash – Update Avada Builder
A public Avada form can let a stranger permanently empty your WordPress trash. Here’s what’s affected, how to update, and what to check today....Read More...
Read more October 11, 2026Your AI Chatbot Can Attack Your WordPress Admin
A bug in AI Engine could turn chatbot input into code running in a WordPress admin’s browser. Jotform AI Chatbot has a separate bug with no official patch…
Read more October 8, 2026Contact Form 7 6.2 took your site down? Here’s how to get back in
Contact Form 7 6.2 caused critical errors on some sites. Here's how to get back in, check the cause, and choose between 6.2.1 and a rollback....Read More...
Read more October 7, 2026Ninja Forms and WPC Product Bundles Attacks: Check for Hidden WordPress Backdoors
Attackers are using flaws in Ninja Forms and WPC Product Bundles to plant a fake plugin, hidden admin accounts and a secret login. Here’s how to check your…
Read more September 29, 2026WPForms Stripe refund flaw – update to 2.0.2 or newer
A WPForms flaw could trigger refunds and cancel subscriptions on a shared Stripe account. Here's how to check your version and look for trouble....Read More...
Read more September 28, 2026Elementor 4.3.0 and 4.3.1 – why one admin click could add an admin
A flaw in the free Elementor plugin could let a link opened by a logged-in admin create another admin account. Check whether you're on 4.3.0 or 4.3.1 and…
Read more September 24, 2026How to tell if a plugin CVE actually affects YOUR site – version + path check
You see a scary headline: “Critical vulnerability in Popular Plugin X.” Your stomach drops a little. Maybe you use that plugin. Maybe...Read More...
Read more September 23, 2026Updated WordPress last week? Update again – attackers started probing in under five hours
You updated WordPress last week. Good. Now update it again. WordPress 7.1.1 arrived on September 17 with maintenance work and 11 security...Read More...
Read more