Loyal Security Blog
Practical WordPress security writing from the team that builds Loyal Security: what we're seeing in the wild, how the plugin's defenses work, and what changed in each release.
/wp-admin and /wp-login.php are the two most-guessed addresses on the internet — because they’re the same on every default WordPress install. Moving yours doesn’t stop a determined attacker, but it quiets almost everything else.
Read moreWhy an online store has a different security threat model than a content site, the specific areas worth extra attention, and what a general security plugin alone might miss.
Read moreA phrase that’s stopped meaning much on its own “AI-powered security” has been attached to enough products, in enough contexts, that hearing it attached to one more doesn’t tell you anything useful…
Read moreThe wall almost everyone hits eventually If you maintain WordPress sites for other people, there’s a familiar progression: the first client site is easy to keep an eye on. The second is…
Read moreMost “free vs paid” articles are written backwards, starting from the product and working back to justify the upgrade. This one starts from your site instead — run the checklist, see where you land.
Read moreA plugin setting changes. A new admin user appears. A file gets edited at 3am. Without a log of what happened and when, you’re left guessing — and guessing is a bad place to be during an actual incident.
Read moreA hacked WordPress site doesn’t always look hacked. Sometimes it’s one quiet file redirecting a fraction of your visitors, or borrowing your site’s reputation for someone else’s spam — with nothing visibly wrong on the surface.
Read more“Firewall” gets thrown around as a reassuring word without much explanation of what it’s actually doing. Here’s what’s really happening to the traffic hitting your site before you ever see it.
Read moreNo security plugin, ours or anyone else’s, is a 100% guarantee. The honest safety net is a recent, tested backup stored somewhere other than your own server — and most sites don’t actually have one.
Read moreMost attacks on small WordPress sites aren’t a skilled attacker picking your site specifically. They’re a script trying common passwords against your login page thousands of times a day, fully automated, no human involved until it works.
Read more