Tag

WordPress Security

Keeping your WordPress site secure with updates, plugins, and best practices.

17 articles

WordPress is the most targeted CMS on the web. That's not because it's insecure; it's because it's popular, and attackers go where the numbers are. Most compromises come from outdated plugins, weak passwords, or skipped updates.

These articles cover the security side of WordPress: hardening your install, responding to vulnerabilities, and understanding what your hosting provider handles versus what's on you. We see the attack patterns first-hand through our managed hosting platform, and we share what we learn.

Explore topics
WordPress Hosting UK Business Small Business AI Visibility SEO Web Hosting Content Strategy Security AI Discovery Files WordPress
Security 15 May 2026

Avada Builder Just Patched a 1M-Site SQL Injection. The WooCommerce Deactivated Trap Is the Buried Lead.

Wordfence disclosed CVE-2026-4798 in Avada Builder this week, affecting over 1,050,000 WordPress installations. The headline is patch to 3.15.3. The buried lead almost nobody covered is the WooCommerce-installed-then-deactivated precondition that turns the SQL injection from a "1M sites at risk" panic into a much narrower exploit window. We have held Avada licences for years and patched our portfolio first. Here is what actually matters.

7 min read Read
News 16 Dec 2025

Grok's Bondi Errors Show AI Risks for UK WordPress Sites

Grok AI spread false information about the Bondi Beach terrorist attack, inventing a fictional hero and misidentifying victims. Here's why UK WordPress site owners using AI for content need to pay attention to the Online Safety Act and implement proper verification workflows.

10 min read Read
Hosting 15 Dec 2025

PHP 8.1 End of Life: What Happened Next and Why Millions Are Still Exposed

PHP 8.1 reached end-of-life on 31 December 2025. Four months on, WP Cloud, Pagely, and WordPress VIP have force-migrated their customers, but roughly 55% of the top million PHP sites are still running an EOL version. Here's what happened, what the host-driven upgrades actually broke, and how to get off PHP 8.1 now if you haven't already.

9 min read Read
Security 10 Dec 2025

131,000 Attacks Target WordPress Sites via Sneeit RCE Flaw

A critical remote code execution flaw in the Sneeit Framework WordPress plugin (CVE-2025-6389, CVSS 9.8) has triggered 131,000+ attack attempts. Attackers are creating admin accounts and uploading backdoors. Here's how to check if you're compromised and what to do right now.

8 min read Read
Security 4 Dec 2025

King Addons Hack Lets Anyone Become WordPress Admin

A critical vulnerability in King Addons for Elementor (CVE-2025-8489) lets anyone create an admin account on your WordPress site. Over 48,400 exploit attempts logged since October. Here's how to check if you're compromised and lock it down.

9 min read Read
Back to all articles