Updates, news and developments from hosting, security and Internet infrastructure.
Security
Domain registration, hosting, CMS access and backups have different owners and logins. A short access review can prevent disruption when a supplier changes.
Web & WordPress
WordPress has changed how its security team prioritises vulnerability reports. Most website owners do not need to do anything immediately, but the change helps explain how security fixes reach WordPress sites.
Web & WordPress
WordPress 7.0.4 arrived on August 12 with a security fix affecting sites where Author-level users can upload malicious files in environments using Imagick and Ghostscript.
Web & WordPress
WordPress 7.0.2 addressed serious security issues on July 17, including vulnerabilities affecting database queries and the REST API, making prompt updates especially important.
Hosting
TLS certificates usually work quietly in the background, but an expired certificate can make a healthy website look broken or unsafe within minutes.
Web & WordPress
Plugin count alone is a poor measure of a WordPress site; quality, overlap and maintenance matter more.
Security
HTTP security headers allow a website to tell browsers how certain content and connections should be handled.
Security
A backup is useful only if it survives the incident it is supposed to recover from. If production credentials can also delete every backup…
Security
The principle of least privilege limits each user, process or application to the access it actually needs.
Security
Website compromises often involve more than one malicious file. Attackers may leave backdoors, scheduled tasks, unauthorized administrators…
Security
Maintenance windows are useful for orderly operations, but not every vulnerability can safely wait.
Security
Automated login attempts remain common against hosting panels, CMS logins, SSH services and mailboxes.
