If you are still running sites with WordPress 4.1 through 4.6 then take note that security back-ports will no longer be available. Usage of these versions is very low.

FluentAuth is a free login and security plugins. Version 2.0 of FluentAuth was released yesterday. It included some updates needed by users as well as several new features. Some of the new additions include Login with Facebook, Login/Register Page Customizer, and the option to log via email as a primary option. Md Shahjahan recorded a video about the new version.

Is WordPress core not being secure just a perception issue, or is there more that needs to be done?

This is a good discussion about WordPress security with Mario Peshev and Oliver Sild. It is a wide-ranging discussion.

Advanced Access Monitor is a security focused plugin that has a pretty robust free version. The free version has an audit feature that checks a number of areas to see that they are locked down and in line with best practices. This article outlines the audit feature.

It seems like the number of unpatched vulnerabilities is increasing. If that is correct it is not a good trend.

Patchstack has released their annual State of WordPress security report.

If you are going to be at WordCamp Asia, Patchstack is running a “Capture the Flag” hacker challenge. They already have over 100 people signed up.

For developers, this article looks at the OWASP told ten vulnerabilities list, so hopefully you can recognize and avoid them in your code.