Just like your WordPress site, if you are using a VPS then it is necessary to lock it down and keep it updated.

WordFence has launched a new free service where you can setup web hooks for vulnerability notifications.

Here is the first in a mini-series from WP Builds on the state of WordPress security. The first interview is with Calvin Alkan. Much of the episode covers ground that we’ve already posted about in the group, but there is some new info.

There is a critical vulnerability in Kadence Blocks versions prior to 3.1.11. Please update to the latest version.

In the security reference department – this article lists a large number of common vulnerability types and explains what they are and how they work.

For developers: this is an in-depth overview about WordPress nonces and a tutorial on how to use them.

This is a mid-year report from the WordFence team about security threats they have tracked so far. The article is kind of interesting also because they used AI prompts against their own vulnerability database to help generate the answers.

This article addresses the recent supply chain vulnerability in plugins using the Freemius SDK. It also goes in depth to provide information about the process of reporting and the reporting authorities in the WordPress ecosystem.

This interview with Tom Raef touches on a lot of good issues, a few that aren’t often mentioned. I liked the relaxed approach to the discussion. A few good suggestions. I’m sure the idea that Mac users should have anit-virus installed will be controversial to some, but if you are managing other people’s sites from that Mac then that seems like a good idea.