Field notes
The Ximbalo security blog
Plain-English guides on the threats hitting WordPress sites every day — malware, bots, cPanel, plugins, email, and how to recover when things break.
WordPress Malware: How to Tell If Your Site Is Infected
Strange redirects, spammy pages, browser warnings, a sluggish admin — the early signs of a hacked WordPress site, and what to do the moment you spot them.
Read article →Why Bots Are Hammering Your WordPress Site — and How to Stop Them
Automated traffic now dwarfs human visitors for many small sites. Here's what the bots are actually doing to your WordPress install, and how to push back.
The Real Cost of an Outdated Plugin
One abandoned plugin can mean a defaced homepage, a spam relay, or a surprise bandwidth bill. A look at how small neglect becomes a big invoice.
wp-login.php Brute Force Attacks: A Plain-English Guide
Thousands of login attempts a day is normal for a WordPress site. Here's what brute-force attacks are, why they work, and how to lock the door.
Hardening cPanel: The Server Checklist Most Owners Skip
Your site can be perfectly patched and still get owned through the server around it. A practical checklist for cPanel, PHP, SSL, and email.
robots.txt Won't Save You From Bad Bots — Here's What Does
robots.txt is a polite request, and bad bots aren't polite. Why blocking abusive crawlers takes more than a text file.
Is Your Domain Blacklisted? Fixing Email Deliverability
When invoices and replies start landing in spam — or vanishing — your domain may be blacklisted. How it happens and how to recover.
Backups That Actually Work: A Recovery Plan for WordPress
A backup you've never restored is just a hope. What a real WordPress recovery plan looks like — and the mistakes that make backups useless.
Outdated PHP Is a Security Hole — Why Updating Matters
Running an old PHP version is one of the most common and most overlooked risks on a WordPress site. Here's what it costs you.
My Site Was Hacked. Now What? A Step-by-Step Recovery
A calm, ordered plan for the moment you realize your WordPress site has been compromised — what to do first, and what to avoid.