Security Your WordPress site was hacked. Do these ten things, in this order 5 September 2026 / 6 September 2026 by Rik Smeets A checklist for the first two hours, written for the person who has to fix it, not for the person who has to be reassured. Read more »
Security ClickFix: hacked WordPress sites are serving fake CAPTCHAs 31 August 2026 / 6 September 2026 by Rik Smeets Two research teams documented the same campaign at very different scales. The visitor infects their own computer; the site owner usually finds out from a complaint. Read more »
Security Elementor Pro and Forminator: two form vulnerabilities and what to do 19 August 2026 / 6 September 2026 by Rik Smeets Both are on millions of sites, both were patched, and both are still running unpatched on sites nobody logs into. The fix is a version number. Read more »
Security WordPress 7.0.3 and the security releases you may have missed 12 August 2026 / 6 September 2026 by Rik Smeets Minor releases install themselves on most sites. On the ones where they do not, nobody notices until the scan does. Read more »
Security The BdThemes supply-chain attack: a plugin update that was the malware 8 August 2026 / 6 September 2026 by Rik Smeets When the vendor's own update server ships the payload, every site that did the right thing gets infected first. What happened, and what still protects you. Read more »