The wp-config.php Settings That Actually Change Your Risk
Setting DISALLOW_FILE_EDIT prevents administrators from modifying plugin and theme code directly inside the WordPress dashboard.
Security & Ops
Security & Ops
Updates, credentials, logs and backups: the unglamorous work that decides how bad a bad day gets.
Security & OpsTwo-Factor for WordPress Admins Without Locking Yourself Out
WordPress administrator accounts cannot rely on a single defensive boundary when authentication spans both browser sessions and machine-to-machine interfaces.
Reading Your Access Log After Something Went Wrong
The Apache HTTP Server documentation defines its default Combined Log Format as %h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-agent}i".
Security & Ops currently holds 12 pages. They are dated 2007 to 2026. Nothing is filed here because it was popular. A page joins this section when it answers a question that came up while something was actually being built.
Every version, date and default quoted in this section is carried over from published documentation. None of it is estimated, and none of it is refreshed to look current. What this section does not do: rank tools against each other, publish sponsored recommendations, or update an old page’s figures so it reads as new.
Order here is chronological, most recent first. A page does not move up because it is being read more; it moves only when something newer is published. That makes the foot of the list the oldest material on the subject, which is worth knowing before you follow a setting or a command from it into a current install. The most recent of them is Two-Factor for WordPress Admins Without Locking Yourself Out, published 2026-09-29.
Everything in Security & Ops
Front page- Security & Ops
Application Passwords, and When a Real Password Is the Wrong Credential
WordPress core ships with a dedicated credential system that isolates programmatic API access from interactive account logins.
- Security & Ops
Adding a Content Security Policy Without Breaking the Admin
Enforcing a content security policy on WordPress without diagnostic data routinely breaks the site.
- Security & Ops
A Backup You Have Never Restored Is Not a Backup
A backup archive sitting on a remote storage volume proves nothing until it boots inside an isolated environment.
- Security & Ops
WordPress Plugin: Disable Theme Updates
Latest version: 1.1 – Released June 15th, 2025 All the information for this plugin can be found over at the WordPress Plugin Directory: Disable WordPress Theme Updates.
- Security & Ops
WordPress Plugin: Logout Password Protected Posts
Latest version: 0.2 – Released November 3rd, 2025 There is no built-in way for your visitors to "log out" of password protected posts once they've entered the password.
- Security & Ops
WordPress Plugin: Disable WordPress Plugin Updates
Latest version: 1.4 – Released June 15th, 2025 All the information for this plugin can be found over at the WordPress Plugin Directory: Disable WordPress Plugin Updates.
- Security & Ops
WordPress Plugin: Global Post Password
Latest version: 1.5 - Released November 2nd, 2025 WordPress 3.4 and 3.5 compatibility. WordPress 3.4 or later is now a requirement.
- Security & Ops
WordPress Plugin: Disable WordPress Core Update
Latest version: 1.4 – Released June 15th, 2025 Completely disables the core update checking system in WordPress 2.3 and higher.
- Security & Ops
WordPress Plugin: Sign Out Reminder
Latest version: 0.2 – Released 26 July 2008 This is a very straight forward plugin. It simply displays to every user who logs in a reminder to log out once they’ve finished using the admin interface.