MalCare Security Blog
Practical WordPress security guides from the MalCare team: cleaning hacked sites, hardening WordPress, and choosing the right tools.
520 articles · page 1 of 44
Too Many Redirects in WordPress: How to Fix the Redirect Loop
If you see the too many redirects wordpress error, the browser is caught in a redirect loop: it keeps being told to request another URL and never reaches a final page.
How to Add CAPTCHA to WordPress: Protect Login, Forms, and Comments
If you are searching for a captcha WordPress solution because bots are filling your comments, contact forms, registrations, or login page, you can reduce that
WordPress Cookies: What They Are, Which Ones WordPress Uses, and How to Manage Them
WordPress cookies are small pieces of data stored in a browser.
WordPress User Enumeration: How to Detect and Prevent It
If you are setting up a new WordPress site or hardening an existing one, WordPress user enumeration is a way for someone to discover a valid user or author identifier without logging in.
How to Disable File Editing in WordPress Safely
If you searched for disable file editing wordpress, the safest general approach is to back up the site and set DISALLOWFILEEDIT to true in wp-config.php.
How to Disable PHP Execution and Directory Browsing in WordPress
If you want to disable PHP execution directory browsing in WordPress, treat the two settings as separate WordPress hardening tasks.
WordPress Failed Login Attempts: What They Mean and How to Stop Them
Seeing repeated WordPress failed login attempts can be alarming.
How to Change the Default WordPress Username (3 Methods)
If you are staring at Users > Profile because WordPress will not let you edit the Username field, you are in the right place.
X-XSS Security Header in WordPress: What It Means and Whether to Enable It
If a scanner flags a missing x-xss security header, do not add it without checking what it does today.
Referrer Policy in WordPress: What It Is and How to Configure It
If a security scan has flagged your site for a missing referrer policy WordPress setting, you probably want a safe fix—not another header to configure blindly.
HSTS WordPress: How to Add the Strict-Transport-Security Header Safely
If a scanner reports no HSTS header after you moved WordPress to HTTPS, you need to know what HSTS changes before you enable it.
X-Frame-Options WordPress: Configure and Test It Safely
If you need an x-frame-options wordpress fix, first inspect the response header your site sends.