WP Ghost 9.1.08 is out (28 Oct). It can throttle AI training crawler bots so a crawl spike cannot exhaust the server, configurable on the 2026 Ghost Firewall. Update from Plugins > Updates. wpghost.com/kb/changelog/

2026 Ghost Firewall covers the full range of how a WordPress site is probed and exploited, at the edge and inside the request: wpghost.com/kb/2026-ghost-fi… #firewall #WordPressSecurity #hidemywp

YOOtheme Pro 5.0.0 to 5.0.52 on WordPress: CVE-2026-102785, an unauthenticated file upload, is being exploited (Unit 42, Wordfence). The theme doesn't auto-update. Install 5.0.53 and check wp-content/uploads for .php files you don't know. wordfence.com/threat-intel/v…

DreamHost has been expiring some email and FTP/SFTP passwords since Oct 23, cause not named. WordPress on DreamHost: set new SFTP passwords under Websites > SFTP Users & Files and remove mail forwards you don't know. help.dreamhost.com/hc/en-us/…

WP Ghost 9.1.06 is out (26 Oct) with the 9G Firewall, the new firewall generation. It covers admin-ajax and the REST API, file uploads too. Update from Plugins > Updates. wpghost.com/kb/changelog/

Beginner guide, under 3 minutes: install WP Ghost, load one preset, run Ghost Doctor, set the 8G Firewall. Your login gets a new address and wp-login.php returns a 404. youtu.be/HQl8p1X5mIg

WP Ghost 9.1.05 is out (21 Oct). Security update: the plugin always verifies the account server's SSL certificate on licence and update checks, also on sites without HTTPS. Update from Plugins > Updates. wpghost.com/kb/changelog/ #WpGhost #HideMyWP

Open /xmlrpc.php on your WordPress site. If it says "XML-RPC server accepts POST requests only", it's live. One .htaccess or Nginx rule turns that into a 403. hidemywpghost.com/how-to-dis…

xmlrpc.php is still on by default in WordPress, and one system.multicall request can carry many password guesses. Most sites can block it with nothing breaking. Test Jetpack after. wpghost.com/disable-xml-rpc-…

New from the WP Ghost team: CrawlBrain, AI Site Search for WooCommerce, WordPress and Shopify. Shoppers who misspell a product or type "warm beige foundation" still find it, and it answers buying questions from your own pages. $5 free credit: crawlbrain.com

New from the WP Ghost team: CrawlBrain, AI Site Search for WooCommerce, WordPress and Shopify. Shoppers who misspell a product or type "warm beige foundation" still find it, and it answers buying questions from your own pages. $5 free credit: crawlbrain.com

WP Ghost 9.1.03 update: test your reCAPTCHA keys right on the Brute Force page, without logging out. Plus firewall hardening so a forged login cookie can no longer skip it, and a fix for Temporary and Magic Login on PHP 8. Update from your plugins page. #WordPress #Security

wpghost.com/wordpress-securi… The best-performing host other than Patchstack managed to block 60.7%, while several blocked less than 17% and one blocked nothing at all. #WordPressSecurity hashtag#WordPress hashtag#Security hashtag#WPGhost

wpghost.com/kb/wp-ghost-9-1/ WP Ghost 9.1 adds Ghost Doctor, a diagnostic layer that inspects your server rules, cache and theme, explains what is broken in plain language, and repairs most of it in one click with an Undo. #WPGhost #release #wordpressplugin #WordPressSecurity

hidemywpghost.com/wordpress-… SQL injection (SQLi) is the attack behind those probes. It lets an attacker slip database commands into a form field, URL parameter, or API request that your site runs as if you typed them yourself. #WordPress #WordPressPlugin #WordPressSecurity #SQLi

hidemywpghost.com/hide-wordp… Wappalyzer does not hack anything. It pattern-matches. It pulls your HTML, your response headers, your cookies and your asset URLs, then runs them against a public library of regular expressions. #wappalyzer #wordpress #security #WPGhost

8 Best WordPress Security Plugins in 2026, Compared by Security Layer #bestwordpressplugin #topwordpress #SecurityPlugins #wordpresssecurity wpghost.com/best-wordpress-s…

hidemywpghost.com/hide-wordp… A “footprint” is any signal, in your HTML, your HTTP headers, or a predictable file path, that identifies your CMS, its version, or its components. Here is what leaks ... #WordPressSecurity #footprints #cybersecurity

Stop Brute Force Attacks on WordPress wpghost.com/stop-brute-force… Stop brute force attacks on WordPress: reconfigure the login endpoint and close XML-RPC and REST so probes return 404 before the auth form loads. #WordPress #Security #BruteForce

WP Ghost 9.0.09 (13 July 2026) - Force 2FA Setup: require selected user roles to set up 2FA Authentication before they can access the dashboard - Translation in Indonesian & Turkish wpghost.com/ #HideMyWPGhost #security #2FA