Your first WordPress restore attempt should happen while the site is healthy.
“Where's the password for the backup account?” is a better Tuesday task than an emergency discovery.
Restore a consistent set of files and database into an isolated environment. Sign in, open pages and media, and test the important workflows.
Time the whole process, including finding credentials and remembering where the configuration lives.
Then check whether compromised website credentials could delete every backup. Protect at least one recovery copy with separate access controls.
Finally, compare backup frequency with how much recent work you could afford to lose.
A folder full of backup files becomes much more reassuring after you've successfully used it.
“Where's the password for the backup account?” is a better Tuesday task than an emergency discovery.
Restore a consistent set of files and database into an isolated environment. Sign in, open pages and media, and test the important workflows.
Time the whole process, including finding credentials and remembering where the configuration lives.
Then check whether compromised website credentials could delete every backup. Protect at least one recovery copy with separate access controls.
Finally, compare backup frequency with how much recent work you could afford to lose.
A folder full of backup files becomes much more reassuring after you've successfully used it.
0
0
1
99
Your cached WordPress homepage can load beautifully while other requests still reach the application.
Login requests.
API calls.
Plugin endpoints.
Cache misses.
Wonderful performance review. A few things left for the security review.
Check what an unauthenticated visitor can reach, including through the original hosting address.
Static publishing changes the setup by serving generated files independently. The WordPress installation used for editing still needs its own access restrictions.
Look at both environments.
The homepage loading quickly is lovely. The bots aren't necessarily coming for the homepage, though 😂
Login requests.
API calls.
Plugin endpoints.
Cache misses.
Wonderful performance review. A few things left for the security review.
Check what an unauthenticated visitor can reach, including through the original hosting address.
Static publishing changes the setup by serving generated files independently. The WordPress installation used for editing still needs its own access restrictions.
Look at both environments.
The homepage loading quickly is lovely. The bots aren't necessarily coming for the homepage, though 😂
4
1
7
793
Copying a Content Security Policy from another website can be a surprisingly efficient way to discover what your checkout depends on.
Preferably before your customers do.
CSP helps control which scripts execute in visitors' browsers. Your WordPress site may combine a page builder, analytics, embeds, and payment tools, so the policy needs to account for your actual setup.
Start with a report-only policy. Review violations, investigate unexpected dependencies, and test the journeys visitors rely on.
Move to enforcement when the policy is ready.
Report-only mode doesn't block those requests. It helps you understand what enforcement would affect.
Review the policy again when you add new tools.
Preferably before your customers do.
CSP helps control which scripts execute in visitors' browsers. Your WordPress site may combine a page builder, analytics, embeds, and payment tools, so the policy needs to account for your actual setup.
Start with a report-only policy. Review violations, investigate unexpected dependencies, and test the journeys visitors rely on.
Move to enforcement when the policy is ready.
Report-only mode doesn't block those requests. It helps you understand what enforcement would affect.
Review the policy again when you add new tools.
0
1
3
161
"Hey Claude, here is my WordPress website - please use the Simply Static Studio MCP to make it static. Let me know once it's done."
That's all I'm saying (for now!)
That's all I'm saying (for now!)
5
2
50
8,679
“Disable the WordPress REST API!”
The block editor would like a word.
The editor and plenty of integrations depend on it.
A blanket block can turn a security task into an afternoon of troubleshooting.
Start with what each route actually does.
Public routes serving public posts are expected. Routes that expose private information or change data need proper permission checks.
Ask your developer to test sensitive routes as a logged-out visitor, a user with limited permissions, and the person who should have access.
Check capabilities and ownership where relevant.
Being logged in doesn't entitle someone to edit everything.
Then test publishing and integrations after changing restrictions.
The block editor would like a word.
The editor and plenty of integrations depend on it.
A blanket block can turn a security task into an afternoon of troubleshooting.
Start with what each route actually does.
Public routes serving public posts are expected. Routes that expose private information or change data need proper permission checks.
Ask your developer to test sensitive routes as a logged-out visitor, a user with limited permissions, and the person who should have access.
Check capabilities and ownership where relevant.
Being logged in doesn't entitle someone to edit everything.
Then test publishing and integrations after changing restrictions.
0
0
4
560
Patrick Posner retweeted
I did it again… @SimplyStaticWP turns @WordPress into a local static site generator and @SpacefastHQ let's you host it for free.
mattcromwell.com/blog/static-wo…
mattcromwell.com/blog/static-wo…
7
5
41
1,665
A careers form should collect CVs.
Accidentally launching a public CV library is a less useful feature. 😂
Follow an uploaded document all the way to storage:
• Allow only the file types you need.
• Enforce size limits.
• Validate files on the server, including their actual content.
• Don't trust the browser's declared file type.
• Scan where appropriate.
• Store sensitive attachments privately.
• Require authorized downloads.
• Set a retention period.
Then test the direct file URL while logged out. A protected form page can still leave attachments publicly accessible.
For static websites, review the service handling submissions just as carefully. Processing and storage still happen somewhere!
Accidentally launching a public CV library is a less useful feature. 😂
Follow an uploaded document all the way to storage:
• Allow only the file types you need.
• Enforce size limits.
• Validate files on the server, including their actual content.
• Don't trust the browser's declared file type.
• Scan where appropriate.
• Store sensitive attachments privately.
• Require authorized downloads.
• Set a retention period.
Then test the direct file URL while logged out. A protected form page can still leave attachments publicly accessible.
For static websites, review the service handling submissions just as carefully. Processing and storage still happen somewhere!
1
0
0
141
Patrick Posner retweeted
Hey @Railway, is there a reason employee's of yours are trying to breach my infrastructure?
Your employee Jake Runzer, just attempted to tonight.
Your employee Jake Runzer, just attempted to tonight.
228
344
9,530
2,928,582
The homepage is back.
The attacker might be, too.
Restoring WordPress without addressing the original entry point can put you straight back where you started.
Your recovery plan should cover:
• Containing the affected environment.
• Preserving logs and evidence before wiping it.
• Investigating the entry point with your host.
• Finding unauthorized accounts, code and persistence.
• Rebuilding or restoring from a verified clean source.
• Revoking affected credentials and sessions.
• Fixing the weakness before reopening access.
The latest backup may already contain the compromise.
Choose recovery material based on evidence.
Afterward, monitor for recurrence and record what needs to change.
The attacker might be, too.
Restoring WordPress without addressing the original entry point can put you straight back where you started.
Your recovery plan should cover:
• Containing the affected environment.
• Preserving logs and evidence before wiping it.
• Investigating the entry point with your host.
• Finding unauthorized accounts, code and persistence.
• Rebuilding or restoring from a verified clean source.
• Revoking affected credentials and sessions.
• Fixing the weakness before reopening access.
The latest backup may already contain the compromise.
Choose recovery material based on evidence.
Afterward, monitor for recurrence and record what needs to change.
0
0
0
226
An impressive firewall at the front.
Direct access to the server around the back.
An interesting floor plan. 😂
An edge firewall may be working perfectly while your WordPress origin remains reachable through another hostname or connection.
Ask your host to verify that the origin enforces the intended access restrictions.
When a plugin vulnerability appears, check whether a relevant firewall rule exists and is enabled. Its protection depends on the traffic it inspects and the attacks it recognizes.
Keep the patch or removal task open until the vulnerable software has been addressed.
A firewall rule can buy useful time. Use it to apply the fix.
Direct access to the server around the back.
An interesting floor plan. 😂
An edge firewall may be working perfectly while your WordPress origin remains reachable through another hostname or connection.
Ask your host to verify that the origin enforces the intended access restrictions.
When a plugin vulnerability appears, check whether a relevant firewall rule exists and is enabled. Its protection depends on the traffic it inspects and the attacks it recognizes.
Keep the patch or removal task open until the vulnerable software has been addressed.
A firewall rule can buy useful time. Use it to apply the fix.
1
0
2
184
Patrick Posner retweeted
We’re sponsoring CMS Conf 2026! 🎉
WordPress, headless CMS, AI, and modern web development, all at one conference.
📍 Gdynia, Poland
📅 November 12–14
I really like the idea of bringing different CMS communities together instead of staying in our own little bubbles.
Sadly, I won’t be able to make it in person this year, but we’re happy to support the event!
The organizers also gave us a 40% discount code to share:
🎟️ cmsconf40
Check it out: cmsconf.com
WordPress, headless CMS, AI, and modern web development, all at one conference.
📍 Gdynia, Poland
📅 November 12–14
I really like the idea of bringing different CMS communities together instead of staying in our own little bubbles.
Sadly, I won’t be able to make it in person this year, but we’re happy to support the event!
The organizers also gave us a 40% discount code to share:
🎟️ cmsconf40
Check it out: cmsconf.com
2
1
4
291
My Zelda-branded Switch 2 arrived today.
Merry Christmas and Happy New Year - see you in January! 😂
Merry Christmas and Happy New Year - see you in January! 😂
0
0
2
168
"We might need it again.”
The unofficial motto of the inactive WordPress plugin list.
Deactivation stops normal loading. The files remain on your server, and depending on the code, some vulnerabilities may still be reachable.
If a plugin has finished its job, check dependencies, export any settings or data you need, take a backup, and uninstall it.
Anything you deliberately keep still needs updates and someone responsible for it.
A surprisingly useful feature in your security toolkit: the DELETE button. 😂
The unofficial motto of the inactive WordPress plugin list.
Deactivation stops normal loading. The files remain on your server, and depending on the code, some vulnerabilities may still be reachable.
If a plugin has finished its job, check dependencies, export any settings or data you need, take a backup, and uninstall it.
Anything you deliberately keep still needs updates and someone responsible for it.
A surprisingly useful feature in your security toolkit: the DELETE button. 😂
1
0
2
378
We’re sponsoring CMS Conf 2026! 🎉
WordPress, headless CMS, AI, and modern web development, all at one conference.
📍 Gdynia, Poland
📅 November 12–14
I really like the idea of bringing different CMS communities together instead of staying in our own little bubbles.
Sadly, I won’t be able to make it in person this year, but we’re happy to support the event!
The organizers also gave us a 40% discount code to share:
🎟️ cmsconf40
Check it out: cmsconf.com
WordPress, headless CMS, AI, and modern web development, all at one conference.
📍 Gdynia, Poland
📅 November 12–14
I really like the idea of bringing different CMS communities together instead of staying in our own little bubbles.
Sadly, I won’t be able to make it in person this year, but we’re happy to support the event!
The organizers also gave us a 40% discount code to share:
🎟️ cmsconf40
Check it out: cmsconf.com
2
1
4
291
Your WordPress plugin list can become a small museum of past decisions.
- A campaign from 2022.
- A migration tool.
- Three plugins you tested before choosing a fourth.
Every one still installed needs someone responsible.
For each plugin, check what it does, whether anything depends on it, who maintains it, and who owns its updates. Look for duplicated features (looking at you, form plugins) and unresolved security advisories.
There's no magic safe number. A recent release and a million installations don't guarantee security either.
Start with the plugin nobody remembers installing. Save anything you need, check dependencies, and remove unnecessary code.
- A campaign from 2022.
- A migration tool.
- Three plugins you tested before choosing a fourth.
Every one still installed needs someone responsible.
For each plugin, check what it does, whether anything depends on it, who maintains it, and who owns its updates. Look for duplicated features (looking at you, form plugins) and unresolved security advisories.
There's no magic safe number. A recent release and a million installations don't guarantee security either.
Start with the plugin nobody remembers installing. Save anything you need, check dependencies, and remove unnecessary code.
1
0
1
317
Patrick Posner retweeted
Ollie OS — Designed for humans, optimized for agents, built for the frontier. This is WordPress like you've never seen it before, and it's coming soon.
olliewp.com/ollie-os
olliewp.com/ollie-os
16
8
113
30,262
The PHP vulnerability affected everyone in the WordPress ecosystem (and beyond that!).
Many people (including me) had a long, exhausting day, and that's fine; keeping our customer sites and data secure is (and should be) our top priority.
But it really pisses me off to see certain hosting providers claim they were safe "immediately" and use that to make a few extra sales.
Instead of doing this bullshit, why not make it accessible to everyone? Tons of reputational damage around WP could have been prevented (and yes, I know it was PHP and not WP).
You know what?
Zero of our customers have been impacted AT ALL; their static versions kept running, we disabled booting up WP during the patch implementation, and that's it.
Do I comment under every post that "We have been safe immediatly"? No, because we are all in this together, making the web a better (and safer) place - at least I thought so.
Sorry, I'm just a bit tired.
Many people (including me) had a long, exhausting day, and that's fine; keeping our customer sites and data secure is (and should be) our top priority.
But it really pisses me off to see certain hosting providers claim they were safe "immediately" and use that to make a few extra sales.
Instead of doing this bullshit, why not make it accessible to everyone? Tons of reputational damage around WP could have been prevented (and yes, I know it was PHP and not WP).
You know what?
Zero of our customers have been impacted AT ALL; their static versions kept running, we disabled booting up WP during the patch implementation, and that's it.
Do I comment under every post that "We have been safe immediatly"? No, because we are all in this together, making the web a better (and safer) place - at least I thought so.
Sorry, I'm just a bit tired.
11
2
75
16,850
This is serious.
I'm already hovering my finger over the upgrade button to upgrade all Studio instances right away.
Sometimes, I'm really glad we are less impacted because our sites aren't running all the time 😅
I'm already hovering my finger over the upgrade button to upgrade all Studio instances right away.
Sometimes, I'm really glad we are less impacted because our sites aren't running all the time 😅
We were all supposed to wait until Thursday at 11am ET.
Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619
We cannot share further information right now. Take this seriously and apply patches when available.
1
0
4
781
Maybe it's time to reconsider your WordPress stack: simplystatic.com/tutorials/two-…
0
0
1
127
Patrick Posner retweeted
I rebuilt Roots & Fruit as a static site that costs $0/month on Cloudflare Pages.
But I didn't ditch WordPress.
I start with my CDS (Core Design System). It has a WordPress compiler that generates a theme, stylesheets, and patterns. I've open-sourced it so you can fork it and adapt it to your own brand.
Then I build locally. When I'm ready to publish, Simply Static generates the static site, and Cursor deploys it to Cloudflare. That means that Studio is my staging.
I really like this separation of concerns. I keep WordPress for what it's good at: content management, semantic layouts, and plugins that let me extend the site programmatically.
But I don't have to pay to host all that infrastructure, and I don't need PHP running on a public server just to serve HTML, CSS, and a little JavaScript.
WordPress is a great platform for AI-assisted web development, and I think people need to take its strengths more seriously.
My CDS + WordPress setup gives an AI agent the guidelines, components, and context it needs to build something accurate and compelling, consistently and reliably.
I wrote up the whole process, with GitHub links so you can adopt the approach and make it your own.
rootsandfruit.com/articles/stati…
But I didn't ditch WordPress.
I start with my CDS (Core Design System). It has a WordPress compiler that generates a theme, stylesheets, and patterns. I've open-sourced it so you can fork it and adapt it to your own brand.
Then I build locally. When I'm ready to publish, Simply Static generates the static site, and Cursor deploys it to Cloudflare. That means that Studio is my staging.
I really like this separation of concerns. I keep WordPress for what it's good at: content management, semantic layouts, and plugins that let me extend the site programmatically.
But I don't have to pay to host all that infrastructure, and I don't need PHP running on a public server just to serve HTML, CSS, and a little JavaScript.
WordPress is a great platform for AI-assisted web development, and I think people need to take its strengths more seriously.
My CDS + WordPress setup gives an AI agent the guidelines, components, and context it needs to build something accurate and compelling, consistently and reliably.
I wrote up the whole process, with GitHub links so you can adopt the approach and make it your own.
rootsandfruit.com/articles/stati…
10
2
31
3,172