CMSConf is happening this week in Gdynia, Poland!
Looking forward to meeting fellow #WordPress professionals, catching up with friends, and listening to some interesting talks.
I'll also be speaking on Saturday about WordPress session hijacking.
We have plenty of tools to s, but what happens when an attacker steals an authenticated session cookie? They may be able to access your website without ever logging in.
I'll explain how this works, why it's difficult to detect, and what we can do to reduce the risks.
Saturday, November 14, Developer Track
If you're attending, come say hello!
And if you still need a ticket, there's a discount available here:
cart.easy.tools/checkout/cmsco…
#CMSConf #WordPress #WordPressSecurity @CMSconf_
Looking forward to meeting fellow #WordPress professionals, catching up with friends, and listening to some interesting talks.
I'll also be speaking on Saturday about WordPress session hijacking.
We have plenty of tools to s, but what happens when an attacker steals an authenticated session cookie? They may be able to access your website without ever logging in.
I'll explain how this works, why it's difficult to detect, and what we can do to reduce the risks.
Saturday, November 14, Developer Track
If you're attending, come say hello!
And if you still need a ticket, there's a discount available here:
cart.easy.tools/checkout/cmsco…
#CMSConf #WordPress #WordPressSecurity @CMSconf_
0
0
1
91
We've released another update of the @melapressHQ WP 2FA plugin earlier this week.
It's a maintenance release with several bug fixes, but we've also made a small improvement to the user experience.
You can now relaunch the setup wizard from the plugin settings.
The wizard is first install WP 2FA. It helps you configure authentication methods, MFA policies and requirements, and user exclusions.
While you can always change all these settings individually in the plugin's configuration, the wizard provides a quicker way to go through the main configuration options again.
A small but useful addition. As always, keep the plugin up to date.
#mfa #wordpress #plugin
It's a maintenance release with several bug fixes, but we've also made a small improvement to the user experience.
You can now relaunch the setup wizard from the plugin settings.
The wizard is first install WP 2FA. It helps you configure authentication methods, MFA policies and requirements, and user exclusions.
While you can always change all these settings individually in the plugin's configuration, the wizard provides a quicker way to go through the main configuration options again.
A small but useful addition. As always, keep the plugin up to date.
#mfa #wordpress #plugin
1
1
6
154
Soon, I'll be joining @VitoPeleg from @atarim_io for a webinar about AI and WordPress.
We have developed an integration together to allow site admins to keep track of the changes made via AI.
We'll demonstrate AI making changes to a WordPress website, explain how those changes e you a sneak peek at what we're developing.
Join us 17th November:
atarim.io/webinar/?utm_s…
We have developed an integration together to allow site admins to keep track of the changes made via AI.
We'll demonstrate AI making changes to a WordPress website, explain how those changes e you a sneak peek at what we're developing.
Join us 17th November:
atarim.io/webinar/?utm_s…
1
3
7
302
We all still rely heavily on email, yet email deliverability remains a big problem.
When we launched WP 2FA, I never expected so many support tickets to be about emails not being delivered. And it's a common issue across #WordPress , not just our plugin.
So I invited Ken Simpson, CEO of @MailChannels to The Melapress Show to discuss #spam , SPF, DKIM, DMARC, email reputation, and what website owners can do to improve deliverability.
Plenty of useful advice in this episode. The episode will air later on today, at 4PM CET.
When we launched WP 2FA, I never expected so many support tickets to be about emails not being delivered. And it's a common issue across #WordPress , not just our plugin.
So I invited Ken Simpson, CEO of @MailChannels to The Melapress Show to discuss #spam , SPF, DKIM, DMARC, email reputation, and what website owners can do to improve deliverability.
Plenty of useful advice in this episode. The episode will air later on today, at 4PM CET.
Your website sends a password reset link or a 2FA code, but the user never receives it. The problem isn't necessarily with your website.
In episode 62 of The Melapress Show, @robertabela speaks with @MailChannels CEO Ken Simpson about email deliverability, sender reputation, to investigate missing or delayed emails.
🗓️ Watch the new episode on November 5 at 4:00 p.m. CET.
2
0
3
57
As I explained at WordCamp US, one of the challenges with session hijacking is that it's difficult to detect. Someone could be using your #WordPress website account without you knowing.
That's why we've added a new option in Melapress Login Security to alert users of With the latest update of the plugin users now receive email alerts when their account has simultaneous sessions, with an option to terminate all other sessions.
Simple notifications like these give users more visibility and control over their accounts, thus increasing the chances of detecting hijacked sessions.
That's why we've added a new option in Melapress Login Security to alert users of With the latest update of the plugin users now receive email alerts when their account has simultaneous sessions, with an option to terminate all other sessions.
Simple notifications like these give users more visibility and control over their accounts, thus increasing the chances of detecting hijacked sessions.
1
2
9
834
A compromised DevOps engineer's laptop may have been the starting point of a security incident at Binance, with an estimated impact of $6.3 billion.
This is a good example of something I spoke about at @WordCampUS earlier this year: security doesn't stop at authentication.
User education, proper access policies, and visibility into what users do after logging in are just as important.
And this applies to any platform, be it WordPress or a Saas, and also to everyone, including experienced technical users.
Here is my WordCamp US talk on this topic: youtube.com/watch?v=z5_hxy…
This is a good example of something I spoke about at @WordCampUS earlier this year: security doesn't stop at authentication.
User education, proper access policies, and visibility into what users do after logging in are just as important.
And this applies to any platform, be it WordPress or a Saas, and also to everyone, including experienced technical users.
Here is my WordCamp US talk on this topic: youtube.com/watch?v=z5_hxy…
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/ann…
0
0
4
78
I really had a great time today on This Week in WordPress, episode #387.
Always a pleasure joining these discussions. Plenty to learn, good conversations, and a few laughs along the way!
I joined Nathan from @wpbuilds - the host, @TacoVerdo, and @i_cirkovic and we covered , the WordPress credit system, PressConf, and most importantly, supermarket fridges!
Watch it here: youtube.com/watch?v=06eTdn…
Always a pleasure joining these discussions. Plenty to learn, good conversations, and a few laughs along the way!
I joined Nathan from @wpbuilds - the host, @TacoVerdo, and @i_cirkovic and we covered , the WordPress credit system, PressConf, and most importantly, supermarket fridges!
Watch it here: youtube.com/watch?v=06eTdn…
0
1
8
210
Going live on @wpbuilds within the next minute. A lot to talk about from the #WordPress world.
Join me and other WordPress people at wpbuilds.com/live
#podcast #WPWeekly
Join me and other WordPress people at wpbuilds.com/live
#podcast #WPWeekly
0
1
4
114
Can someone access your #WordPress dashboard without ever logging in? Unfortunately, yes.
We spend a lot of time securing WordPress logins with 2FA, strong passwords, and firewalls. However, if an attacker manages to steal an authenticated user's session cookie, they may not This is what I'll be discussing at @CMSconf_ on November 14.
My talk, "The Attacker That Never Logged In", covers how WordPress sessions work, session hijacking, why these attacks can go unnoticed, and what we can do to reduce the risks.
Saturday, November 14, at 13:20, Developer Track.
Talk details:
cmsconf.com/speakers/rober…
If you haven't got your ticket yet, use CTRL-ALT-DISCOUNT for a discount.
#CMSConf
We spend a lot of time securing WordPress logins with 2FA, strong passwords, and firewalls. However, if an attacker manages to steal an authenticated user's session cookie, they may not This is what I'll be discussing at @CMSconf_ on November 14.
My talk, "The Attacker That Never Logged In", covers how WordPress sessions work, session hijacking, why these attacks can go unnoticed, and what we can do to reduce the risks.
Saturday, November 14, at 13:20, Developer Track.
Talk details:
cmsconf.com/speakers/rober…
If you haven't got your ticket yet, use CTRL-ALT-DISCOUNT for a discount.
#CMSConf
1
2
5
107
Need to give a third party access to #WordPress?
Create a temporary login link with Melapress Login Security. Choose the user role, expiry, number of uses, and post-login redirect.
No permanent WordPress users to remember to delete:
melapress.com/support/kb/mel…
Create a temporary login link with Melapress Login Security. Choose the user role, expiry, number of uses, and post-login redirect.
No permanent WordPress users to remember to delete:
melapress.com/support/kb/mel…
0
0
1
37
Is it still worth learning tools such as WP-CLI in the age of AI and agentic tools?
Everyone is talking about how #AI can automate everything, so why bother learning the tools?
Last week, I discussed this with Marcel Tanish on the Melapress #podcast . Marcel highlighted the truth that many people tend to ignore: AI agents can also make mistakes, especially when they lack context or the user doesn't fully understand what they're asking the AI to do.
How did Marcel come to this conclusion? He has years of experience using WP-CLI to manage complex WordPress websites, and he's seen this happen firsthand.
The key takeaway is that AI can do the work for you, but that doesn't mean you shouldn't understand what it's doing.
A very interesting discussion, especially if you're increasingly using AI to manage your #WordPress websites.
#wpcli
Everyone is talking about how #AI can automate everything, so why bother learning the tools?
Last week, I discussed this with Marcel Tanish on the Melapress #podcast . Marcel highlighted the truth that many people tend to ignore: AI agents can also make mistakes, especially when they lack context or the user doesn't fully understand what they're asking the AI to do.
How did Marcel come to this conclusion? He has years of experience using WP-CLI to manage complex WordPress websites, and he's seen this happen firsthand.
The key takeaway is that AI can do the work for you, but that doesn't mean you shouldn't understand what it's doing.
A very interesting discussion, especially if you're increasingly using AI to manage your #WordPress websites.
#wpcli
AI can generate WP-CLI commands, but do you know what they actually do?
In episode 61 of The Melapress Show, @robertabela and Marcel Tannich discuss WP-CLI, troubleshooting WordPress issues, automation, and using AI safely.
🎥 Watch the full episode:
1
0
7
288
As promised, here's a short video showing how easy it is to migrate from the discontinued Wordfence Login Security plugin to WP 2FA.
With the new importer in WP 2FA 4.2.0, users are automatically migrated the next time they log in, together with their existing 2FA settings and ime, no need to set up 2FA again.
If you prefer written instructions, we've also published a step-by-step guide covering the migration process, how to monitor its progress, and when it's safe to remove the old plugin:
> melapress.com/support/kb/mig…
With the new importer in WP 2FA 4.2.0, users are automatically migrated the next time they log in, together with their existing 2FA settings and ime, no need to set up 2FA again.
If you prefer written instructions, we've also published a step-by-step guide covering the migration process, how to monitor its progress, and when it's safe to remove the old plugin:
> melapress.com/support/kb/mig…
0
0
4
145
If you missed our panel discussion about this year’s #WordPress Security Survey, you are missing out.
A few days ago, we hosted the discussion with @kathyzant, @danielebesana, @stealthcopter, and Thomas Raef. They all approach website security from different angles: governance, application security, bug bounties & malware.
That meant we could go beyond the survey numbers and discuss how the findings compare with what they actually see in practice.
Here is the panel discussion --> x.com/melapressHQ/st…
If you would like to see the 2026 WordPress Security Survey results before listening to the panel discussion, you can find them here --> melapress.com/wordpress-secu…
A few days ago, we hosted the discussion with @kathyzant, @danielebesana, @stealthcopter, and Thomas Raef. They all approach website security from different angles: governance, application security, bug bounties & malware.
That meant we could go beyond the survey numbers and discuss how the findings compare with what they actually see in practice.
Here is the panel discussion --> x.com/melapressHQ/st…
If you would like to see the 2026 WordPress Security Survey results before listening to the panel discussion, you can find them here --> melapress.com/wordpress-secu…
What does the state of WordPress security look like in 2026?
Tomorrow, we’re publishing a recorded panel discussion with @robertabela, @WeWatch, @stealthcopter, @kathyzant & @danielebesana on the findings of the 2026 Melapress Security Survey.
🕓 Save the date: Sept 29, 16:00 CET
ecurity #Cybersecurity #MelapressShow
0
1
5
191
I'll be speaking at @CMSconf_ in Gdynia this November!
I’m looking forward to meeting new people from other CMS communities, but also to catch up with familiar faces from the #WordPress community, all of whom will be speaking; Mike Miler, @Bovelett, @rmelogli, @RaitisSevelis, ootsman, and many others.
I'll also be giving a talk about WordPress session hijacking, and why securing the login process alone isn't always enough.
If you're attending, come say hello!
And if you haven't booked your ticket yet, you can get €30 off your ticket with this coupon code: CTRL-ALT-DISCOUNT.
#CMSConf #WordPress #WordPressSecurity
I’m looking forward to meeting new people from other CMS communities, but also to catch up with familiar faces from the #WordPress community, all of whom will be speaking; Mike Miler, @Bovelett, @rmelogli, @RaitisSevelis, ootsman, and many others.
I'll also be giving a talk about WordPress session hijacking, and why securing the login process alone isn't always enough.
If you're attending, come say hello!
And if you haven't booked your ticket yet, you can get €30 off your ticket with this coupon code: CTRL-ALT-DISCOUNT.
#CMSConf #WordPress #WordPressSecurity
0
4
10
233
Earlier this week we released WP 2FA 4.2.0. It includes a number of improvements and bug fixes, as well as a security fix.
However, the main addition is an importer for Wordfence Login Security.
Wordfence Login Security, a free 2FA plugin, was discontinued a few weeks ago. We don't want users to be left without #2FA, so we've built an importer to make moving to WP 2FA as straightforward as possible, without any downtime.
If you're using Wordfence Login Security, simply install WP 2FA. It will automatically detect the plugin and prompt you to start the migration.
Users are migrated together with their backup codes, so they don't need to configure 2FA again or change how they log in. From their point of view, everything continues working as normal. No user action is required.
Administrators can also follow the migration progress and see how many users have already been migrated.
You can install the free edition of WP 2FA directly from your WordPress dashboard. Go to Plugins, click "Add Plugin", search for "WP 2FA", and install it.
Once activated, follow the step-by-step wizard.
If you need help with the migration, we're also offering one-to-one email support to free edition users until the end of this year.
Don't leave your #WordPress #website users without 2FA. Keep your website secure.
However, the main addition is an importer for Wordfence Login Security.
Wordfence Login Security, a free 2FA plugin, was discontinued a few weeks ago. We don't want users to be left without #2FA, so we've built an importer to make moving to WP 2FA as straightforward as possible, without any downtime.
If you're using Wordfence Login Security, simply install WP 2FA. It will automatically detect the plugin and prompt you to start the migration.
Users are migrated together with their backup codes, so they don't need to configure 2FA again or change how they log in. From their point of view, everything continues working as normal. No user action is required.
Administrators can also follow the migration progress and see how many users have already been migrated.
You can install the free edition of WP 2FA directly from your WordPress dashboard. Go to Plugins, click "Add Plugin", search for "WP 2FA", and install it.
Once activated, follow the step-by-step wizard.
If you need help with the migration, we're also offering one-to-one email support to free edition users until the end of this year.
Don't leave your #WordPress #website users without 2FA. Keep your website secure.
0
0
0
48
Four in five #WordPress developers in our 2026 Security Survey had experienced at least one known security incident. Of those, 72.2% had experienced two or more.
That doesn't mean 80% of WordPress websites experience security incidents. Developers often work across multiple brought in specifically after a website has been compromised.
What it does show is that security incidents are something many WordPress developers face in their work, even when they know what they're doing.
We've analyzed the findings in our new Developer Security Benchmark:
melapress.com/wordpress-deve…
That doesn't mean 80% of WordPress websites experience security incidents. Developers often work across multiple brought in specifically after a website has been compromised.
What it does show is that security incidents are something many WordPress developers face in their work, even when they know what they're doing.
We've analyzed the findings in our new Developer Security Benchmark:
melapress.com/wordpress-deve…
0
0
1
53
WP Activity Log has changed a lot since I first started working on it back in 2013.
What started as a side project is now our main plugin at @melapressHQ, with far more features, settings and options.
Now we're working on its next big change: a completely new UI.
We're at the ly like feedback from our customers and free plugin users, before we go further and finalize the new UI.
If you'd like to test it, email me at robert@melapress.com and I'll send you the latest beta.
What started as a side project is now our main plugin at @melapressHQ, with far more features, settings and options.
Now we're working on its next big change: a completely new UI.
We're at the ly like feedback from our customers and free plugin users, before we go further and finalize the new UI.
If you'd like to test it, email me at robert@melapress.com and I'll send you the latest beta.
1
0
6
254
Tomorrow's episode of the @melapressHQ
Show is about something we all agree is important, yet often leave until later (or never gets done): documentation.
I'm joined by @DjevaLoperka, a long-time #WordPress #documentation contributor. Milana sees documentation as part of the engineering process, not something you write once development is finished.
I agree with her, even though unfortunately I don't always follow that approach myself.
During this episode we couldn't not talk about AI, the FAIR project, and Doc2Me, a project Milana started at the CloudFest Hackathon to explore automating some of the repetitive parts of software documentation.
Documentation might not be the sexiest thing on the internet, but when you tried a new software or needed to do something at a new job and it was missing, you definitely noticed.
If you can relate, then watch the episode which will be streaming tomorrow at 16:00 CET / 10:00 AM Eastern.
Show is about something we all agree is important, yet often leave until later (or never gets done): documentation.
I'm joined by @DjevaLoperka, a long-time #WordPress #documentation contributor. Milana sees documentation as part of the engineering process, not something you write once development is finished.
I agree with her, even though unfortunately I don't always follow that approach myself.
During this episode we couldn't not talk about AI, the FAIR project, and Doc2Me, a project Milana started at the CloudFest Hackathon to explore automating some of the repetitive parts of software documentation.
Documentation might not be the sexiest thing on the internet, but when you tried a new software or needed to do something at a new job and it was missing, you definitely noticed.
If you can relate, then watch the episode which will be streaming tomorrow at 16:00 CET / 10:00 AM Eastern.
🗓️ New Melapress Show episode: tomorrow at 4:00 p.m. CET
In the next episode, @robertabela speaks with @DjevaLoperka, a WordPress Documentation Team representative and WordPress Engineer at XWP, about why code alone is not enough and how documentation can become a more natural velopment process.
They also discuss:
▫️ Why good documentation is never really “finished”
▫️ Why documenting decisions can save time later
▫️ How WordPress handles documentation during release cycles
▫️ Where AI can actually help with documentation work
How can teams make documentation easier to maintain and more useful over time? Watch the full conversation tomorrow at 4:00 p.m. CET. 🙌
0
1
6
360
Today at 4PM we’re streaming our panel discussion about this year’s #WordPress Security Survey results.
This year we brought together people who see security from very different angles: @kathyzant, @danielebesana , @stealthcopter, and Thomas Raef.
Between them, there’s more than 30 years of experience in WordPress security, governance, hacked website cleanup, application security, bug bounties, & malware.
The mix of penalists' experience made for a very interesting discussion; people discussing the same numbers but from a different perspective.
If you would like to read the survey results before listening to the panel discussion, head to melapress.com/wordpress-secu…
Link to the panel discussion in the tweet below.
This year we brought together people who see security from very different angles: @kathyzant, @danielebesana , @stealthcopter, and Thomas Raef.
Between them, there’s more than 30 years of experience in WordPress security, governance, hacked website cleanup, application security, bug bounties, & malware.
The mix of penalists' experience made for a very interesting discussion; people discussing the same numbers but from a different perspective.
If you would like to read the survey results before listening to the panel discussion, head to melapress.com/wordpress-secu…
Link to the panel discussion in the tweet below.
What does the state of WordPress security look like in 2026?
Tomorrow, we’re publishing a recorded panel discussion with @robertabela, @WeWatch, @stealthcopter, @kathyzant & @danielebesana on the findings of the 2026 Melapress Security Survey.
🕓 Save the date: Sept 29, 16:00 CET
ecurity #Cybersecurity #MelapressShow
0
1
5
228
I had a very interesting discussion with @kathyzant on the latest @melapressHQ Show.
Kathy has years of experience in WordPress & #security, including working with the likes of Wordfence and SolidWP, so we covered quite a lot.
One important point that we discussed: your website doesn't need to be popular to be a target. Attackers often want the server resources behind it, not your brand. And now, with WordPress websites increasingly connected to AI services, they can become an even bigger goldmine, and therefore a bigger target.
We also discussed session hijacking, AI connectors, API keys, prompt injection, least privilege, and why AI doesn't replace good security governance or human oversight.
If you manage #WordPress websites, this episode is well worth a listen.
Watch here --> x.com/melapressHQ/st…
Kathy has years of experience in WordPress & #security, including working with the likes of Wordfence and SolidWP, so we covered quite a lot.
One important point that we discussed: your website doesn't need to be popular to be a target. Attackers often want the server resources behind it, not your brand. And now, with WordPress websites increasingly connected to AI services, they can become an even bigger goldmine, and therefore a bigger target.
We also discussed session hijacking, AI connectors, API keys, prompt injection, least privilege, and why AI doesn't replace good security governance or human oversight.
If you manage #WordPress websites, this episode is well worth a listen.
Watch here --> x.com/melapressHQ/st…
Even a low-traffic website has server resources that can be used to send spam, redirect visitors, distribute malware, or support other attacks.
In episode 59, @kathyzant explains why every WordPress website has value to attackers and what small businesses can do to reduce the risk.
Watch the premiere today:
x.com/i/broadcasts/1…
0
3
6
162