§ 17.06.2026 , 8-minute read

WordPress and security: the four checks no plugin gives you

WordPress security plugins fix the surface that's already exposed. The four checks that prevent exposure in the first place.

§ Body

The essay

8-minute read

Capability checks on every admin action. Nonces on every state-changing request. Sanitize at write, escape at output. Lock the file system. None of these are sold as a plugin because they are mostly discipline.

§ Adjacent

Next, previous

Same lane
← Previous Plugin diet: 38 → 11 in 14 days Next → When Classic beats FSE — and when it doesn’t
§ Related

Keep reading

3 more in this lane
01 17.06.2026 Why your WP site lost 1.2 s to a plugin audit, and how to win it back. A 9-minute teardown of the plugin tax. Includes the spreadsheet I use to score plugins on weight, render-blocking, and abandonment risk. Numbers from 47 live sites measured in 2026. 9 min · Performance, WordPress 02 17.06.2026 Plugin diet: 38 → 11 in 14 days A worked example of cutting an enterprise WordPress install from 38 active plugins to 11, with every removed plugin's behaviour preserved in theme code. 11 min · Performance, WordPress 03 17.06.2026 When Classic beats FSE — and when it doesn’t A frank tour of the design space. Classic themes win for marketing sites with bespoke design; FSE wins for content-heavy sites where editors compose pages. 5 min · WordPress

Want this on your site? Currently booking new projects.

Start a project