WP Ghost 9.0

WordPress 7.1.4 (Oct 28) fixes a core upgrade-process flaw that can lead to remote code execution, plus stored XSS bugs. Patchstack counts 22. Check Dashboard > Updates shows 7.1.4 today and update by hand if not.

/wp-json/wp/v2/users lists your WordPress authors to anyone, with IDs and login slugs. Close that route first. Locking the whole API breaks the WooCommerce cart block.

Switch off the WordPress REST API completely and the block editor stops saving. Return a 401 to logged-out visitors instead, or move /wp-json/ so scanners get a 404.

WP Ghost 9.1.08 is out (28 Oct). It can throttle AI training crawler bots so a crawl spike cannot exhaust the server, configurable on the 2026 Ghost Firewall. Update from Plugins > Updates.

2026 Ghost Firewall covers the full range of how a WordPress site is probed and exploited, at the edge and inside the request: #firewall #WordPressSecurity #hidemywp

YOOtheme Pro 5.0.0 to 5.0.52 on WordPress: CVE-2026-102785, an unauthenticated file upload, is being exploited (Unit 42, Wordfence). The theme doesn't auto-update. Install 5.0.53 and check wp-content/uploads for .php files you don't know.

DreamHost has been expiring some email and FTP/SFTP passwords since Oct 23, cause not named. WordPress on DreamHost: set new SFTP passwords under Websites > SFTP Users & Files and remove mail forwards you don't know.

WP Ghost 9.1.06 is out (26 Oct) with the 9G Firewall, the new firewall generation. It covers admin-ajax and the REST API, file uploads too. Update from Plugins > Updates.

Beginner guide, under 3 minutes: install WP Ghost, load one preset, run Ghost Doctor, set the 8G Firewall. Your login gets a new address and wp-login.php returns a 404.

WP Ghost 9.1.05 is out (21 Oct). Security update: the plugin always verifies the account server's SSL certificate on licence and update checks, also on sites without HTTPS. Update from Plugins > Updates. #WpGhost #HideMyWP

Open /xmlrpc.php on your WordPress site. If it says "XML-RPC server accepts POST requests only", it's live. One .htaccess or Nginx rule turns that into a 403.

xmlrpc.php is still on by default in WordPress, and one system.multicall request can carry many password guesses. Most sites can block it with nothing breaking. Test Jetpack after.

New from the WP Ghost team: CrawlBrain, AI Site Search for WooCommerce, WordPress and Shopify. Shoppers who misspell a product or type "warm beige foundation" still find it, and it answers buying questions from your own pages. $5 free credit:

New from the WP Ghost team: CrawlBrain, AI Site Search for WooCommerce, WordPress and Shopify. Shoppers who misspell a product or type "warm beige foundation" still find it, and it answers buying questions from your own pages. $5 free credit:

WP Ghost 9.1.03 update: test your reCAPTCHA keys right on the Brute Force page, without logging out. Plus firewall hardening so a forged login cookie can no longer skip it, and a fix for Temporary and Magic Login on PHP 8. Update from your plugins page. #WordPress #Security

The best-performing host other than Patchstack managed to block 60.7%, while several blocked less than 17% and one blocked nothing at all. #WordPressSecurity hashtag#WordPress hashtag#Security hashtag#WPGhost

WP Ghost 9.1 adds Ghost Doctor, a diagnostic layer that inspects your server rules, cache and theme, explains what is broken in plain language, and repairs most of it in one click with an Undo. #WPGhost #release #wordpressplugin #WordPressSecurity

SQL injection (SQLi) is the attack behind those probes. It lets an attacker slip database commands into a form field, URL parameter, or API request that your site runs as if you typed them yourself. #WordPress #WordPressPlugin #WordPressSecurity #SQLi

Wappalyzer does not hack anything. It pattern-matches. It pulls your HTML, your response headers, your cookies and your asset URLs, then runs them against a public library of regular expressions. #wappalyzer #wordpress #security #WPGhost

8 Best WordPress Security Plugins in 2026, Compared by Security Layer #bestwordpressplugin #topwordpress #SecurityPlugins #wordpresssecurity