Steel Security Blog

The WordPress Generator Tag: What It Exposes and Whether You Should Remove It — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.

REST API User Enumeration in WordPress: What to Check and Why It Matters — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.

Author Enumeration in WordPress: How Usernames Leak Through Public Patterns — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.

WordPress Login Error Leakage: Why Specific Login Errors Help Attackers — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.

XML-RPC Enabled in WordPress: When It Matters and How to Reduce Risk — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.

ZIP Backups in Web Root: A Serious but Common WordPress Exposure — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.

Database SQL Files in Web Root: Why They Must Be Removed — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.

Why Leaving phpinfo() in Web Root Is a Security Mistake — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.