Steel Security Blog
Insights on WordPress security, auditing, and practical hardening — without the noise.Clear, actionable guidance for developers and site owners.
Author Enumeration in WordPress: How Usernames Leak Through Public Patterns
Author Enumeration in WordPress: How Usernames Leak Through Public Patterns — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.
REST API User Enumeration in WordPress: What to Check and Why It Matters
REST API User Enumeration in WordPress: What to Check and Why It Matters — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.
Must-Use Plugins and Authentication Overrides: Hidden Risks to Review
Must-Use Plugins and Authentication Overrides: Hidden Risks to Review — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.
The WordPress Generator Tag: What It Exposes and Whether You Should Remove It
The WordPress Generator Tag: What It Exposes and Whether You Should Remove It — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.
WordPress Debug Configuration: Safe Settings for Development and Production
WordPress Debug Configuration: Safe Settings for Development and Production — a practical Steel Security guide explaining why this condition matters, what it can expose, and how to think about safer WordPress hardening.
Founder / Seat Licensing Clarification
How seats work and what to expect in activation UX.
License Activation and Site Connection
Connect flow, token format, common errors, and fixes.
Report Export Workflows
Creating client/stakeholder-ready reports from stored runs.