fail2ban is installed for SSH and left there, but the same brute force runs against every HTTP login on the box — a WordPress admin, a staging basic-auth…
Interpolating user input into a pattern is how a search box becomes a regular expression injection. preg_quote() escapes the metacharacters, but its default output is still not safe…
A nonce proves the request came from a form your site rendered, recently. It says nothing about whether the person submitting it is allowed to perform the action…
$wpdb->prepare() looks like sprintf() and behaves differently in the one way that matters: %s adds the surrounding quotes itself. Writing them by hand produces a doubly-quoted value and…
A week-old server already sees thousands of login attempts a day. Key-only SSH, a firewall, fail2ban and monit — and the recovery plan for locking yourself out.