Open the PHP error log on a WordPress site that has been on the public internet for six months and you will find the same line thousands of times: PHP Fatal error: Uncaught Error: Class “WP_REST_Controller” not found in …/wp-content/plugins/…. The plugin is not broken. Nobody on the site saw an error. What the line…

Most advice on WordPress tags SEO is written from the outside: tags are “good for organisation”, tag archives are “thin”, set them to noindex and move on. I wanted the inside view, so I counted every tag on this site and then read what the access log says about who asks for the archives and…

Yesterday’s post ended with a promise I did not expect to keep this quickly: now that a denied request costs this server nine bytes instead of a full page, the scanner wordlist paths were worth a block. So I read the whole 404 column of the origin logs, both ports, for the twenty days since…

The WordPress hardening guide has a short block of .htaccess rules that stops anyone from loading the files under wp-includes/ directly. I added a version of it to this site this morning, verified that the files now returned an error instead of a 200, and moved on. Then I timed one of the denied requests….

Every guide to forcing HTTPS on WordPress starts the same way: go to Settings → General, change both addresses to https://, save. This site did that years ago. Its certificate is fine, its canonical tags say https, and Cloudflare sits in front of it. Then I read the access log that Apache keeps for port…

WP-Cron is the scheduler inside WordPress: the queue of things a site does on its own, such as checking for updates, deleting expired transients, sending pingbacks, and running whatever its plugins registered. It has no clock. It runs when something requests wp-cron.php, and on a stock install the something is the next visitor. Set DISABLE_WP_CRON…

PHP OPcache is the part of PHP that keeps compiled scripts in memory so the next request does not have to read, lex, parse and compile them again. It has shipped with PHP since 5.5, it is on by default in most PHP builds, and on this host it is not loaded at all. WordPress…

admin-ajax.php is the file in wp-admin that every WordPress plugin is allowed to phone. It boots the whole site, reads one action parameter, runs whatever function claimed that name, and hangs up. The name says “admin” but the front end uses it just as freely, so the file shows up in two places site owners…

A chatbot plugin is a web form that spends your money when someone types into it. That is the whole product: a visitor writes a sentence, the plugin sends it to an AI vendor with your API key attached, and the vendor bills you per token. For a customer it is support. For a script…

Search Console has a status called Discovered – currently not indexed. It means Google knows a URL exists and has chosen not to fetch it yet. The report tells you which URLs are in that state and nothing else: not when Google learned about them, not what it fetched instead, not whether it is coming…