[ BruteBank :: Dispatches ]
Security
in plain text.
Practical notes for WordPress owners who would rather block the attack than explain it afterward.
// read before they break in
STOP
before the login
// all posts
7 articlesBruteBank / field manual / checklist
#01WordPress Security Checklist
What is WordPress Security? Is WordPress Secure? How do we make WordPress more secure?
Open dispatch ↗BruteBank / field manual / permissions
#02WordPress File & Folder Security Permissions
What are the correct file and folder permissions for WordPress to ensure security and a fully functional website?
Open dispatch ↗01 // brute-force calls
02 // disable if unused
03 // deny at server
BruteBank / attack surface / xml-rpc
#07XMLRPC WordPress Attacks
Learn how attackers abuse WordPress XML-RPC for password guessing and denial-of-service traffic, and how to reduce the exposure.
Open dispatch ↗$ brutebank verify --wordpress
password accepted
$ email one-time-code
2FA CHECKPOINT: ACTIVE_
BruteBank / field manual / 2fa
#03Why two-factor authentication matters on WordPress
Passwords are not enough. Learn how BruteBank adds a secure email code before a WordPress login is allowed through.
Open dispatch ↗BruteBank / incident response / recovery
#04What to do after a WordPress brute-force attack
A practical incident plan for spotting an attack, locking down access, checking your site, and preventing the next attempt.
Open dispatch ↗the second checkpoint
BruteBank / account defense / email
#05Email security is WordPress security
Your WordPress security codes, alerts, and recovery links all depend on one critical account: your email.
Open dispatch ↗! failed / repeated
! success / unknown
! 2fa / verify
BruteBank / signal desk / alerts
#06How to read BruteBank security alerts
Turn a stream of login notifications into a clear decision: ignore, investigate, or shut it down now.
Open dispatch ↗