ThemeAlley

Since 31 March 2025, two PCI DSS requirements have applied to ecommerce sites that previously did not have to think about them. Requirement 6.4.3 obliges you to inventory every script loaded on a payment page, document why it is there, have it explicitly authorised, and verify its integrity on an ongoing basis. Requirement 11.6.1 obliges…

If you are reading this at an unusual hour, you probably already know something is wrong, and the thing to understand first is that scanning and cleanup are two different products. Almost every tool in this category will tell you that you are infected. Far fewer will remove it, and the ones that do charge…

Every control in this article exists because of one gap: a firewall cannot tell an attacker with your password from you. Virtual patching, malware scanning, and vulnerability monitoring all address flaws in code. An intruder logging in with valid credentials is exploiting nothing, and nothing in your security stack objects. The good news is that…

A backup stored on the same server as the site is not a backup. It is a second copy of the same risk. Every scenario that destroys the site, a compromised server, a hosting account suspended, a provider failing, a disk lost, takes the copy with it, and the one scenario it does protect against,…

At fifty sites the security question changes shape entirely. One site is a thing you look after. Fifty sites is a queue, and the binding constraint stops being whether you can fix a vulnerability and becomes whether you can find out which of the fifty has it, before the five-hour median exploitation window closes on…

Five hours. That is the weighted median time between a WordPress vulnerability being disclosed and the first attempt to exploit it in the wild, according to Patchstack’s State of WordPress Security in 2026, published in February. Twenty per cent of heavily exploited vulnerabilities are attacked within six hours of disclosure, 45% within a day, and…