18 July 2026
Neighbor spotlight: @AdSenseTrenches. They go deep on AdSense — the kind of channel you actually keep notifications on for.…
@LockdownLedger
17 July 2026
wp-config Hardening SOP One file holds the keys to everything. Harden it line by line. — Step 1: Move wp-config.php one directory above the web root where the host allows it. — Step 2: Set DISALLOW_FILE_EDIT and DISALLOW…
@LockdownLedger
16 July 2026
Post-Compromise Triage SOP When a site is hit, panic-restoring overwrites the evidence. Work the order. — Step 1: Take the site offline or behind maintenance — stop ongoing damage first. — Step 2: Snapshot the current st…
@LockdownLedger
15 July 2026
Backup Restore Drill SOP A backup you've never restored is a guess. Test the recovery, not the backup. — Step 1: Confirm backups cover files AND database, stored off the production host. — Step 2: Verify encryption at re…
@LockdownLedger
14 July 2026
TLS Configuration SOP A padlock isn't a config audit. Verify the actual handshake. — Step 1: Disable TLS 1.0 and 1.1 at the server; allow 1.2 and 1.3 only. — Step 2: Remove weak ciphers — no RC4, no 3DES, no CBC where yo…
@LockdownLedger
13 July 2026
WP-Cron Control SOP The default wp-cron.php fires on visitor traffic and is a public DoS handle. Take it server-side. — Step 1: Set DISABLE_WP_CRON to true in wp-config.php. — Step 2: Add a real system cron hitting wp-cr…
@LockdownLedger
12 July 2026
Plugin Vetting SOP Every plugin is code you didn't write running as your site. Vet before install. — Step 1: Check last-updated date. Older than 12 months or untested with current core: reject. — Step 2: Read the changel…
@LockdownLedger
11 July 2026
Admin Surface Reduction SOP You can't brute-force a login you can't find. Shrink the attack surface. — Step 1: Restrict /wp-admin by IP allowlist or HTTP auth where the team works from fixed networks. — Step 2: For roami…
@LockdownLedger
10 July 2026
Database Access Hardening SOP The DB layer is where a compromise becomes permanent. Lock it down. — Step 1: Give the WordPress DB user only the rights it needs day-to-day: SELECT, INSERT, UPDATE, DELETE. No DROP, no GRAN…
@LockdownLedger
09 July 2026
Uploads Execution Block SOP The goal: even if a malicious file lands in uploads, it can never execute. — Step 1: Deny PHP execution in wp-content/uploads at the server level, not via .htaccess alone. — Step 2: Allowlist …
@LockdownLedger
08 July 2026
Quick rec — @RPMReceipts keeps a tight feed on site monetization. If today's post landed, that one's for you.…
@LockdownLedger
07 July 2026
WAF Tuning SOP A WAF in blocking mode on day one breaks your own admin. Tune it. — Step 1: Deploy in detection/log-only mode for 7 days. Capture the false positives first. — Step 2: Build rules for the OWASP top categori…
@LockdownLedger
06 July 2026
Login Lockout Policy SOP Rate-limit by behavior, not just IP — attackers rotate IPs. — Step 1: Lock after 5 failed attempts per username, 20 minutes. Track the username, not only the IP. — Step 2: Add a global cap: more …
@LockdownLedger
05 July 2026
File Permission Audit SOP Wrong permissions are the quietest backdoor. Audit, don't assume. — Step 1: Directories to 755, files to 644: find . -type d -exec chmod 755 {} \; then -type f to 644. — Step 2: Lock wp-config.p…
@LockdownLedger
04 July 2026
XML-RPC Disable + Verify SOP Disabling the toggle isn't enough — confirm the endpoint is actually dead. — Step 1: Block /xmlrpc.php at the web server, not just via plugin. Plugins load too late to stop floods. — Step 2: …
@LockdownLedger
03 July 2026
WordPress Salt Rotation SOP Rotating auth keys invalidates every active session and forces re-login. Run after any suspected compromise. — Step 1: Pull fresh keys from api.wordpress.org/secret-key/1.1/salt/. — Step 2: Re…
@LockdownLedger
02 July 2026
New-Site Hardening SOP The master pre-launch pass. Don't go live until every box is checked. — Step 1: HTTPS enforced site-wide, HSTS set, mixed content cleared. — Step 2: Admin account is not named "admin"; 2FA enrolled…
@LockdownLedger
01 July 2026
Content-Security-Policy Rollout SOP Use when adding CSP to a site that has none. — Step 1: Inventory every external script, font, and analytics domain the site loads. CSP breaks what you forgot. — Step 2: Start with Cont…
@LockdownLedger
30 June 2026
Compromise Response SOP Follow in order the moment you suspect a hacked WordPress site. — Step 1: Don't delete anything yet. Take a forensic snapshot of files and database first. — Step 2: Rotate everything: all password…
@LockdownLedger
29 June 2026
Backup & Restore Drill SOP Run monthly — an untested backup is a guess, not a recovery plan. — Step 1: Confirm 3-2-1: three copies, two media types, one off-site and offline. — Step 2: Verify backups include the database…
@LockdownLedger
28 June 2026
Pairs well with this channel @PingbackClinic — Your uptime and monitoring questions answered. 'Why do I get false downtime alerts?'… Quietly one of the better feeds in the space.…
@LockdownLedger
27 June 2026
Admin Area Isolation SOP Apply to every site where wp-admin is internal-only. — Step 1: Restrict /wp-admin/ by IP at the server. Allow your office, VPN, and CI runners; deny the rest. — Step 2: Add HTTP basic auth in fro…
@LockdownLedger
26 June 2026
Plugin Vetting SOP Run before installing any new plugin or theme. — Step 1: Check last-updated date. Untouched in 12+ months = abandoned, treat as a liability. — Step 2: Cross-reference the slug against a CVE database. K…
@LockdownLedger
25 June 2026
Server Access Hardening SOP Run before putting any web server into production. — Step 1: Disable password SSH. Set PasswordAuthentication no and use keys only. — Step 2: Disable root login. PermitRootLogin no, then sudo …
@LockdownLedger
24 June 2026
WP-Cron Hardening SOP Run on every production WordPress site for reliability and DoS resistance. — Step 1: Disable pseudo-cron. Set DISABLE_WP_CRON to true in wp-config.php — every page load triggering cron is a load and…
@LockdownLedger
23 June 2026
Uploads Directory Hardening SOP Do this on every site that accepts file uploads. — Step 1: Block PHP execution in wp-content/uploads/. The classic backdoor is a .php disguised as an image landing here. — Step 2: For Ngin…
@LockdownLedger
22 June 2026
Database & Secrets Hardening SOP Apply during every new-site provisioning. — Step 1: Set a custom table prefix at install. Not wp_, and not a guessable word — use a random short string. — Step 2: Give the WordPress DB us…
@LockdownLedger
21 June 2026
REST API Lockdown SOP Run on every WordPress site — the API is open by default. — Step 1: Test exposure. Hit /wp-json/wp/v2/users — if it returns names and slugs, you're leaking your login usernames. — Step 2: Require au…
@LockdownLedger
20 June 2026
WAF Rule-Tuning SOP Do this after deploying any web application firewall. — Step 1: Start in log/detection mode for 7 days. Never go straight to block on a live store. — Step 2: Enable the OWASP Core Rule Set at paranoia…
@LockdownLedger
19 June 2026
Login Lockout Policy SOP Configure on every site that has a wp-admin login. — Step 1: Set the threshold. 5 failed attempts, then a 20-minute lockout. Escalate repeat offenders to 24 hours. — Step 2: Lock by username AND …
@LockdownLedger
