01 August 2026
Case: Staged Auto-Updates Closed the Patch Gap From 23 Days to 1 Client's mean time to patch a disclosed plugin CVE was 23 days. Two incidents traced to known, unpatched bugs. Update SOP: — Step 1: Enable WordPress core …
@LockdownLedger
31 July 2026
Case: Moving wp-admin Behind Allowlist Cut Login Bot Load 99% Login page took 6,700 bot hits/day. Owner refused a plugin-based hidden URL (too fragile). Allowlist SOP at nginx: — Step 1: Restrict /wp-login.php and /wp-ad…
@LockdownLedger
30 July 2026
Case: PHP-FPM Pool Separation Contained a Single-Site Breach Shared box ran 6 WordPress sites under one PHP-FPM pool, one Linux user. One compromised site let the attacker read all 6 wp-config.php files. Isolation SOP: —…
@LockdownLedger
29 July 2026
Case: Key-Only SSH Ended 12k Daily Root Probes A VPS logged 12,300 SSH brute-force attempts/day against root over password auth. SSH SOP: — Step 1: Add your key, test login in a second session before locking anything. — …
@LockdownLedger
28 July 2026
Pairs well with this channel @NetworkMythHQ — We pressure-test what Ezoic, Mediavine and Raptive actually pay versus what their… Quietly one of the better feeds in the space.…
@LockdownLedger
27 July 2026
Case: Blocking REST User Enumeration Stopped Targeted Brute-Force Attackers were pulling usernames from /wp-json/wp/v2/users, then brute-forcing those exact accounts. 12 valid usernames were exposed. Enumeration SOP: — S…
@LockdownLedger
26 July 2026
Case: wp-config Hardening Blocked a Live Disclosure Attempt During an audit, wp-config.php was world-readable and the DB user had full GRANT ALL. Hardening SOP: — Step 1: chmod 600 wp-config.php, owner = the PHP user onl…
@LockdownLedger
25 July 2026
Case: One Rate-Limit Rule Absorbed a 220k-Request Burst A Black Friday landing page got hit with a layer-7 burst: 220,000 requests in 11 minutes from 1,400 IPs, all hammering /?s= search. WAF SOP we keep ready: — Step 1:…
@LockdownLedger
24 July 2026
Case: Five Headers Moved Observatory From F to A+ Client site scored F on Mozilla Observatory (15/100). No security headers present. Header SOP, added at the edge: — Step 1: Strict-Transport-Security: max-age=31536000; i…
@LockdownLedger
23 July 2026
Case: Cutting 22 Admins to 4 Shrank the Blast Radius A media site had 22 accounts with administrator role. Nobody could say why. Two belonged to ex-contractors still active. Least-privilege SOP: — Step 1: Export all user…
@LockdownLedger
22 July 2026
Case: One chmod Sweep Found 1,847 World-Writable Files Inherited a hosting account after a malware cleanup. A previous "fix" had set huge swaths of files to 0777. Audit SOP: — Step 1: Inventory the damage. find . -type f…
@LockdownLedger
21 July 2026
Case: Mandatory 2FA Cut Account Takeovers to Zero Agency with 63 editor/admin accounts had 3 confirmed takeovers in one quarter via reused passwords from a breach dump. Enforcement SOP we ran: — Step 1: Set a 14-day grac…
@LockdownLedger
20 July 2026
Case: XML-RPC Pingback Flood Killed at 41k req/day Client ran a 9-site WordPress fleet. /xmlrpc.php took 41,200 hits/day, mostly system.multicall credential stuffing. PHP-FPM hit 100% CPU twice weekly. What we ran: — Ste…
@LockdownLedger
19 July 2026
Session & Cookie Hygiene SOP Stolen session cookies bypass the password and the 2FA. Tighten the session layer. — Step 1: Confirm auth cookies carry Secure, HttpOnly, and SameSite=Lax or stricter. — Step 2: Shorten the '…
@LockdownLedger
18 July 2026
Neighbor spotlight: @AdSenseTrenches. They go deep on AdSense — the kind of channel you actually keep notifications on for.…
@LockdownLedger
17 July 2026
wp-config Hardening SOP One file holds the keys to everything. Harden it line by line. — Step 1: Move wp-config.php one directory above the web root where the host allows it. — Step 2: Set DISALLOW_FILE_EDIT and DISALLOW…
@LockdownLedger
16 July 2026
Post-Compromise Triage SOP When a site is hit, panic-restoring overwrites the evidence. Work the order. — Step 1: Take the site offline or behind maintenance — stop ongoing damage first. — Step 2: Snapshot the current st…
@LockdownLedger
15 July 2026
Backup Restore Drill SOP A backup you've never restored is a guess. Test the recovery, not the backup. — Step 1: Confirm backups cover files AND database, stored off the production host. — Step 2: Verify encryption at re…
@LockdownLedger
14 July 2026
TLS Configuration SOP A padlock isn't a config audit. Verify the actual handshake. — Step 1: Disable TLS 1.0 and 1.1 at the server; allow 1.2 and 1.3 only. — Step 2: Remove weak ciphers — no RC4, no 3DES, no CBC where yo…
@LockdownLedger
13 July 2026
WP-Cron Control SOP The default wp-cron.php fires on visitor traffic and is a public DoS handle. Take it server-side. — Step 1: Set DISABLE_WP_CRON to true in wp-config.php. — Step 2: Add a real system cron hitting wp-cr…
@LockdownLedger
12 July 2026
Plugin Vetting SOP Every plugin is code you didn't write running as your site. Vet before install. — Step 1: Check last-updated date. Older than 12 months or untested with current core: reject. — Step 2: Read the changel…
@LockdownLedger
11 July 2026
Admin Surface Reduction SOP You can't brute-force a login you can't find. Shrink the attack surface. — Step 1: Restrict /wp-admin by IP allowlist or HTTP auth where the team works from fixed networks. — Step 2: For roami…
@LockdownLedger
10 July 2026
Database Access Hardening SOP The DB layer is where a compromise becomes permanent. Lock it down. — Step 1: Give the WordPress DB user only the rights it needs day-to-day: SELECT, INSERT, UPDATE, DELETE. No DROP, no GRAN…
@LockdownLedger
09 July 2026
Uploads Execution Block SOP The goal: even if a malicious file lands in uploads, it can never execute. — Step 1: Deny PHP execution in wp-content/uploads at the server level, not via .htaccess alone. — Step 2: Allowlist …
@LockdownLedger
08 July 2026
Quick rec — @RPMReceipts keeps a tight feed on site monetization. If today's post landed, that one's for you.…
@LockdownLedger
07 July 2026
WAF Tuning SOP A WAF in blocking mode on day one breaks your own admin. Tune it. — Step 1: Deploy in detection/log-only mode for 7 days. Capture the false positives first. — Step 2: Build rules for the OWASP top categori…
@LockdownLedger
06 July 2026
Login Lockout Policy SOP Rate-limit by behavior, not just IP — attackers rotate IPs. — Step 1: Lock after 5 failed attempts per username, 20 minutes. Track the username, not only the IP. — Step 2: Add a global cap: more …
@LockdownLedger
05 July 2026
File Permission Audit SOP Wrong permissions are the quietest backdoor. Audit, don't assume. — Step 1: Directories to 755, files to 644: find . -type d -exec chmod 755 {} \; then -type f to 644. — Step 2: Lock wp-config.p…
@LockdownLedger
04 July 2026
XML-RPC Disable + Verify SOP Disabling the toggle isn't enough — confirm the endpoint is actually dead. — Step 1: Block /xmlrpc.php at the web server, not just via plugin. Plugins load too late to stop floods. — Step 2: …
@LockdownLedger
03 July 2026
WordPress Salt Rotation SOP Rotating auth keys invalidates every active session and forces re-login. Run after any suspected compromise. — Step 1: Pull fresh keys from api.wordpress.org/secret-key/1.1/salt/. — Step 2: Re…
@LockdownLedger
