Myth-Busting SOP: 'We Have HTTPS, So the Site Is Secure'

Myth-Busting SOP: 'We Have HTTPS, So the Site Is Secure'

TLS encrypts transport. It does nothing against SQL injection, weak passwords, or a vulnerable plugin. Close the gap:

— Step 1: Confirm HTTPS is enforced, then stop treating the padlock as a finish line.
— Step 2: Add HSTS: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
— Step 3: Patch application layer — auto-update core, audit plugins monthly.
— Step 4: Enforce 2FA and least-privilege roles; TLS protects the password in transit, not a leaked one.
— Step 5: Verify with a vuln scanner (wpscan, Nikto) over the live HTTPS site — the padlock won't catch what they find.

Encryption protects the wire, not the app. Run this every time.