WPDeeply
WordPress Security Guides
Practical WordPress security guides: plugins, vulnerability types, hardening and malware.
Four clusters, each answering a different question. Start with plugin security if you are trying to decide whether something on your site is safe to keep.
Plugin security
How to judge, replace and remove plugins — evaluating a plugin before install, reading update gaps, and what a WordPress.org removal actually means.
Vulnerability types
What the vulnerability classes mean — SQL injection, XSS, CSRF, RCE, privilege escalation and friends, explained with real WordPress examples.
Hardening
Configuration that reduces risk — wp-config, file permissions, admin access, headers, XML-RPC and the REST API.
Malware
Detection and cleanup — recognising an infection, cleaning it properly, and stopping reinfection.