Guides

Plain-English guides for WordPress and WooCommerce owners. Each one starts with what you can do yourself, for free.

Logins and accounts

• How to limit login attempts in WordPress: lockouts that cover every login door, and what to do about botnets that spread their guesses.
• How to hide your WordPress username: the five places WordPress shows usernames, and how to close each one.
• Leaked passwords on WordPress: why login limits don't stop them, and how breached-password checks work, privately.
• Getting password reset emails you didn't ask for? What they mean, whether anyone can get in, and how to stop them.
• Should you change your WordPress login URL? What it stops, what it misses, and what to do instead.
• WordPress XML-RPC: is it a security risk, and should you turn it off?
• Is your WordPress debug.log public? How to check in 10 seconds, and three ways to fix it.

Forms

• How to stop contact form spam in WordPress: the settings Contact Form 7 and WPForms already have, and how to stop most spam without a puzzle.

Stores

• WooCommerce bot protection, door by door: what WooCommerce, CAPTCHAs, Cloudflare, Wordfence and your payment provider each stop, and what's still open.
• Ropeline for any website: not on WordPress? One API call before a login, signup, checkout or form post says allow, challenge or block. Node, PHP, Python or a Cloudflare Worker.
• Cloudflare rules for WordPress and WooCommerce: a free tool. Answer three questions, copy the rules that fit your site on Cloudflare's free plan.
• Card testing on WooCommerce: how to spot it, what to do in the next hour, and how to stop it for good.
• Failed orders with Origin "Unknown": what the label does and doesn't prove, and what to do in the next hour.
• Does Wordfence stop card testing? What Wordfence's own support says, and what does stop it.
• Shield Security or Ropeline? An honest comparison for WooCommerce stores, door by door, and when you want both.
• Bots guessing coupon codes: the coupon settings that make guessing pointless, and how to limit tries.
• Fake account signups on WooCommerce: why bots make them, the settings that close the easy doors, and how to clean up.
• WooCommerce and PCI DSS 4.0: the checkout script rules, and which ones apply to your store.
• AI shopping agents: how to let the real ones in and keep the fakes out.