SEC
Security & Hardening
Capability checks, nonces, sanitisation, SQL safety and threat modelling for plugins.
The Capability Checks People Forget at Three Entry Points
REST routes, admin-ajax handlers and admin-post actions each need their own guard. Here is the check each one requires and why the admin menu is not protection.
SEC
Tomas Lindqvist
15 SEP 2026 · 7M
A Nonce Proves Intent, and Never Permission to Act
WordPress nonces are short-lived CSRF tokens, not permission checks. Where they fail, why the failure looks like a logout, and what to pair them with.
SEC
Tomas Lindqvist
03 AUG 2026 · 9M
Where $wpdb->prepare() Protects You, and Where It Cannot
prepare() escapes each value and splices it into a query string. Here is what that contract covers, and the identifiers, wildcards and shapes it never touches.
SEC
Tomas Lindqvist
02 JUL 2026 · 9M
Threat Modelling a WooCommerce Plugin in Ninety Minutes
Four questions, seven trust boundaries and a table you can fill in as a team. What a ninety-minute threat model finds, and the class of bug it will never find.
SEC
Tomas Lindqvist
28 APR 2026 · 9M
Handling File Uploads in a Plugin Without Creating an Incident
The type field in $_FILES is whatever the browser sent. Upload handling starts with an allowlist, a content check and a filename the client never chooses.
SEC
Tomas Lindqvist
05 FEB 2026 · 8M