WordPress security glossary

Access and authentication

SSH key authentication

A way to log in to a server with a cryptographic key pair instead of a password. The private key stays with the connecting machine, and the public key is placed on the server. No password is transmitted, and a key can be revoked without changing anything else about the account. A key still grants whatever access the account has, so the private key should be treated like a password. Read more: SSH keys vs passwords.

Two-factor authentication (2FA)

A second proof of identity beyond a password, usually a time-based code from an app, required at login. It stops most credential-stuffing and brute-force attacks even when a password has leaked, because the attacker still needs the second factor.

Brute-force attack

An automated attempt to guess a login by trying large numbers of username and password combinations. The default WordPress login form (wp-login.php) is a common target because it is predictable and rarely rate-limited out of the box. Read more: Brute-force login attacks.

Credential stuffing

An attack that reuses username and password pairs leaked from breaches on other sites, betting that some owners reused the same password. Unlike brute force, it does not guess. It replays credentials known to be real somewhere.

Privilege escalation

A vulnerability that lets a low-permission account, or an attacker with no account at all, gain administrator access. Often the real damage of a WordPress hack is not the entry point but what the attacker escalates to afterward.

Detection and response

Malware

Software written to harm a site or its visitors: spam injection, redirects, credential theft, backdoors and cryptocurrency miners are common kinds on WordPress sites.

Core file integrity

A check that compares WordPress's own files, the core install and not themes or plugins, against the official checksums published by WordPress.org. A mismatch usually means a file has been modified or replaced, which is one of the clearest signs of compromise. Read more: Core file integrity check.

Malware quarantine

Moving a flagged file out of its normal location instead of deleting it, so the site keeps running while the finding is reviewed and the original can be restored if the flag was a false positive. SiftWP quarantines files rather than deleting them.

Backdoor

Code an attacker plants to regain access even after the original vulnerability is patched, often a small, obfuscated file that accepts remote commands. Backdoors are why deleting the visible malware alone often does not fix a hack. Read more: How to find a backdoor.

Webshell

A kind of backdoor: a script, frequently disguised as an image or plugin file, that gives an attacker a command-line-like interface to the server through web requests.

Obfuscation

Code deliberately scrambled so it is hard to read, often with functions such as base64_decode or gzinflate. Legitimate software uses some of the same functions, so obfuscation alone is not proof of malware. Read the file before judging it. Read more: How to remove malware.

False positive

A legitimate file or behavior flagged as malicious, for example a theme's minified JavaScript that happens to match a pattern used by real malware. Quarantining instead of deleting makes false positives cheap to undo.

SEO spam (pharma hack)

Injected pages or hidden links that promote pharmacy, gambling or similar sites, often shown only to search crawlers (cloaking) so the owner does not see them. The first sign is often spam pages appearing in site:yourdomain.com searches. Read more: How to tell if your site is hacked.

Attack types

SQL injection

An attack that inserts malicious database commands through an input that was not properly sanitized, such as a comment box, search field or URL parameter, to read, change or delete data.

Cross-site scripting (XSS)

An attack that injects malicious JavaScript into a page that other users view. The script runs in the victim's browser with their session, which can be used to steal cookies or act as them.

Zero-day vulnerability

A security flaw that is exploited or disclosed before the vendor has released a fix. Zero-days in popular plugins are dangerous because one flaw can affect hundreds of thousands of sites at once.

CVE (Common Vulnerabilities and Exposures)

A standard ID, for example CVE-2026-XXXXX, assigned to a publicly disclosed vulnerability so it can be tracked consistently across tools and advisories.

Nulled plugin

A pirated copy of a paid plugin with its license check removed, usually distributed outside the official marketplace. Nulled plugins are a frequent malware source, because the crack is often how the malware is delivered.

Infrastructure and hardening

Web application firewall (WAF)

A filter that inspects and blocks malicious traffic before it reaches your server, usually at the DNS or CDN level or inside the application. A WAF blocks a broad class of known attack patterns but does not tell you whether something already got through. Read more: Do you need a firewall?.

Virtual patching

A firewall rule that blocks exploitation of a known vulnerability without changing the vulnerable code, useful as a stopgap when a plugin update is not available yet or has not been applied. Read more: SiftWP vs Patchstack.

File permissions

Unix-style rules, commonly written as numbers like 644 or 755, that control who can read, write or run a file on the server. Overly permissive settings, such as a world-writable wp-config.php, make it easier for an attacker with any foothold to change files. Read more: File permissions explained.

wp-config.php

WordPress's main configuration file, holding database credentials and security keys. It is one of the highest-value targets on an install, since access to it usually means access to everything. Read more: How to secure wp-config.php.

Security keys and salts

Random values in wp-config.php used to protect the information in login cookies. Rotating them ends every existing session, including an attacker's, which is a useful step after a suspected compromise.

Must-use plugin (mu-plugin)

A plugin placed in wp-content/mu-plugins that loads automatically and cannot be deactivated from the normal plugin list. It appears under a separate Must-Use tab, and attackers use the folder as a hiding place. Read more: How to remove malware.

Database prefix

The string, wp_ by default, added to the start of every WordPress table name. Changing it gives only mild obscurity. It will not stop a targeted attack, but it filters out the least sophisticated automated SQL-injection attempts.

.htaccess

An Apache server configuration file that can restrict access to files or folders, redirect requests and block traffic patterns. It is often used to protect wp-config.php, disable directory listing or block xmlrpc.php, and it is also a common place for injected redirect rules.

XML-RPC

A WordPress API (xmlrpc.php) for remote publishing and other actions, historically abused for brute-force logins and pingback-based DDoS traffic. Many sites turn it off if they do not use remote publishing.

REST API abuse

Misuse of WordPress's built-in REST API, for example listing usernames through the default /wp-json/wp/v2/users endpoint, which then feeds a brute-force or credential-stuffing attack.

Rate limiting

Restricting how many requests, such as login attempts, one source can make in a time window. It is one of the simplest defenses against brute force, and one of the most often missing on a default WordPress install.

Uptime monitoring

Continuous checking that a site is reachable and responding correctly. It is not a security control by itself, but a sudden outage is sometimes the first sign of a hack, such as a defaced homepage, a crashed database or a redirect loop.