-
·
Two thermostats, one furnace
When another plugin overrides a WordPress setting, you probably won’t notice unless you’re looking for it. WordPress lets any number of plugins weigh in on the same setting, and the last one to run wins silently. If it changes your update policies, you probably want to know. That’s why Keel now reports what your update policy is, what’s blocking it, and which other plugins are working the same hooks.
-
·
I didn’t build a 2FA plugin. I filed bugs, then built around the best one.
WordPress’s canonical Two Factor plugin is a solid workhorse with a minimalist design. It has no policy and onboarding features, so when I needed those, instead of writing yet another 2FA plugin, I got more involved with Two Factor and created my own add-ons.
-
·
Sudo’s tests agreed with Sudo. WordPress didn’t.
Sudo passed 1,663 tests while missing seven ways to bypass its reauthentication prompt. Its code and tests shared the same mistaken model of WordPress requests. The lesson: check the assumptions against core, use independent review, and prove that tests fail when the guard is removed.
-
·
Why I retired my own security plugin
Sudo was a plugin that asked WordPress administrators for their password before they did something dangerous. An AI audit found seven ways around it with an active admin session. That points to a fundamental architectural problem that only WordPress core can address.
-
·
Keel Defaults
Keel surfaces 40 (soon 41) WordPress core defaults with their own controls and reports their real state in Site Health. Keel also tells you when your version of WordPress core has known vulnerabilities, and when it’s eligible for same-branch security updates as well as major version jumps.
If you don't visit the bad neighbourhoods, the bad neighbourhoods will visit you.
WordPress Plugins
Plugin design, development, interoperability, and the effects of extending WordPress.