The Morning I Found a Plugin I Never Installed
July 13, 2026
A plugin folder appeared on my site that I never installed. It was caught before it did damage, and the investigation changed how I run every part of my WordPress stack.
Series: Your Website Is Your Beacon
A seven-part series on protecting the website your business credibility lives on. It began the morning a plugin appeared on my site that I never installed. From there: why commercial themes are Frankenstein monsters, what it costs to leave a page builder, how to put your plugin stack on a diet, why the number of maintainers matters, how the supply chain delivers attacks through trusted channels, and why security is a posture, not a plugin.
Your Website Is Your BeaconWhy So Many WordPress Themes Are Frankenstein Monsters
July 13, 2026
I opened up the theme running my website and found dead code, three settings systems, and an animation for an element that never existed. Here is why commercial themes end up this way and what you can actually do about…
Your Website Is Your BeaconDivorcing Your Page Builder: What It Cost Me to Leave
July 13, 2026
I have left two page builders: one because it was hurting my site, one while genuinely admiring it. Both exits cost the same, because the price was never about quality. It was about depth of embedding.
Your Website Is Your BeaconThe Plugin Diet: Trimming WordPress Without Losing Muscle
July 13, 2026
Plugins are generally in better shape than themes, but they grow sideways: the tool you installed for one job quietly becomes a platform doing fifteen. An afternoon audit puts the stack back on a diet.
Your Website Is Your BeaconThe Single Maintainer Problem: Who Keeps Your Software Alive?
July 13, 2026
Before installing any software, ask how many people keep it alive. The number is public, takes five minutes to find, and predicts more grief than any feature list. The story of an excellent theme with a bus factor of one.
Your Website Is Your BeaconThe Supply Chain Is the Attack Surface
July 13, 2026
The attack that reached my site did not come at it. It came through it, riding a trusted update channel. Why supply chain attacks scale, why they extend to hardware, and how to manage a chain you cannot eliminate.
Your Website Is Your BeaconWordPress Security Is a Posture, Not a Plugin
July 13, 2026
Every article in this series was secretly about security. The capstone: why the green checkmark is a component and not a defense, what a working posture looks like in practice, and the five questions no product can answer.
Your Website Is Your BeaconContent Decay: Why Your Best Posts Quietly Stop Working
August 21, 2026
Old posts lose traffic quietly, on two separate clocks: the slow slide down search rankings, and the newer one where a page keeps its ranking and stops being cited in AI answers. Here is how to audit both and repair…
Your Website Is Your BeaconTraining Crawls and Live Queries Are Not the Same Thing
August 21, 2026
A training crawl is a machine reading your site to teach a model, and it may never send you a human being. A live query is a person asking a question right now. Only the second one is traffic.
Your Website Is Your BeaconMost of Your Website Traffic Was Never Human. I Checked.
July 30, 2026
Cloudflare found human traffic down at least 35 per cent across every major industry in under a year, and more than half of all internet traffic is now non-human. This week I filtered my own site properly and checked the…
Your Website Is Your BeaconWriting to Get Found by AI Instead of Just Ranked
June 17, 2026
The old game of stuffing keywords to rank is dying. Writing that gets found in 2026 answers a real question clearly, from a source a machine can trust.