Protecting WordPress sites on Trellis: fail2ban, Nginx deny lists, malware scanning, IP reputation checks and hardening.

• Case No. — Security Documented

  Locked Out of WordPress: Create a Temporary Admin With WP-CLI Over SSH, Then Delete It

  A lost admin password, a plugin that broke the login, an admin email that no longer exists: when you cannot log in but you can reach the server, WP-CLI gets ...

  Oct 30, 2026 · wordpress wp-cli security admin
• Case No. — Security Documented

  A Weekly and Monthly Security Routine for Trellis WordPress Sites: fail2ban, Scans, and Checking IPs Against AbuseIPDB Before You Block Them

  Security on a Trellis site comes in layers, and each layer needs a little attention on a schedule. None of it takes long. What goes wrong is that nobody chec...

  Oct 29, 2026 · wordpress trellis security fail2ban
• Case No. — Security Documented

  A Permanent Nginx Deny List on Trellis: When It Beats fail2ban, CIDR Ranges, and How Not to Lock Yourself Out

  fail2ban is the right default: it detects an attacker, bans the address for a while, and needs no upkeep. Its weakness is that a ban expires and a rotating a...

  Oct 29, 2026 · wordpress trellis nginx security
• Case No. — Security Documented

  Reading WordPress Malware Scan Results: Severity Levels, the False Positives You Can Ignore, and the Checks After a Compromise

  A scanner that prints 86 matches is only useful if you can tell which three matter. The questions that come up every time: how urgent is a HIGH, is xmlrpc.ph...

  Oct 29, 2026 · wordpress security malware false-positives
• Case No. — Security Documented

  Two WordPress Malware Scanners and Checksum Verification: What Each One Catches, and How to Run Them on Any Host

  A WordPress malware scan has to do two opposite things: be sensitive enough to catch an eval(base64_decode(...)) in a theme file, and quiet enough that you s...

  Oct 29, 2026 · wordpress security malware wp-cli
• Case No. — Security Shipped

  fail2ban for wp-login.php on Trellis: Turn the Jail On, Anchor the Filter, Keep an Nginx Deny List for the Rest

  One IP address tried to log in to /wp-login.php 1,420 times in two months on a production Trellis server. Two more tried 860 and 742 times, and over 40 other...

  Oct 28, 2026 · wordpress trellis fail2ban nginx
• Case No. — Devops Documented

  WP-CLI One-Liner: Generate and Set a Secure Password Without the Shell History Risk

  The command reads like a haiku, but it solves a problem that bites everybody at least once:

  Sep 21, 2026 · wordpress wp-cli cli security
• Case No. — Security Shipped

  wp-ops malware-scan: Checking a Remote WordPress Site Without Leaving Anything Behind

  Malware scanning a WordPress site you can only reach over SSH used to mean a small ritual: scp the scanner script up to /tmp, run it, and remember to delete ...

  Sep 11, 2026 · wordpress security wp-cli trellis
• Case No. — Devops Documented

  The Administration Email Field Doesn't Change the Administration Email

  I opened Settings → General on a client site this week and found this sitting above the email field:

  Sep 3, 2026 · wordpress wp-cli cli admin
• Case No. — Devops Shipped

  The Seven Commands I Actually Run Every Day (And Why I Stopped Memorizing Them)

  For a long time, my daily WordPress ops routine lived in shell history. Pull a database, sync some uploads, eyeball a security log, glance at a client site’s...

  Aug 29, 2026 · wordpress trellis wp-cli ansible
• Case No. — Security Hardened

  WP 2FA on Roots Bedrock/Trellis: Per-Environment Encryption Keys and a Composer Patch for a Fatal Bug

  We added WP 2FA (two-factor authentication) to a client site this week to help lock down /wp-login.php after a brute-force wave that hit us — 20 IPs, 176 to ...

  Jul 3, 2026 · wordpress php security 2fa