If you self-host a WordPress blog, or any other blog, behind Cloudflare Tunnel, update its connector now. Cloudflare’s email reached me on October 26 under the subject “[Action Required] Upgrade your Cloudflare Tunnel to version 2026.10.2 or later”.
Tagged WordPress
PHP2Shell Vulnerabilities Affect WordPress
If you run a WordPress blog, check that your host has patched PHP. The PHP project released emergency fixes on October 21 for two critical vulnerabilities, known as PHP2Shell, that can let an attacker execute code without logging in. WordPress runs on PHP, but the usual WordPress, theme and plugin updates do not update PHP itself.
Retiring Pingbacks and XML-RPC Same Day, Housekeeping WordPress with AI Pt. 1
On October 12, I closed pingbacks on Mad Tea Party. Technically, it wasn’t pingbacks that started it. It was XML-RPC. During the routine check on Cloudflare, the AI noticed an address posting to /xmlrpc.php about every ten seconds. I assumed the usual botnet scanning for WordPress installations, and wasn’t expecting anything as dramatic as what turned up.
Streamlining Analytics, Migrating with AI Pt. 5
Post-migration, I knew some jobs were left untouched. Not because of the amount of work involved — again, I don’t think the workload has meaningfully increased. For the first project afterward, I wanted to focus on a part of the website I hadn’t touched in a while: analytics.
To Self-Host or Not To Self-Host, Migrating with AI Pt. 4
No doubt the idea of complete control of a blog at $10 a year would be appealing for many. And no doubt many would share the same concerns as I do. During the planning phase, some of the definitive downgrades I was able to come to terms with, some of the regained controls I was able to make use of, and the saved cost I was ready to file under an existing list of subscriptions. I believe there are three major concerns most bloggers may have: uptime, support, and technical debt to AI.
The Part Where I Pay, Migrating with AI Pt. 3
The plan finished baking. Reviewed, revised, the whole nine yards. I wasn’t going to execute the plan myself; I wanted to automate it as well. The only decision left was how.
Between Cost of Hosting and Effort of Self-Hosting, Migrating with AI Pt. 2
Starting a blog doesn’t cost money. At least that’s how I started back in the 2000s, and free platforms are still around. Intermediary platforms came along in the 2010s, giving some control back to bloggers or sharing the ad revenue. The way out of it all, ever since the term weblog was coined, was to run it yourself — either on a machine from a paid hosting service or on your own home server. The question was price and effort.
The Day Hosting Failed Me, Migrating with AI Pt. 1
Mad Tea Party was down for 24+ hrs. A datacenter problem. I’m not arguing a professional hosting service should have zero downtime. Failure itself is expected. Reliability is what happens after it. A full day of downtime is one full business day lost, and a good hosting service should be judged not only on physical performance, but on clear communication during a sudden failure and reasonable effort to reduce it.
App to Identify wp2shell Vulnerability on WordPress
If your WordPress has automatically installed an update, this is the retroactive PSA on why WordPress has urgently issued one. If it hasn’t, consider it an urgent PSA. There is a vulnerability in WordPress Core, disclosed July 17, affecting 6.9.0–6.9.4 and 7.0.0–7.0.1. The attack surface is Core itself: no compromised plugins, themes, or custom code. As far as I could find, with an estimated 500 million+ websites running the platform, WordPress has decided to push the update rather aggressively.
How to Add Custom Text Around WordPress Comments
After the 30 days decision, the first change I wanted to make immediately to the site was letting readers know that comments will be closed after certain period. I didn’t get into details before, WordPress simply doesn’t load comments section if the post in question doesn’t have any comments and the submission is closed. In other words, there is “around the comments” control for the site admin or the site builder. Any actions would need to be hooked to the body of the contents or beginning of the footer.
How to Change Comments Closed Message on WordPress
On WordPress, the default behavior for comments section has an oddly hidden notification message. It is only shown when a post already has some comments, and the comment section must be closed for future submission. It simply reads: “Comments are closed”. It sounds obvious and communicates to the fact why the comment field is not visible, but the site moderator or designer is not given control over the text message itself — which is, again, weird.
AI Spams and Comment Moderation
Many websites have some common unwritten rules on comment moderation — most common of which is locking or closing comments after certain duration. I believe Reddit has it at 6 months, under some of the news articles they have it at 14 days, and some chatting-like discussions, they keep it tight at 48 hours. The Mad Tea Party is now closing comments (Trackbacks and others still work) after 30 days.
App to Disable WordPress Native Functions
There are several native WordPress features that fell out of use naturally, or became loopholes bloggers would want to plug, or became the subject of privacy regulations. WordPress is a strong platform that enables much of the extra toppings that, in my opinion, at the time sounded like interesting social media features.
How to Self-Host Google Fonts on WordPress
If you have noticed outage, I must apologize. I was experimenting with what can be or should be done with Google Fonts. Of many things Google offers for free, Google Fonts is the platform caters to creative purposes without extra charge. Many font creators contribute towards the goal, and some of the fonts, such as Nanum series from Naver, became de facto fonts (for Korean language) for many. And Google is open to let other websites to take advantage of it.
App to Add 2FA on WordPress
Surprisingly, WordPress supports neither 2FA (two-factor authentication) nor passkeys. Considering the prevalence of both and how readily available they have become, it’s still hard for me to believe WordPress does not have native solutions. Websites, of any kind, due its nature, are bound to be exposed. No wonder why WordPress is being preyed on.