Comments for Making WordPress Secure

Comment on The Core Security Initiative by Rodrigo Vieira Eufrasio da Silva

Rodrigo Vieira Eufrasio da Silva — Mon, 07 Sep 2026 23:26:47 +0000

Really glad to see this framed with quality of reports as a priority, not just volume. From the documentation side, I'd add one thing that could complement the "Crush vulnerabilities with AI" pillar directly: a lot of the ambiguity that generates false positives (both from human researchers and from AI-assisted scanning) comes from core behaviors that are correct but under-documented — permission checks that live in a different layer than the function being flagged, silent failure paths that look like bypasses but aren't, etc. Better inline documentation and DevHub notes on these edge cases wouldn't just help developers avoid misuse; it would give both human triagers and AI tools better signal to distinguish "looks risky" from "is risky," which seems directly relevant to keeping the incoming report queue manageable as volume grows.

Comment on The Core Security Initiative by Ahmed Kabir Chaion

Ahmed Kabir Chaion — Wed, 02 Sep 2026 09:31:02 +0000

+make.wordpress.org/hosting/

Comment on Updates to the WordPress Vulnerability Disclosure Program by Sander van Dragt

Sander van Dragt — Wed, 02 Sep 2026 07:19:10 +0000

In reply to John Blackbourn.

Thanks for the update. Has the level of ineligible reports changed recently? If not, is this a decision on what the team should prioritise? Would be interested in any lessons you can share about this. Cheers.

Comment on The Core Security Initiative by Marc

Marc — Tue, 01 Sep 2026 16:34:24 +0000

thanks for clarification.
Do you plan to work on preventive mesures like making account enumeration not easy by default to prevent from brute force technics ?
ex: by default, the account are too easily guessable for anyone knowing how to retrieve the account identifiers through Rest, Author link in templates, oEmbed calls, numbers from comment authors, Author sitemap, RSS/Atom feeds, not enforced nick names (so the account get the username)…
ex: Is there a plan to deprecate the old xml_rpc way ?

Woud be nice to ship a minimal hardening. Some will ask for 2FA, but why not hardening first on the basics ?
Maybe by adding in site health a page to give some advices or alert from weakenesses by adding some checks ?

Comment on Updates to the WordPress Vulnerability Disclosure Program by John Blackbourn

John Blackbourn — Tue, 01 Sep 2026 13:00:30 +0000

+make.wordpress.org/core/

Comment on The Core Security Initiative by Stefano Picco

Stefano Picco — Tue, 01 Sep 2026 08:53:32 +0000

Sounds great

Comment on The Core Security Initiative by Cédric Aimé Fotso

Cédric Aimé Fotso — Tue, 01 Sep 2026 08:46:33 +0000

Wishing the team lots of courage.

Comment on The Core Security Initiative by Torsten Landsiedel

Torsten Landsiedel — Sat, 29 Aug 2026 11:00:57 +0000

It would be great to see a feature plugin to explore ideas for enhancing site security in a feature plugin (like the performance and AI teams does it).

I don’t talk about a complete security suite, but some low-hanging fruits. Hardening recommendations. Integrity checks. Warning on abandoned/closed plugins. Things like that …

See: https://x.com/zodiac1978/status/2093292207197368631?s=20

Comment on The Core Security Initiative by John Blackbourn

John Blackbourn — Fri, 28 Aug 2026 17:00:29 +0000

+make.wordpress.org/core/

Comment on Hardening GitHub Actions workflows across the WordPress organisation by John Blackbourn

John Blackbourn — Mon, 13 Jul 2026 21:30:50 +0000

+make.wordpress.org/core/
+make.wordpress.org/cli/
+make.wordpress.org/ai/