Articles
Writing on plugin provenance: who controls the code on your site, how that changes, and what the public record actually shows.
-
How to check who owns a WordPress plugin
Everything you need is public. It takes about three minutes per plugin, and the part most guides skip is the part that matters.
-
The 2026 WordPress supply-chain attacks: what happened, and what each one teaches
Two separate compromises hit WordPress plugins in 2026. They are usually discussed together, and they were not the same kind of attack at all.
-
Every way a WordPress plugin can change hands
You are trusting whoever controls each plugin on your site today, not whoever wrote it. Here is every way that person changes.
-
Reading a WordPress plugin’s SVN commit history
Every plugin in the directory has a public repository. Most people never open one. It answers questions the directory page cannot.
-
An agency’s plugin provenance checklist
You did not choose most of the plugins you maintain, and you will still be the one answering for them. This is a routine that fits in an hour a month.