https://blog.wapnet.nl/tag/github/Recent content in Github on Wapnet BlogHugoen-USSun, 25 Oct 2026 07:00:00 +0100https://blog.wapnet.nl/2026/10/from-wordpress-to-hugo-after-a-php-scare/Sun, 25 Oct 2026 07:00:00 +0100https://blog.wapnet.nl/2026/10/from-wordpress-to-hugo-after-a-php-scare/<p><strong>The Wake-Up Call</strong></p> <p>A few days ago my hosting provider sent me a friendly message: <em>&ldquo;Warning: 500 emails have just been sent by your account.&rdquo;</em> Not what you want to read on a Saturday evening.</p> <p>My first thought: someone dropped a PHP shell on my WordPress blog and is using it as a spam cannon. I renamed PHPMailer as an emergency brake and started digging.</p> <p><strong>What It Actually Was</strong></p> <p>The good news: no shell. WordPress core and all plugins passed their checksum checks, and there were no unknown admin logins. The culprit was my own security plugin. Wordfence was blocking a brute-force wave of about 500 login attempts, and it was configured to send me an email for <em>every single block</em>, with no hourly limit. So the security plugin did its job and still got me an abuse warning.</p>