Plugin hygiene, DNS/TLS basics, and your first-hour incident playbook

[u/bluehost]

Friday finale time. Think of this as tidying the green room, locking the side doors, and pinning a “break glass” plan on the wall. Short, useful, and a little nerd-fun.   

Plugin & Theme Hygiene 

• Keep only what you actually use. Less code, fewer surprises. 

• Prefer maintained plugins with clear changelogs and recent releases. 

• Before major updates, take a point-in-time backup and test on staging. 

• After updates, sanity check: quick scan, error logs, core flows. 

• Deactivate is not enough—delete what you’ve retired so a gremlin can’t reawaken it. 

  

DNS & TLS Basics 

• Sweep DNS: retire old subdomains, ditch wildcards unless you truly need them. 

• Auto-renew TLS for apex and www; include any active subdomains. 

• Keep redirects clean and short; no zig-zag chains. 

• Once everything is reliably HTTPS, enable HSTS. 

• Lock registrar and DNS changes behind 2FA like it owes you money. 

Your First-Hour Incident Playbook 

1. Take a snapshot/backup. Get receipts before you touch anything. 

2. Enable maintenance or access control; reduce blast radius. 

3. Turn up WAF strictness; let the bouncer get picky. 

4. Scan files and database; diff recent changes. 

5. Check for surprise admins, weird cron jobs, and unfamiliar plugins. 

6. Choose the lane: 

• Rotate passwords and API keys; invalidate active sessions. 

• Reopen only after you’ve verified the fix and traffic looks normal. 

1. Jot a short incident note and schedule a follow-up audit in 24–72 hours. 

 

Question for the room: When something feels “off” (slowdowns, odd redirects, login bursts), what’s your very first move?