Year: 2026

WordPress is a free, open-source content management system used to create and manage websites without needing much coding (WordPress.com: Everything You Need to Build Your Website).

The tool let you build (The Build websites, write blog posts, Design pages, Manage content easily) from a dashboard.

WordPress itself is secure, but poor setup such as (Weak passwords, Outdated plugins and others) can make a site vulnerable which leads to the threat actors targeting your website.

To prevent it, we need to follow some recommendations. Let's have a look at them.

Recommendations:

• Update WordPress core, themes regularly
• Auto update for the plugin or regularly scan to detect any vulnerability
• Delete unused plugins, themes
• Use long, unique passwords not reused anywhere
• Change the default “admin” username
• Enable 2FA (two-factor authentication)
• Block malicious traffic
• Limit login attempts
• Install an SSL certificate such as Let’s Encrypt
• Daily or weekly backups
• DDOS protection plugin
• Maintenance windows plugin
• Plugin to accept or refuse the usage of Cookies
• Banner for GDPR or Privacy plugin
• Reduce brute-force attacks on your WordPress site by hiding wp-login.php changing the login URL so bots can’t easily find it.
• Store backups off-site
• Change default database prefix for example mywebsite.com/wp-admin to mywebsite.com/change
• Restrict file permissions:
• wp-config.php contains your database credentials, security keys, and sensitive settings, so it should be protected by following the recommendations:
• Move wp-config.php outside web root
• Add .htaccess protection
• Set permissions to 400/440
• Disable file editing plugin if not needed
• Disable XML-RPC if not needed
• Hide WordPress version
• Use a Web Application Firewall
• Hide all the webpage or make them not accessible for example
• Add to robots.txt. For example:

User-agent: *
Disallow: /

Or

Block access via .htaccess:

Order Deny,Allow

Deny from all

Allow from YOUR_IP

• Protecting phpMyAdmin is critical because if someone gets access, they can control your entire WordPress database (users, passwords, content, everything).
• Change or hide phpMyAdmin URL:

Default URLs:

/phpmyadmin
/pma
/mysql

Like you see, they are many configurations and settings to implement to make your WordPress website more secure. Be aware that security should be the first step to start your WordPress journey.

Electronic signature platforms such as Docusign, Dropbox Sign, Google Docs, OneDrive signature and Adobe Sign have revolutionized business processes by enabling fast, paperless transactions. However, cybercriminals have also recognized their potential as a vector for phishing attacks. By mimicking legitimate signing requests, attackers trick users into revealing sensitive information or downloading malware.

Techniques used by threat actors to trick users:

Fake Signing Requests

Attackers send emails that look like legitimate requests from trusted platforms such as Docusign, Adobe Sign. These emails often contain urgent language like “Your signature is required immediately.”

Malicious Links

The email includes a link to a fake login page mimicking the real service. Victims enter credentials, which attackers steal.

Malware Delivery

Some phishing emails include attachments disguised as documents to sign, which actually contain malware.

Business Email Compromise (BEC)

Attackers impersonate executives or vendors, requesting signatures on fraudulent documents (e.g., payment authorizations). 

Red Flags to Detect Phishing

Unexpected signing requests from unknown senders.

Generic greetings like “Dear Customer” instead of your name.

Suspicious URLs (hover over links before clicking).

Urgency or threats in the message.

Requests for credentials beyond normal signing process.

Tools Commonly Used by Threat Actors

Email Spoofing Tools (e.g., Sendmail, Postfix misconfigurations)

Used to forge sender addresses and bypass basic email filters.

Phishing Kits (e.g., Evilginx, Modlishka)

Enable creation of realistic login pages and capture credentials.

URL Shorteners

Hide malicious links behind shortened URLs to evade detection.

Malware Loaders

Embedded in attachments disguised as PDFs or signing documents.

 Conclusion

While online document signing platforms offer convenience, they also present a significant attack surface for phishing campaigns. Organizations must implement robust email security, user awareness training, and multi-factor authentication to mitigate these threats. Vigilance and verification are key always confirm the legitimacy of signing requests before clicking any link.