more wp security notes