AnQiCMS Help Document and User Guide
WordPress 7.1.3 fixed a second SQL injection in the WXR export process. The characteristic of secondary injection is that it appears harmless when the data is stored, but becomes harmful when used again in the query. This article explains why import and verification should be considered separately, what to check during storage verification and output verification, and how to implement the two checkpoints of batch import within the site and content collection.
WordPress 7.1.3 fixed a stored XSS vulnerability that could be triggered by pending review comments in the comment management page. This article explains why unreviewed content can still be rendered and executed in the background, the danger lies in treating comments as trusted data output, and the closing should be based on input verification and output escaping, and corresponding to the site's sensitive word filtering, content review and verification code protection.
This is a minor security update for WordPress 7.1.1 that includes 11 security fixes. The official recommendation is to update immediately, and sites that support automatic background updates will start updating automatically. This article explains which steps of the automatic update can be covered, and which situations require manual scheduling of the upgrade window, as well as the backup and credential rotation confirmation to be done before and after the update.
The system contains content that in the version announcement has changed the user deletion and status switching to POST submission and verify the form security credentials, preventing cross-site request forgery from causing users to be mistakenly deleted or their status to be changed. This change blocks cross-site request forgery - attackers exploit the browser to automatically carry the login state. Moving the status change from GET to POST is just the first layer, what really blocks forgery is the credential verification that comes with the form.
At the same time, only a few branches usually receive security fixes, and there will be no official patches for new vulnerabilities from the day the support is discontinued. Taking the release plan of a certain content system as an example, the security release window covers only a few specific branches, and the old branches will end support in the week of the new major version release. The upgrade window should be arranged in reverse order: first determine the day of discontinuing support, then leave time for verification and rollback, data backup must be done within the window, and login credentials must be processed as described in the upgrade instructions for the home version.
The security upgrade announcement for the PHP class content system provides the following handling order: first upgrade to the fixed version, delete the running directory, check the pseudo-static rewrite rules, then investigate the abnormal files, and explain that the problem is related to vulnerabilities in previous versions. The running directory should be checked first because it is the most common landing point and also resembles renewable content, deleting it will not damage the data; after cleaning up, you still need to confirm that the backup time is earlier than the intrusion time.
The advantages of static generators lie in the construction and hosting stages, where typical sites can be built in seconds; but fast construction does not equal fast maintenance. When content structure, columns, and fields need to be adjusted repeatedly, or when multiple people need to continuously update and batch import historical content, a content management system with a backend is more suitable; here, we compare two routes from four aspects: content model, batch import, template editing, and application scenarios.
It is a feasible practice to divide the area within the same site for different crawling strategies, some service providers have supported setting exceptions according to URI patterns, providing free crawling for specific pages and charging separately for the rest. Within the site, the idea is to organize the pseudo-static rules and robots by path prefix, clearly write the matching scope and effective order, and avoid the exception rules being covered by the rules of the parent directory.
There are edge service providers that divide AI traffic into three categories: search, training, and intelligent agents, and starting from September 15, 2026, they will set a new default value for all customers (including the free tier): allow search traffic, and block training and intelligent agent traffic by default on pages containing ads, and each site can be set separately. The change in default values will affect sites that have never manually changed the settings, and the review should be done layer by layer per site and aligned with the site's robots and anti-crawling settings.
llms.txt was originally proposed in September 2024, v2 in August 2026 added the discoverability writing style through link relations, allowed .md file extension, defined the coverage of sub-paths, and removed the semantic expansion of the context. The specification page explicitly states that it is not a standard, but has been released by a large number of sites, the implementation of each model can be different, and consistency should be maintained when automatically generated on site.
