jasperf · Oct 28, 2026 · Oct 28, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+- **The security guides**, now four posts on wpvilla.in: [the two scanners and checksum verification](https://wpvilla.in/wordpress-malware-scanners-targeted-general-checksum-verification/), [reading scan results](https://wpvilla.in/reading-malware-scan-results-false-positives-wordpress-hardening/), [a permanent Nginx deny list](https://wpvilla.in/nginx-deny-list-trellis-cidr-whitelist-self-lockout/) and [a Trellis security routine](https://wpvilla.in/trellis-wordpress-security-routine-abuseipdb-fail2ban/), plus the existing [fail2ban post](https://wpvilla.in/fail2ban-wordpress-wp-login-trellis-nginx-deny-list/). The `README`, `SECURITY-GUIDE` and `SCANNER-SUMMARY` guides in `wp-cli/security/` and the `README`, `FAIL2BAN` and `MANUAL-IP-BLOCKING` guides in `trellis/security/` are gone; the scanners and the AbuseIPDB scripts stay. The scanner wrapper's closing hint now names the post.
 - **The provisioning and updater guides**, now four posts on wpvilla.in: [a new Mac for Trellis](https://wpvilla.in/new-mac-trellis-development-setup-lima-composer-node/), [cloning an existing project](https://wpvilla.in/clone-trellis-bedrock-project-lima-vm-first-provision/), [updating Trellis](https://wpvilla.in/update-trellis-without-losing-customisations-rsync-excludes/) and [provision tags and the PHP upgrade](https://wpvilla.in/trellis-provision-tags-php-version-upgrade-checklist/). The cron guide is covered by the existing [WP-Cron interval post](https://wpvilla.in/trellis-wp-cron-interval-scheduled-posts-late-cron-interval/). `trellis/provision/` is gone, as are the updater README and `manual-update.md`; the `trellis-updater` script stays.
 - **The content-creation guides**, now three posts on wpvilla.in: [creating pages from block markup](https://wpvilla.in/create-wordpress-pages-block-markup-wp-cli-trellis-vm-production/), [block patterns as PHP files](https://wpvilla.in/wordpress-block-pattern-php-files-headers-escaping-images/) and [pattern layout rules](https://wpvilla.in/wordpress-block-pattern-layout-alignfull-grid-spacing-rules/). `PAGE-CREATION.md`, `PATTERN-REQUIREMENTS.md` and the folder README are gone; the scripts and the example stay.
 - **The migration guides**, now four posts on wpvilla.in: [migrating a site to Trellis and Bedrock](https://wpvilla.in/migrate-wordpress-to-trellis-bedrock-step-by-step/), [testing before the DNS cutover](https://wpvilla.in/trellis-migration-test-etc-hosts-letsencrypt-dns-cutover/), [migrating several sites onto one server](https://wpvilla.in/migrate-multiple-wordpress-sites-one-trellis-server/) and [wp search-replace for domain and path changes](https://wpvilla.in/wp-search-replace-wordpress-url-domain-https-bedrock-paths/). `wp-cli/migration/` is gone, and the README, `CLAUDE.md` and `wp-cli/README.md` no longer point at it.

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -129,7 +129,7 @@ trellis ssh production -- "cd /srv/www/example.com/current && \
 - cPanel/Plesk terminal: Use version-specific PHP binaries (e.g., `/opt/plesk/php/8.2/bin/php`)
 - Browser access: Requires IP whitelist, delete files immediately after use (security risk)
 - Local scan: Download WordPress via FTP and scan locally (safest for restricted hosting)
-- See `wp-cli/security/README.md` for complete installation and troubleshooting guide
+- See [the scanner post](https://wpvilla.in/wordpress-malware-scanners-targeted-general-checksum-verification/) for installation and troubleshooting
 
 ### Image Optimization
 

diff --git a/README.md b/README.md
@@ -52,7 +52,7 @@ wp-ops security-scan example.com production    # wp-login/xmlrpc abuse, high-vol
 ```
 
 Reads the site's Nginx logs on the server — no analytics plugin, no third-party
-service. Pair it with the [fail2ban setup](trellis/security/README.md) to block what
+service. Pair it with the [fail2ban setup](https://wpvilla.in/fail2ban-wordpress-wp-login-trellis-nginx-deny-list/) to block what
 the scan finds.
 
 ### 3. Publish and verify content without opening wp-admin
@@ -132,7 +132,7 @@ sites are run with:
 | **Trellis** | Safe Trellis updates (`trellis-updater`) | [guide](https://wpvilla.in/update-trellis-without-losing-customisations-rsync-excludes/) |
 | **Backups** | Timestamped database and uploads backups from any environment | [→](trellis/backup/README.md) |
 | **Monitoring** | AI-crawler traffic, error surfacing, traffic by country, cron-scheduled reports | [→](trellis/monitoring/README.md) |
-| **Security** | Malware scanners with checksum verification, fail2ban, manual IP blocking, AbuseIPDB lookup | [scanners](wp-cli/security/README.md) · [server](trellis/security/README.md) |
+| **Security** | Malware scanners with checksum verification, fail2ban, manual IP blocking, AbuseIPDB lookup | [routine](https://wpvilla.in/trellis-wordpress-security-routine-abuseipdb-fail2ban/) · [scanners](https://wpvilla.in/wordpress-malware-scanners-targeted-general-checksum-verification/) |
 | **Content & SEO** | Page creation, block pattern validation, redirect/schema/orphan-page audits | [SEO](wp-cli/seo/README.md) |
 | **Nginx** | WebP/AVIF serving, browser caching and redirect templates for Trellis `nginx-includes/` | [images](docs/nginx/image-optimization/README.md) · [caching](docs/nginx/browser-caching/README.md) · [redirects](docs/nginx/redirects/README.md) |
 | **Bedrock** | Testing unreleased packages via Composer `path` repos, standard `wp-cli.yml` | [packages](docs/bedrock/local-package-development/README.md) · [wp-cli.yml](docs/bedrock/wp-cli-config/README.md) |

diff --git a/trellis/README.md b/trellis/README.md
@@ -209,14 +209,6 @@ WordPress security protection through fail2ban automatic IP blocking and manual
   - fail2ban log monitoring
   - Integration with malware scanners
 
-### Documentation
-
-| File | Purpose |
-|------|---------|
-| `README.md` | Security overview and quick reference |
-| `FAIL2BAN.md` | fail2ban setup, configuration, and monitoring |
-| `MANUAL-IP-BLOCKING.md` | Permanent Nginx IP blocks for extreme cases |
-
 ### Quick Start
 
 **Enable fail2ban WordPress protection:**
@@ -258,10 +250,10 @@ ssh web@yoursite.com "grep 'POST.*wp-login' /srv/www/yoursite.com/logs/access.lo
 - Zero maintenance required
 
 **See also:**
-- [security/README.md](security/README.md) - Complete security guide
-- [security/FAIL2BAN.md](security/FAIL2BAN.md) - Automatic IP blocking setup
-- [security/MANUAL-IP-BLOCKING.md](security/MANUAL-IP-BLOCKING.md) - Manual IP blocks
-- [wp-cli/security](../wp-cli/security/) - Malware detection scanners
+- [fail2ban on Trellis](https://wpvilla.in/fail2ban-wordpress-wp-login-trellis-nginx-deny-list/)
+- [A permanent Nginx deny list](https://wpvilla.in/nginx-deny-list-trellis-cidr-whitelist-self-lockout/)
+- [A weekly and monthly security routine](https://wpvilla.in/trellis-wordpress-security-routine-abuseipdb-fail2ban/)
+- [Malware scanners](https://wpvilla.in/wordpress-malware-scanners-targeted-general-checksum-verification/) and [reading their results](https://wpvilla.in/reading-malware-scan-results-false-positives-wordpress-hardening/)
 
 ---
 

diff --git a/trellis/security/FAIL2BAN.md b/trellis/security/FAIL2BAN.md