EDITS.WS

Tag: security

  • 10 Best Tools to Check a Website for Malware & Viruses

    As a website owner, you’ve worked hard to develop your website and build your business. But, with Google issuing over three million safe browsing warnings a day, it’s clear that you have to be vigilant against the ever-present threat of malware.

    A single malware infection can cripple your website, damage your reputation, and even steal your customers’ data. That’s why it’s essential to have a reliable malware scanner in place to help you spot an infection as soon as it happens, so you can take steps to secure your site and get it back up and running.

    With so many malware scanners available, it can be challenging to know which one to choose. However, thanks to our comprehensive review of the best website malware scanners, you’ll be able to determine the right option for you.

    The top ten tools to scan a website for viruses and malware

    Jetpack Protect Plugin

    1. Jetpack Protect

    Jetpack Protect is one of the best ways to check your WordPress website for malware and keeps you one step ahead of security threats. This free plugin can be set up in just one click, and it’ll get to work checking your site daily for vulnerabilities that hackers could exploit to inject malware — so you can prevent issues before they start. And, with a paid upgrade, it will check your entire site for tens of thousands of known malware definitions and immediately alert you if something’s found.

    Jetpack Protect allows you to secure your site without slowing it down, as it uses state-of-the-art decentralized scanning technology which can search your entire site — including the admin area, themes, and plugins — using Jetpack’s servers.

    The plugin scans your site against an extensive database that is updated by dedicated WordPress security experts as soon as new vulnerabilities, viruses, or malware are discovered. If Jetpack Protect does detect an issue on your site, it will notify you via your Jetpack dashboard and will provide straightforward guidance to help you secure your site and remove malware from your WordPress site.

    Jetpack Protect is made by Automattic, the team behind WordPress.com, which means it seamlessly integrates with any WordPress site. The tool uses the same technology used to guard some of the world’s leading brands, so you know you’re in good hands. 

    Key features of Jetpack Protect:

    • A simple one-click setup 
    • Automatic ‘set it and forget it’ daily scans for vulnerabilities that keep your site secure 
    • Scans of plugins, themes, and WordPress core for potential vulnerabilities 
    • Recommended actions to help you resolve any issues that are found
    • Automated daily malware scanning against over 37,000 definitions (paid)
    • A Web Application Firewall (paid)
    • Instant email notifications (paid)

     Pros of Jetpack Protect:

    • As the automatic malware scans run on Jetpack’s servers, Jetpack Protect can scan your entire site without slowing it down.
    • The plugin uses the same malware database as the advanced enterprise-level tool, WPScan, which is constantly updated by experienced online security experts.
    • You can start protecting your site with just a single click, and it’ll run scans daily and notify you of any issues through your dashboard.

    Cons of Jetpack Protect:

    • Jetpack Protect was designed specifically for WordPress websites, so if your site doesn’t use WordPress, you’ll need to explore one of the other options on our list.
    • While the plugin offers advice on resolving any security issues, it doesn’t provide automatic malware removal without a paid upgrade.

    Ease of use:

    Jetpack Protect is super simple to use, as it only takes one click to activate its advanced scanning tools. There is also no need to remember to run scans, as the plugin will protect your site automatically in the background. Detailed documentation is available, and if you need support, you can access Jetpack’s team of WordPress Happiness Engineers.

    Pricing of Jetpack Protect:

    Jetpack Protect is available for free from the WordPress plugin directory. 

    Wordfence Security Plugin

    2. Wordfence

    Wordfence is a WordPress security plugin that offers a range of features to protect your website from malware, viruses, and other threats. One of the key features of Wordfence is its malware scanner, which automatically checks your website for malware and other vulnerabilities.

    Wordfence is a server-side malware scanner (so it will use resources from your host) that allows you to check your entire website, including plugins and themes. The scanner looks for a wide range of vulnerabilities and signs of malware or viruses, including malicious redirects, backdoors, and code injections. 

    In addition, Wordfence has a dedicated team of website security experts who regularly update its database with new malware and virus definitions, which are immediately available to premium customers so that your site is protected against the latest threats.

    If Wordfence detects malware, it will automatically quarantine infected files, prevent them from being executed, and alert you via email. Wordfence can help you recover from simple malware attacks by replacing damaged core WordPress files with a clean version and deleting any malicious ones. Complete malware removal is included at some of the higher-tier subscription levels.

    Key features of Wordfence:

    • Automated malware and virus scanning
    • Daily email alerts
    • Basic repair and deletion functions for removing simple malware
    • A range of other security features, including a firewall and access logging
    • Regular malware definition updates (premium)
    • Malware removal by a security expert (premium)

    Pros of Wordfence:

    • Wordfence conducts daily scans of your site and will email you if it notices any issues.
    • Alongside the malware scanner, Wordfence also includes various other security features, including a Web Application Firewall (WAF) and two-factor authentication.

    Cons of Wordfence:

    • The free version of Wordfence only updates its malware definition 30 days after a new piece of malware is identified, meaning you have to upgrade to a paid plan if you want to detect the latest threats.
    • Wordfence uses your server’s resources to conduct its scans, which could impact your site’s performance.
    • Wordfence only works with WordPress websites.

    Ease of use:

    Wordfence requires configuration to ensure that it fully protects your site, but when it’s set up, its automatic scanning and notifications mean things are pretty hands-off. Sometimes the email alerts sent by Wordfence flag legitimate changes as a concern, which could cause confusion if you’re unfamiliar with website security and the WordPress ecosystem. 

    Wordfence has comprehensive documentation and a learning center. Support is offered for free users through the plugin’s support forum and via email for premium subscribers. 

    Pricing of Wordfence:

    Wordfence offers a free plan, but there’s a 30-day delay between new discoveries of malware and when the free plan updates the database to include those discoveries in scans. 

    Wordfence Premium costs $119 a year and includes daily malware database updates. 

    Wordfence Care costs $490 a year, including installation and optimization of the plugin and malware removal by a WordPress security expert.

    Sucuri Security Plugin

    3. Sucuri

    Sucuri is a well-known name in website security that offers a free malware scanner alongside several premium services that can help keep your site safe, including a web application firewall, DDoS protection, and malware removal.

    Sucuri’s free SiteCheck external malware scanner allows you to scan the front end of your site for malware by entering its URL. If your website is built using WordPress, Sucuri offers a basic plugin that will check your site’s WordPress core files for any changes. 

    Sucuri also offers premium plans, including automatic malware and virus scanning and access to a server-side scanner to check all your website files.

    Key features of Sucuri:

    • A free external malware scanner
    • File integrity scanning 
    • Security event logs 
    • Automated malware scanning (premium)
    • Server-side malware scanning (premium)
    • Malware removal (premium)
    • Blocklist monitoring (premium)
    • A web application firewall (premium)

    Pros of Sucuri:

    • Sucuri’s SiteCheck scanner is free and doesn’t require an account.
    • Sucuri is platform-agnostic, so it will work regardless of how your website is built.

    Cons of Sucuri:

    • Sucuri’s free malware scanner does not offer automatic scanning, so you must regularly visit the SiteCheck website and enter your URL to check your site for malware.
    • Sucuri’s free SiteCheck scanner may not be able to spot all malware on your site. This is because the malware scan is conducted remotely, so it can only check for malware in the source code of the public-facing pages on your site. 
    • If your site is built on WordPress, Sucuri says that their free WordPress malware scanner isn’t 100% accurate. Malware could be inserted into plugin files or other admin areas and, therefore, wouldn’t appear on your site’s front end.

    Ease of use:

    Sucuri’s free malware scanner is simple to use as it only requires your website URL. However, unless you subscribe to a premium plan, you need to remember to manually run the scan to ensure you spot any malware or virus infections. 

    The server-side scanner could be confusing for non-technical website owners to set up, as it requires FTP/SFTP credentials. Sucuri offers a range of guides and documentation, and its premium customers are offered email support.

    Pricing of Sucuri:

    Sucuri SiteCheck and their WordPress plugin are free of charge. Premium subscriptions start at $199 a year and include a range of features, including server-side automatic malware scanning, a web application firewall, and unlimited malware removal. 

    MalCare Security Plugin

    4. MalCare

    MalCare is a malware scanning and removal service specifically for WordPress websites. The plugin offers automatic malware scanning alongside other security features, including a web application firewall to prevent attackers from accessing your site.

    MalCare’s malware scanner will automatically scan your entire site, including admin files, plugins, and themes. The plugin temporarily and securely copies your files to its servers to conduct each malware scan, meaning that scans won’t slow down your site. 

    MalCare also monitors your website’s files and databases and will let you know if it spots a change that it thinks could be the result of malware. If it thinks you have a malware or virus infection, it will alert you by email, and the plugin’s premium version offers automatic malware removal.

    Key features of MalCare:

    • A malware scanner with automatic daily scanning
    • Vulnerability detection
    • Monitoring for suspicious file changes
    • A web application firewall
    • Automated malware cleaning (premium)

    Pros of MalCare:

    • MalCare offers automatic daily malware scans, which can check your entire site.
    • The plugin uses MalCare’s servers to carry out its malware scanning, meaning it won’t slow down your site.
    • MalCare will send you an alert by email if it finds any signs of a malware infection, so you can take action to secure your site.

    Cons of MalCare:

    • While the free version of the plugin will tell you if your site is infected with malware, it won’t let you know where it is. Instead, you must upgrade to a premium plan to locate and remove the infection.
    • MalCare is a solution specifically designed for WordPress website owners to check their site for malware, so if your site does not use WordPress, you’ll need to explore one of the other options on our list.

    Ease of use:

    MalCare is easy to install and set up, and its automatic scans mean you don’t need to remember to scan your site. The automated malware removal in its premium version makes it simple to recover your site from most infections. MalCare offers email support for all users and live chat support for premium users.

    Pricing of MalCare:

    There’s a free version available from the WordPress plugin directory. Premium plans include malware removal and start at $99 a year.

    5. Jetpack Scan 

    Jetpack Scan is one of the best ways for WordPress website owners to check their sites for malware and viruses. Jetpack Scan acts as a security guard who constantly watches over your site, taking all the stress out of protecting your site from the latest security threats.

    Jetpack Scan is a premium feature of the Jetpack plugin, which is maintained by Automattic — the same people who are behind WordPress.com, WPScan, and WooCommerce. This means you’ll benefit from the expertise of dedicated WordPress security specialists, who ensure that the vulnerability database used by Jetpack Scan is kept up to date with the latest malware, viruses, and exploits.

    As soon as it’s installed, Jetpack Scan gets to work, scouring your site for malware and vulnerabilities. 

    If an issue is detected, it’ll notify you immediately and provide clear guidance about any identified threats. And, in most cases, Jetpack Scan will offer simple, one-click fixes, so you can get back to running your site.

    Even if your site has been taken offline by a malware attack, you can still see the results of the latest malware scan and implement most one-click fixes from the cloud, meaning you’ll be able to quickly get your site back up and running.

    Jetpack Scan uses clever decentralized scanning technology to scan your entire website, including admin pages, themes, and plugins. It does so with Automattic’s servers, allowing you to benefit from the same protection enjoyed by millions of WordPress websites without slowing down your site. You’ll also get access to other security features, including a web application firewall. You can benefit from even more features, including automated backups and spam protection, by purchasing the Jetpack Security bundle.  

     Key features of Jetpack Scan:

    • Automated daily scanning
    • Instant email notifications if any issues are found
    • One-click fixes to resolve the majority of security threats
    • The ability to access your scan results and one-click fixes even if your site is down
    • A vulnerability database updated by WordPress security experts
    • A web application firewall to help keep hackers out of your site 
    • Priority support from Jetpack’s WordPress Happiness Engineers

    Pros of Jetpack Scan:

    • As Jetpack Scan keeps watch over your site through its automated daily scans, you can ‘set it and forget it’ and rest easy knowing that you’ll be notified immediately if anything’s ever found.
    • Jetpack Scan offers one-click fixes for most malware infections and security vulnerabilities.
    • Jetpack Scan integrates seamlessly with WordPress and WooCommerce and works alongside other Jetpack features, including VaultPress Backup.

    Cons of Jetpack Scan:

    • Jetpack Scan was designed specifically for WordPress websites, so if your site doesn’t use WordPress, you’ll need to explore another option on this list.

    Ease of use:

    Jetpack Scan is simple to set up and use. Its automated scans mean you don’t have to worry about remembering to scan your site, and one-click fixes make solving the majority of security issues simple. Plus, detailed documentation and priority support from Jetpack’s team of Happiness Engineers is available for all Jetpack Scan users.

    Pricing of Jetpack Scan:

    Jetpack Scan is available through the Jetpack plugin or as an upgrade to the Jetpack Protect plugin for just $10 a month. You can also benefit from Jetpack Scan by purchasing Jetpack’s Security or Complete bundles.

    Jetpack Scan

    6. IsItWP Security Scanner

    IsItWP provides a range of tools for site owners, including a website malware scanner, which can check any website for malware and other security vulnerabilities. IsItWP’s scanner is powered by Sucuri, allowing you to scan your site’s front end pages for malware by entering its URL.

    In addition to checking your site for malware and viruses, IsItWP’s scanner also checks if your site is listed in Google’s Safe Browsing and other malware blocklists.

    Key features of IsItWP Security Scanner:

    • The ability to check any website’s public-facing pages for malware and viruses
    • Reports that outline if malware is found or if the website is on Google’s Safe Browsing or other malware blocklists

    Pros of IsItWP Security Scanner:

    • It allows you to check any website for malware by simply entering its URL.

    Cons of IsItWP Security Scanner:

    • There’s no automated scanning option, meaning you must remember to visit IsItWP to check your site for malware.
    • The scanner can only find malware that is present on the front end pages of your website.
    • If malware or viruses are detected, IsItWP doesn’t provide any guidance or tools to help you remove the malware and restore your site.
    • The online scanner is slower than many others on this list.

    Ease of use:

    IsItWP Security Scanner is easy to use as it only requires you to enter your website’s URL to check it for malware.

    Pricing of IsItWP Security Scanner:

    IsItWP Security Scanner is free to use.

    Sitelock Security

    7. SiteLock

    SiteLock offers a range of malware detection and removal services, including a free online malware scanner.

    SiteLock’s free scanner allows you to check the public-facing pages of any website for malware. The web-based scanner returns results in under 60 seconds and also checks for any known viruses or other vulnerabilities.

    SiteLock also offers a number of premium plans which offer automated scans, notifications, and automatic malware removal. Premium customers can also scan their entire website, including admin pages, plugins, and files, using SiteLock’s cloud servers so that website performance is not impacted. 

    Premium scans also check for additional security concerns, including SQL injections and cross-site scripting, as well as your website’s status on malware blacklists.

    Key features of SiteLock:

    • A free, web-based malware scanner
    • Automated daily scans (premium)
    • Automatic malware removal (premium)
    • Additional security features including a web application firewall and DDoS protection (premium)

    Pros of SiteLock:

    • SiteLock’s free online malware scanner is quicker than many others and provides results in an easy-to-understand format.
    • SiteLock’s premium plans feature automated malware removal, so malware is removed from your site as soon as it’s identified.

    Cons of SiteLock:

    • Automated scanning is only available on premium plans.
    • While SiteLock supports WordPress and other content management systems, its plugin is not widely used.

    Ease of use:

    The web-based scanner is easy to use and returns results quickly. For SiteLock’s premium features to work, you must provide FTP/SFTP details, which could be confusing for some users. Email support, with a guaranteed 30-hour response time, is provided to all premium customers.

    Pricing of SiteLock:

    SiteLock’s online scanner is free. Premium plans, which include automated scans of all areas of your site and malware removal, start at $15 a month.

    Complete External Check

    8. Detectify

    Detectify is a cybersecurity company that offers a range of options to check websites and web apps for malware and viruses. Detectify is designed specifically for complex DevOps environments. It can be configured to run either on-demand or scheduled security scans that look at your entire website, including back-end resources.

    In addition to malware, Detectify will scan your server for a wide range of other security risks and vulnerabilities, including SQL injections, authentication vulnerabilities, and SSL issues. Scans also check your site against a unique list of exploits gathered from the hacker community to help keep your site secure from the latest threats.

    Detectify will integrate into your existing workflow to inform you of the results of its scans through tools such as Slack or Jira so that you can take action to address any issues it has identified. 

    Key features of Detectify:

    • Enterprise-grade malware and vulnerability scanning
    • Scans for a wide range of potential security issues
    • Scans of your entire website
    • Multiple scan profiles

    Pros of Detectify:

    • Detectify offers a high level of security for complex web apps and websites that checks for a range of vulnerabilities, including malware and viruses.

    Cons of Detectify:

    • Detectify is an enterprise-grade service, and therefore it offers many features that most website owners may not need.
    • Due to its advanced features, Detectify is significantly more expensive than any other option on this list.

    Ease of use:

    Due to its range of options and scan profiles, Detectify is more complex to set up than many other options on this list. It may require the support of a DevOps specialist to integrate with your website.

    Pricing of Detectify:

    Detectify plans are customizable, but start at around $80 per month.

    Scan Your WordPress Website

    9. Quttera

    Quttera is an established name in website security, and they offer a number of different solutions to check your website for malware, including a free online malware scanner. All of Quttera’s solutions use a patented malware-detection algorithm that it claims can detect previously unknown malware rather than checking your site’s files against a list of malware definitions.

    Quttera’s online malware scanner can only check the front end of your website. But, if your website is built using WordPress, then Quttera’s free plugin will scan your entire site for malware, including admin pages and plugins. A detailed report is provided after each scan, which identifies any malicious or suspicious files, and lets you know your site’s status on several common malware blocklists.

    Quttera’s premium ThreatSign! product offers automated malware scanning, including server-side scanning for all websites, and automated malware removal is provided with some plans.

    Key features of Quttera:

    • A web-based malware scanner
    • A WordPress plugin that checks all website files
    • Malware blocklist checking
    • Automated scanning (premium only)
    • Malware removal (premium only)
    • Additional security features, including a web application firewall and DDoS protection (premium only)

    Pros of Quttera:

    • The free report provided by Quttera is more detailed than the reports provided by other free tools on this list.
    • Quttera’s server-side scanning, available via their WordPress plugin and premium plans, uses their cloud servers to conduct the scan, meaning it won’t slow down your site.
    • Quttera’s malware detection algorithm can detect previously unknown malware.

    Cons of Quttera:

    • It scans using the free web-based tool can only check the front end of your site.
    • Automatic scanning is only available on premium plans.

    Ease of use:

    Quttera’s web-based scanner and WordPress plugin are both easy to use, but the lack of automation means that you need to remember to check your site regularly for malware. Support is only available to premium subscribers.

    Pricing of Quttera:

    Quttera’s web-based scanner and WordPress plugin are free. Premium plans offer automatic scanning and other security features for $10 a month, with plans that offer malware removal starting at $179 a year.

    Safe Browsing site status.

    10. Google Transparency Report

    Google’s Transparency Report provides information on Google’s services, and has a section dedicated to its Safe Browsing technology. Site owners can enter their URL and check its Safe Browsing status to see if it has been flagged as unsafe by Google.

    Safe Browsing is Google’s technology that checks websites for malware and phishing attacks and flags them as unsafe for visitors if they’re potentially malicious. 

    Key features of Google’s Transparency Report:

    • Includes a tool that checks if a site has been identified as unsafe
    • Reports that offer a basic reason for the site being listed as unsafe

    Pros of Google’s Transparency Report:

    • The Safe Browsing status check allows website owners to see if Google has identified signs of malware on their site.
    • The service is free of charge and can be used by anyone to check the status of a site.

    Cons of Google’s Transparency Report:

    • The Safe Browsing status check is not automatic, meaning you must remember to check your site’s status.
    • Google Transparency Report’s Safe Browsing status check section is not a substitute for a comprehensive malware scanning solution because it’s not proactive and only reports issues after visitors are likely to have been affected.
    • Google’s Safe Browsing technology does not scan every website, and the frequency of scans is not publicly available.
    • The Safe Browsing status check does not provide any guidance on how to remove malware if it’s identified on your site.

    Ease of use:

    The Google Transparency Report Safe Browsing status check is easy to use and quickly returns the Safe Browsing status for the URL you enter.

    Pricing of Google’s Transparency Report:

    Google’s Transparency Report is free to use.

    A comparison of the best website malware scanners

      Jetpack Protect Wordfence Sucuri MalCare Over 44,000 IsItWP Security Scanner SiteLock Detectify Quttera  Google Transparency Report
    Made especially for WordPress websites Yes Yes No Yes Yes No No No No No
    Number of malware definitions your site is checked against. Over 37,000 Yes (with a paid plan) Not stated Not stated Over 37,000 Not stated Not stated Not stated Uses proprietary algorithm Not stated
    Automated scans Yes Yes Premium only Yes Yes No Premium Only Yes Premium only No
    Scans your full site, including admin files Yes Yes Premium only Yes Yes No – checks front end files only. Premium Only Yes Premium only No – checks front end files only
    Can scans impact website performance? No Yes No- external scanner Yes No No No Yes No No
    Frequency of malware definition updates Daily Every 30 days (free version)
    Daily (pro version)    		 Daily Daily Unknown Daily Daily Daily N/A Daily
    Malware removal if malware is found Yes (with a paid plan) Limited removal in the premium version. Full removal in Care version. Premium only Premium only Yes (with paid plan) No Premium Only No Premium only No
    Price Free with paid upgrades. Limited free version. Premium plans start at $99/year. Limited free online scanner. Premium plans start at $199/year. Limited free version.Premium plans start at $69/year. $10 / month Free Free online front end scanner. Premium plans start at $15 a month. From $80/ month. Limited free online scanner and plugin. Premium plans start at $10 a month. Plans including malware removal start at $179 a year. Free

     Frequently asked questions about malware scanners

    What is the best website scanner to check for viruses and malware?

    The best website scanner to check for viruses and malware will depend on the platform or CMS your site is built on.

    For example, WordPress site owners should opt for a malware scanner that’s built specifically for WordPress, and it’s clear from our review that Jetpack Protect is the best option. It offers automated scans for vulnerabilities with premium access to a malware database that’s constantly updated by a team of WordPress security experts, so you can be sure your site is being checked for the latest issues. 

    Or you could use the premium Jetpack Scan feature available with the Jetpack plugin. 

    Both Jetpack Scan and the paid upgrade for Jetpack Protect offer clear guidance and one-click fixes if a security threat is identified, along with a web application firewall to keep malicious actors off of your site.

    Should I use an external or server-side malware scanner?

    Many of the free website scanners only search the external pages of your website for malware, and this means that they won’t spot issues that are hidden on the back end of your site. 

    In contrast, server-side malware scanners offer full protection, since they scan the entirety of your site. But, if the malware scanning happens on your server, it could temporarily slow down your website performance. This means the best option to scan your site for malware is to use a tool that uses decentralized scanning technology. 

    For example, Jetpack Protect uses Automattic’s cloud servers to securely scan the front and back ends of your site, meaning you don’t have to worry about the impact on performance while its comprehensive automated scans are being carried out.

    How do I scan a WordPress website for malware?

    To scan your WordPress site for malware, you’ll need to use a malware scanner such as Jetpack Protect that can scan your entire website, including your plugins and themes.

    You can install Jetpack Protect for free by going to Plugins → Add New inside of your WordPress dashboard. Then, search for “Jetpack Protect” and click Install Now → Activate.

    Jetpack Protect in Plugin Repository

    Then, choose either Jetpack Protect or upgrade to benefit from additional features, including one-click malware fixes and a web application firewall.

    Jetpack Protect will then get to work scanning your entire site for malware.

    Jetpack Protect - Your results will be ready soon.

    Once its scan is complete, you’ll be shown the results and told if any security threats have been identified on your site. If Jetpack Protect has identified any issues, it’ll give you a clear description of the issue and let you know where it’s located.

    Jetpack Dashboard - Don't worry about a thing.

    Jetpack Protect will automatically scan your site for vulnerabilities every day. You can see the results of your scans by going to your WordPress admin dashboard menu and selecting Jetpack →  Protect.

    Jetpack via WordPress Dashboard

    You can also run a manual scan at any time by clicking Scan Now.

    How can I prevent my website from being affected or hacked in the future?

    While regular automated scanning will help you detect a malware infection, keeping it secure is the best way to protect your site. Here are some ways you can do this:

    • Use strong passwords. The easier your password is to guess, the more likely it is that a malicious hacker will be able to guess it to get access to your website and install malware. Learn more about securing your WordPress login page.
    • Enable secure authentication. Secure authentication requires users to provide a code from their mobile device alongside their username and password, meaning that if someone does happen to crack your password, they still can’t log in and cause damage to your site.
    • Limit admin user accounts. By limiting the number of users who can have full access to your site, you reduce the number of accounts that could become compromised and used to infect your site with malware.
    • Keep your site up to date. By keeping the software up to date, including any plugins and themes, you’ll benefit from the latest security improvements and vulnerability patches.
    • Get protection against brute force attacks. Brute force protection stops bots who try to guess hundreds of username/password combinations each second until they find one that lets them into your site.
    • Use a web application firewall. Firewalls help prevent attackers from gaining access to your site and are essential for all website owners. For example, Jetpack Scan includes a firewall specifically designed for WordPress sites that uses a vast database to help it identify potentially malicious visitors. 

    WordPress site owners can help keep their site secure and prevent malware infections by using a complete WordPress security solution such as Jetpack Security, which includes advanced features including backups, Jetpack Scan, and protection from spam.

  • Is WordPress Secure? How Reliable and Safe is the Platform?

    If you’re thinking of starting a website, you’ll probably want to use WordPress to build it. This popular CMS and site builder enables you to create any type of site. However, you may be wondering: is WordPress safe?

    The answer is a resounding yes. The proof is in the unprecedented popularity of the tool. Still, there are some simple steps you can take to make your WordPress site more secure, like opting for a reliable web host and using the right plugins.

    In this article, we’ll show you what makes WordPress a reliable platform. Then, we’ll look at how to build a secure WordPress site in six steps. Finally, we’ll discuss some factors that can impact the security of your WordPress site and go over some frequently asked questions. 

    How reliable is WordPress?

    WordPress is one of the most secure CMSs available. Let’s look at five factors that demonstrate its safety and reliability.

    WordPress is the most popular website-building tool

    If you’re searching for evidence that WordPress is reliable, the statistics say it all. Over 43 percent of websites are powered by WordPress, which makes it the most popular website-building tool available.

    WordPress homepage with the words, "WordPress; Flex your freedom"

    This translates to about 835 million WordPress websites, a number that just keeps growing by the day. 

    It’s safe to say that users wouldn’t be flocking to WordPress if it wasn’t dependable. Such a vast market share serves as the ultimate customer testimonial. 

    WordPress has a large community

    WordPress has a large and thriving group of users and developers who continually contribute to expand, improve, and secure the technology for the good of the entire community. Since the software is free and open-source, users can download it at no cost.

    Additionally, WordPress is offered under the General Public License. This means you can use it for any purpose, redistribute the software, and modify it.

    pillars of open-source

    With this flexibility, you can use the CMS however you wish. Moreover, you can modify, build upon, and improve it as you see fit. 

    In fact, the contributors of WordPress encourage others to participate in any way they can.

    the Make WordPress website

    Since Matt Mullenweg, a founding developer of WordPress, organized the first WordCamp event in 2006, there have been over 1,100 WordCamp events in 65 countries. And that’s not the only way that the WordPress community comes together.

    Spanning 115 countries, there are more than 750 WordPress-focused groups on Meetup.com. These communities help support talented WordPress developers and designers who are continually working to improve the software. 

    WordPress is trusted by top enterprises

    WordPress isn’t limited to a specific type of user. While it started out as a blogging platform, today it’s used by a wide range of people and businesses.

    It’s even trusted by some of the top enterprises in the world, including:

    • eBay
    • Forbes
    • CNN
    • The New York Times
    • Mercedes-Benz

    There are many reasons that big businesses choose WordPress over other platforms. For instance, it’s highly customizable, giving users complete control over almost every aspect of the site. 

    Plus, you can easily expand upon its functionality with WordPress plugins. For example, the WooCommerce plugin enables you to transform any WordPress site into a fully functional online store. It even offers extra powerful plans for high-volume online stores.

    enterprise ecommerce plans through WooCommerce

    When it comes to ecommerce platforms, WooCommerce makes up nearly 39 percent of the market and 23 percent of the world’s top one million online stores.

    Experienced WordPress developers

    The first version of WordPress was released in 2003. Since then, thousands of the most highly talented and experienced developers have devoted themselves as both users and volunteer contributors.

    In addition to working on the core software, some WordPress developers may specialize in plugins, themes, or even security. 

    And the WordPress plugin and theme directories help verify the quality of plugins that extend WordPress by displaying accurate information about the plugin’s latest update, developer background and history, verified reviews, and number of users. 

    WooCommerce plugin page

    This way, you’ll be able to tell right away if the tool you’re interested in has been built by experienced developers. Alternatively, if you have the budget to work with a WordPress developer directly, you can easily find top-notch talent in a variety of WordPress niches.

    Solutions like Jetpack offer powerful security tools

    One of the best things about WordPress is that it enables you to use affordable yet robust security solutions like Jetpack.

    Jetpack Security homepage

    Jetpack offers both security and performance tools. It also offers a security plan that includes a backup tool, a malware scanner, and an anti-spam solution. With this powerful trio, you can create real-time backups of your site, run automatic scans for threats, stop spam in its tracks, and more.

    How to build a secure WordPress site (in 6 easy steps)

    By default, WordPress is a powerful and reliable tool. Still, cyber threats remain a universal reality, and strong WordPress security is crucial for every website. 

    So, let’s outline how to build a secure WordPress site in just six steps. 

    1. Choose a secure host for your website

    WordPress is free and open source, but there are still some costs associated with it. Primarily, when you’re using WordPress.org, you’ll need to pay for a domain name and web hosting. 

    Simply put, a domain name is your site’s web address. A web host provides the server space needed for your site and makes it available to view online.

    If you don’t choose your hosting provider carefully, your website may be set up in a way that makes it vulnerable to security threats and performance issues. So, the first step in building a secure WordPress site is choosing a reputable web host. 

    This choice will depend on your site’s unique needs, but any trustworthy web host should offer most of the following security features:

    You’ll also need to choose the right hosting plan. If you’re running a small professional site, a basic or mid-tier plan might be sufficient for your needs. On the contrary, ecommerce stores will likely need higher-tier plans that can accommodate increased web traffic and use of resources. 

    If you’re totally new to the CMS, it might be a good idea to go with a managed WordPress hosting plan. This can simplify the daily management that’s required for your site.

    Finding the right WordPress web host can be a little difficult. If you’re not sure where to look, you might try popular choices like Bluehost or DreamHost.

    DreamHost homepage

    2. Install WordPress using best practices (or use WordPress.com)

    Unless you’re an experienced developer, installing WordPress manually might be challenging. That’s because it requires you to create your own database and modify your site’s files.

    Fortunately, most high-quality web hosts will offer one-click installations. This means they’ll download and set up the software for you. 

    If you do decide to install it manually, here are some best practices to keep in mind: 

    • Make sure you’re downloading the latest version of WordPress
    • Use secure database usernames and passwords
    • Make sure your hosting provider uses the latest versions of PHP and MySQL 
    • Create secure FTP usernames and passwords 

    If you prefer a more streamlined approach, you might consider using WordPress.com.

    WordPress.com homepage with the text, "Welcome to the world's most popular website builder"

    This is the hosted version of WordPress. Unlike WordPress.org, WordPress.com isn’t free, but it includes web hosting and a domain name. What’s more, WordPress.com has a wide variety of plans, ranging from personal to enterprise options. 

    3. Make sure all user accounts have a unique username and strong password

    Once your WordPress installation is complete, you’ll get access to the back end of your website. If you’re the site owner, you’ll need to create an ‘administrator’ account. This role will give you complete control over all the front and back-end elements of your site.

    It’s crucial that you create a unique username and a strong password. Otherwise, your website could become vulnerable to brute force attacks. You may even want to use a password manager like KeePass or 1Password.

    This way, you can regularly reset your WordPress password as an added layer of security and never have to worry about forgetting it.

    Depending on your website, you may also need to add users. For instance, if you have an online store, you’ll have to allow for customer accounts. If you have a marketing manager, they may need access to make periodic updates to landing pages or other parts of the site. Or, if you’re starting a blog, you may need to give authors and editors access.

    You’ll want to make sure that all of these users have strong usernames and passwords as well. To achieve this, you can use a tool like the Password Policy Manager plugin.

    Password Policy Manager plugin page

    This tool enables you to enforce strong passwords for your site. It also gives you lots of other features that enhance password security. Plus, it’s compatible with WooCommerce, which makes it an excellent option for ecommerce sites.

    Also, familiarize yourself with the user roles included with WordPress. Make sure that each person only has the minimal capabilities required to do their job. And if someone stops working with your organization, it’s best to change their login information.

    4. Keep your WordPress core version up to date

    With every release, WordPress is evolving and getting better. Each new version of the CMS can contain design updates, but also bug fixes and security improvements.

    Therefore, it’s crucial that you keep your WordPress core version up to date after your site is set up. If you don’t, you may leave your site vulnerable to attacks.

    You can easily check if your WordPress site is up-to-date by navigating to Dashboard → Updates.

    checking for WordPress updates in the dashboard

    If you’re not using the most recent version of WordPress, you’ll be able to update it from this page. Additionally, you can configure automatic updates here.

    5. Install a powerful security plugin like Jetpack Security

    WordPress is powerful enough for some of the world’s biggest companies. Still, even one security incident or data leak can destroy a brand’s reputation. That’s why organizations both large and small should find a WordPress security plugin to safeguard their work.

    One of the most trusted, and professionally supported, options is Jetpack Security.

    Jetpack Security homepage

    This plugin is the best on the market because it includes tools to protect you from every angle — like Jetpack VaultPress Backup, Jetpack Scan, and Akismet Anti-Spam. So while many other WordPress security plugins only provide protection for a singular type of threat, Jetpack Security gives you everything you need to safeguard your site.

    After you’ve purchased Jetpack Security, and it’s installed on your site, navigate to your WordPress dashboard and go to Jetpack → VaultPress Backup.

    Jetpack VaultPress Backup Dashboard

    From here, you can configure regular backups of your WordPress site. This way, you’ll always be able to restore a recent copy of your entire site in case of emergency.

    Keep in mind that backups may take a moment to complete. Once this process is done, and you’ve finished configuring the tool, you can return to this page to view or restore backups at any time.

    You can manage your anti-spam settings by going to Jetpack → Anti-Spam. Here, you’ll also be able to see how much spam the tool has helped you block.

    Akismet dashboard showing spam blocked

    Finally, you can go to Jetpack → Protect → Scan to set up the malware scanning feature. If you discover any instances in the Malware Threats Found section, you can easily eliminate malware by clicking on Remove Threat.

    6. Only install reliable plugins created by reputable developers

    The ability to extend WordPress with plugins is part of what makes the platform so powerful and flexible. Plus, these tools are easy to use, and you can install them directly from your WordPress dashboard.

    Still, it’s not a good idea to add just any plugin to your site. You should only install tools created by reputable developers. Otherwise, you might be putting your site at risk.

    You can easily vet plugins by viewing their details in the WordPress plugin directory.

    Jetpack plugin shown in the WordPress plugin directory

    You’ll want to make sure that the plugin is compatible with your current version of WordPress and has been updated recently. An out-of-date plugin can make your site vulnerable to threats.

    Additionally, the number of active installations is usually a good measure of a tool’s reliability. You can also check out its star rating to see what users are saying about it.

    Lastly, make sure to pay close attention to the By section beneath the plugin name:

    the developer information underneath a plugin name

    This will tell you who is behind the development of the tool, which can be another strong indicator of its dependability. 

    For example, Jetpack’s suite of plugins is developed and maintained by Automattic, the company behind WordPress.com. So, if you see that the plugin was created by a reputable company, you can probably assume that it’s safe to use.

    What factors can affect the reliability and security of a WordPress site?

    Now that you know how to build a secure WordPress site, let’s dive a little deeper into the factors that can negatively affect the reliability and security of WordPress.

    A low-quality hosting provider

    Low-quality web hosts don’t provide enough performance and security features to keep your site running smoothly. If you opt for a subpar web host, your site may suffer from slow loading times or even excessive downtime. 

    Moreover, a poor web hosting provider might not provide enough storage space or customer support. With this in mind, you’d be wise to avoid low-quality web hosts. 

    If you run a large site that gets high amounts of traffic, it’s best to avoid shared hosting plans. This type of hosting is often cheaper, but requires your site to share resources with other websites, which can lead to poor performance. And, if another site on the shared server is compromised, it’s possible that yours could be as well.

    It’s important to note that reliability is crucial when it comes to Search Engine Optimization (SEO). If your site is often down or glitchy, Google will notice this, and it can lower your rankings in search results.

    A good web hosting service will usually give you unlimited bandwidth, access to a private or cloud-hosted server, a Content Delivery Network (CDN), an SSL certificate, added security features, a server-level firewall, and more.

    An obsolete or outdated plugin or theme

    Any software that runs on your site can affect its reliability and security. This includes plugins and themes.

    Therefore, anytime you install either of these on your site, you’ll want to vet the developers and check out the version details and user reviews. This can help ensure that you only download and install high-quality themes and plugins.

    plugin information in the WordPress plugin repository

    When it comes to themes, always check to see if the design is compatible with your current tools and WordPress version. Most obsolete themes or plugins will just mess with your site’s layouts, but some may be intentionally infiltrated by hackers. 

    It’s also important that you keep your existing themes and plugins up to date. As long as you’re regularly monitoring your site for issues, you can set up automatic updates to immediately take advantage of the latest security patches.

    An outdated version of WordPress

    As we discussed earlier, keeping your WordPress core version up to date is essential. You can do this by navigating to Dashboard → Updates. 

    If you don’t update your WordPress version, you could miss out on key bug fixes and maintenance improvements, leaving your site vulnerable. Plus, running an outdated version of the CMS could lead to compatibility issues with your active plugins and theme.

    WordPress accounts with weak login credentials

    Even if you use strong passwords for your own account, a single user with weak credentials can present a safety risk. This situation is especially possible for large ecommerce sites with lots of customers, blogs with multiple authors, and marketing agencies with large teams.

    Therefore, it’s best to use a trusted password policy plugin to help you manage your user accounts. These kinds of plugins enable you to enforce strong passwords, show a password strength score, and more.

    Lack of security protection 

    In addition to strong login credentials, you’ll want to make sure that your site has some extra security measures in place. These should protect it against the most common risks, like brute force attacks.

    This is when a hacker uses trial and error to guess someone’s login credentials. Strong passwords and usernames are the first defense against this type of attack, but there’s more you can do. As an added layer of security, you can install a plugin like Jetpack and enable the brute force protection feature.

    Incorrect user permissions or unnecessary accounts

    WordPress lets you assign a different user role to each account. Each role has a unique set of permissions, which you can then customize.

    If you’re not familiar with the default permissions for each role, you can end up giving certain users too much control over your website. As a result, inexperienced WordPress users could end up breaking your site.

    Let’s go over the major WordPress roles in descending order:

    • Administrator
    • Editor
    • Author
    • Contributor
    • Subscriber

    Some of these roles were originally developed for collaborative blogging purposes, so they can come in handy if you run a blog. If you manage an ecommerce store or WordPress Multisite, you’ll likely have additional roles like customer, shop manager, or super admin. 

    As a general rule, there should only be one administrator per site. This user has access to all the administration features on a site. 

    The other roles are pretty self-explanatory, but it’s probably best to review the details of WordPress user roles and capabilities before you start assigning them. It’s also a good idea to audit your site’s users from time to time. Dormant accounts can be hacked and utilized for nefarious purposes, so you’ll want to delete them before it’s too late. 

    An insecure login form

    Users will need to use a login form to access your site. Unless you use a third-party tool, WordPress generates this page form for you.

    By default, it only has fields for ‘username’ and ‘password.’ A simple form makes it easy for users to log in, but it’s not the most secure login process. 

    Therefore, you may want to enable Two-Factor Authentication (2FA) to make the login page more secure. This requires users to produce a unique, one-time code that’s sent to them via text message.

    Lack of spam filters

    Unfortunately, if you have a website, you’re likely going to have to deal with spam. With WordPress, this will most likely come in the form of comment spam.

    To prevent this, WordPress gives you the option to turn off comments completely. This might not be ideal if you want to use the comments section to engage with your followers.

    Therefore, you may want to use a spam filter. With over five million active installations, Akismet Anti-Spam is one of the most widely used spam solutions for WordPress. You can download a free version of the tool from the WordPress plugin directory, or you can get Jetpack Security, which includes a premium version of the Akismet plugin.

    Frequently asked questions about WordPress security and reliability

    At this point, you hopefully have a good understanding of how to secure your WordPress website. Still, just in case you have any lingering doubts, let’s go over some of the most frequently asked questions on the matter.

    Is WordPress suitable for large and enterprise-level websites?

    Yes, WordPress is an excellent platform for large and enterprise-level websites. That’s because you can customize every element of your site to support any amount of content and traffic. And if you run an ecommerce store, WooCommerce is highly scalable and grows with you. 

    Can WordPress reliably handle high-traffic sites?

    Yes, WordPress can easily handle high-traffic sites without issue, but this is largely dependent on your site’s hosting provider.

    If you know your website is going to receive a lot of traffic, it’s best to avoid shared hosting and opt for a private or cloud-hosted server instead. You’ll also want to look for unlimited bandwidth and performance optimization tools that will help keep your website running smoothly at all times.

    Is WordPress core secure?

    Yes, WordPress core is highly secure. In fact, it’s getting better all the time. Since it was created in 2003, it has undergone continual “hardening” to reduce the number of threats.

    Are WordPress plugins secure?

    Most WordPress plugins are secure. But outdated tools can put your site at risk.

    Fortunately, it’s easy to check if a plugin is reputable and safe. All you have to do is find its listing in the WordPress plugin directory and view its version details and ratings.

    Unfortunately, premium plugins without free versions are not listed here. That means you’ll need to dig a little deeper.

    In this scenario, your best bet is to look into the developers who created the plugin. For starters, you could look for an official website to learn more about them. If you discover that the same developers have made other tools, you can also cross-reference those. Make sure to read real reviews and testimonials from users as well, which will provide the most accurate assessment of the plugin.

    Are WordPress themes secure?

    Most WordPress themes are secure, but you should always vet them the same way you would plugins.

    What are some common security threats faced by WordPress websites?

    Some of the most common security threats for WordPress sites are brute force attacks, Direct Denial of Service (DDoS) attacks, malware, and comment spam.

    Here are some additional resources on these topics:

    You can greatly reduce the threat of these attacks by following the best practices we discussed in this article, and by using the right security plugins.

    What measures can I take to improve the security of a WordPress site?

    Here are a few things you can do to improve the security of your WordPress website:

    • Choose a high quality WordPress web host.
    • Safely install WordPress (or use WordPress.com).
    • Implement strong usernames and passwords.
    • Only install reliable themes and plugins.
    • Keep your WordPress core, plugins, and themes up to date.

    Even if you do all of the above, it might not be enough to provide the level of security your website needs. Therefore, the best thing you can do to protect your site is to use a robust WordPress plugin like Jetpack Security.

    What is Jetpack Security, and where can I learn more about it?

    Jetpack Security is a plugin that provides you with everything you need to safeguard your WordPress site. It includes the following tools:

    With these powerful security tools, you can create and manage backups, scan for malware, and block spam comments. You can learn more about Jetpack Security here.

    Build and manage a secure website with WordPress

    Choosing the right platform for your website is crucial, especially if you run a business. When your site is built on a solid foundation, you’ll be able to safeguard sensitive data and user information more easily.

    The good news is that WordPress is a highly-secure CMS. As long as you select a reliable hosting provider and follow some best practices, you should have nothing to worry about. You can start by installing WordPress safely and vetting any themes and plugins that you add to your site. It’s also important that you manage your user roles and permissions carefully. 

    Are you ready to take your WordPress security to the next level? With Jetpack Security, you’ll get a comprehensive web security tool that includes automatic backups, real-time malware scanning, spam protection, and much more!

  • WooCommerce Stripe Gateway Plugin Patches Security Vulnerability in 7.4.1

    Patchstack is reporting an Insecure Direct Object References (IDOR) vulnerability in WooCommerce Stripe Gateway, the most popular WooCommerce Stripe payment plugin with more than 900,000 active users. It was discovered by Patchstack researcher Rafie Muhammad on April 17, 2023, and patched by WooCommerce on May 30, 2023, in version 7.4.1.

    The security advisory describes the vulnerability as follows:

    This vulnerability allows any unauthenticated user to view any WooCommnerce order’s PII data including email, user’s name, and full address. The described vulnerability was fixed in version 7.4.1 with some backported fixed version and assigned CVE-2023-34000.

    It was assigned a high severity CVSS 3.1 score of 7.5 and added to the Patchstack database on June 13.

    The vulnerability affects versions 7.4.0 and below. Although the patch from WooCommerce has been available for two weeks, more than 55% of the plugin’s user base is running on versions older than 7.4 and it’s not clear how many 7.4.x users are on the latest version.

    The WooCommerce Stripe Gateway plugin’s changelog for version 7.4.1 includes two short notes and doesn’t elaborate on the severity of the security update:

    • Fix – Add Order Key Validation.
    • Fix – Add sanitization and escaping some outputs.

    Patchstack’s security advisory includes more technical details about underlying vulnerabilities fixed in this update. It is not yet known to have been exploited but store owners are encouraged to update to the latest 7.4.1 version as soon as possible.

  • #79 – Robert Abela on How to Keep Your WordPress Website Secure

    Transcript

    [00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.

    Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, how to keep your WordPress website secure.

    If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice. Or by going to WPTavern.com forward slash feed forward slash podcast. And you can copy that URL into most podcast players.

    If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea featured on the show. Head over to WPTavern.com forward slash contact forward slash jukebox, and use the form there.

    So on the podcast today we have Robert Abela. Robert is the CEO and founder of Melapress, formerly known as WP White Security. They make niche WordPress security and admin plugins. He has over 18 years of experience in the IT and software industries and has written numerous web security articles and white papers.

    We all know that your website is potentially under attack 24 hours a day, 365 days of the year. But why is that? And what can we do to mitigate that risk?

    Robert talks about the security of WordPress Core and how it’s matured over the years. He feels that in most cases, it’s not the Core of WordPress that you need to be concerned about, rather the array of plugins and themes which are added on top. The unique cocktail of software that you add to your site makes it challenging for security products to secure it.

    That being said, Robert is optimistic that there are strategies you can adopt which will make your site less likely to fall prey to malicious actors or bots. Updating plugins on a regular basis, keeping fresh backups and the monitoring of logs, all play a vital role and a straightforward to do.

    Robert is also at pains to point out that this is not a one-click or one time fix. You’re going to need to dedicate time and resources to your website security, and those resources and time will need to be increased as the importance and reach of your website grows. Evolution is the key here. What worked yesterday might not work so effectively tomorrow.

    Another topic we touch on is the automated nature of many of these attacks. Unless you’re hosting a website of some importance, hackers are not trying to break your specific website. They’re deploying automated attacks, trying to infect many websites at the same time. But why do they do this? What are the motivations of these bad actors? Robert explains that it’s not personal, but that does not mean that you can ignore the threat.

    We also chat about the many layers which go into making your website work. Typically, you’ve got a web server, a database, and often much more, and Robert explains why you need to be mindful of all of these when drawing up your security posture.

    Then, of course there’s the users of your site. The people who you’ve allowed to have legitimate access to the WordPress admin. If you’re in a large company with a high churn of employees, you’ll need to make sure that only people who need access have access, and that the permissions that they’re afforded a correct for the work they need to do.

    If you’re curious about how you can secure your WordPress website as it grows this podcast is for you.

    If you’re interested in finding out more, you can find all of the links in the show notes by heading to WP tavern.com forward slash podcast. Where you’ll find all the other episodes as well.

    And so without further delay, I bring you Robert Abela.

    I am joined on the podcast today by Robert Abela. Hello, Robert.

    [00:04:31] Robert Abela: Hello, Nathan. Thank you very much for the invitation. Always nice to talk to you.

    [00:04:34] Nathan Wrigley: Really nice to talk to you. I’ve spoken to you on various other occasions, so I know who you are, but it occurs to me that perhaps the audience don’t. Would you mind just spending a moment giving us a little potted history of yourself? Your relationship with WordPress. We’re going to be talking about security today, so perhaps that would be a good thing to concentrate on as well. So, Robert, over to you.

    [00:04:55] Robert Abela: Sure, I started when I was 20. I started working for a security software company. And through the process of 10, 12 years, I worked through different number of software security companies. So I was working in security.

    And for the last company I was working for, we needed a blog. And back then WordPress was up and coming basically. So yeah, we started using WordPress. Back then was the only viable, very good solution to use. But still, it was in its early days. It was around 2012, 2011, 2012. So of course back then security was a big issue, and there weren’t the vendors that there are today and the solutions that there are today. It definitely got my interest.

    So while I was working with the company, of course we implemented WordPress, but it got my interest. And then I met some people who worked in WordPress. You know, I like the idea of working from home or doing something for yourself. So yeah, it started as a hobby.

    I started writing about WordPress security and reading a bit more, because I was using it for my full-time job. Slowly, slowly it turned into a part-time, from a hobby into a part-timer. And then, yeah, it developed into full-time. And now yeah, I run a company, it’s called WP White Security, which currently by the way, we are re branding to Melapress.

    And yeah, we develop a number of security and management plugins. We started mostly with security plugins. But slowly, slowly we’re developing also a number of plugins, which kind of like, a mix of both. Security and also user slash website management plugins.

    [00:06:12] Nathan Wrigley: Thank you. People who are listening to this podcast, we have a real wide range of an audience. The audience is really broad and deep. And the reason I mention that is because there’ll be a cohort of that audience who understand all the ins and outs of security. And there’ll be a whole load of other people who realize that security online is a thing, but don’t really have any understanding of what we’re talking about.

    So perhaps that would be a good place to lay the groundwork on. Tell us a little bit about the state of WordPress security, if you like. We often hear about a plugin being a fix, or a firewall being a fix, or maybe you sign up for some kind of SaaS app and that’s the fix. But I’m sure that that probably isn’t the fix.

    There’s probably a whole bunch of different security vulnerabilities that we need to be aware of, as well as different ways to fix those. So just paint the landscape of WordPress security, if you like.

    [00:07:04] Robert Abela: Sure. To start off with, we can start with the WordPress Core. Many people think that WordPress is insecure in the Core. But yeah, if you ask me like 10, 12 years ago, I would’ve said yeah. But nowadays, I mean, WordPress in general, the Core, is a really robust, solid product. So WordPress is not an issue.

    But of course WordPress is surrounded, is made up from a huge ecosystem of plugins and themes. And nowadays of course, there are a lot of different solutions. And most issues usually are either user problems, lack of awareness. Or vulnerabilities, issues in plugins. But yeah, in terms of security, like it’s usually a mix of tools. It’s a mix of services, tools, the plugins for example, or services. Or a mix of both. And also best practices.

    You definitely, for example, if you have a bare bone WordPress, you need some plugins and services to implement some things and automate. Like add two factor authentication. Implement a firewall. Automate backups. Enforce some policies, for example. That’s what the software can give you, but you also need to follow some best practices. You know like, let’s say have some logs, an activity log. You need to keep an eye on those logs.

    You need to make sure that the software is always up to date. And by the way when we talk software, many people look just at WordPress, but you need to also keep up to date your own laptop software up to date. Any software you use through the process, your laptop, servers, whatever, everything needs to be kept up to date, not just WordPress.

    And of course one thing to keep in mind is, let’s say you harden WordPress the first time. Security is not a one stop fix. It’s not a one time fix. Because it’s secure maybe today. But as we all know, as businesses grow, as requirements change your website needs to adapt to these changes. So you might need to add new technology. Or you need to install any new plugin, or change something, or change the configuration on the server.

    So with every change, or with any new vulnerability that is discovered, make sure that you adapt your security strategy basically. What we call like the four pillars of security. The idea is of course first to secure, harden WordPress. Then of course monitor. Keep an eye of course, on what’s happening. Test, just keep on testing whenever you add something new. Is the firewalls still working as it’s supposed to be? Things like that. Based on findings, you need to improve.

    So as the website evolves, as your business evolves or your, whatever you are doing with the website, the scope of the website, and the requirements of your team. Security needs to evolve as well. Okay, install a plugin. You maybe use some services as well, a good mix. You have some best practice in place, but yeah, that’s just as of today.

    [00:09:20] Nathan Wrigley: It’s a never-ending enterprise really, isn’t it? You are constantly going to have to be tweaking this and examining this because the nature of the software, which WordPress itself sits on top of, the OS if you like, that’s always changing. WordPress itself is changing. The configuration of plugins, themes, and so on that you’ve got is changing. And also the nature of the attacks, which are coming your way is changing. The long and the short of it is the whole thing is changing. And so I guess you need to adapt with that.

    I just want to switch to the attackers themselves, because I always find this subject curious. What is in it for them? So these days we constantly see about the latest hack. You know, if you read tech journalism, you are seeing about SaaS platforms going down. You see about ransomware attacks. You see about people’s Bitcoin wallets being stolen and there’s just seemingly every which way that people can because mayhem, they do. But in a WordPress website, why are they doing it? What are the reasons that they’re doing it for? I guess we’ve come a long way from just so that they can deface your website.

    [00:10:27] Robert Abela: I’ve been listening to this podcast. It’s about the Lazarus group. I don’t know if you’ve heard about it. It’s from the BBC. Typically on the scale of attacks the motivation is mostly financial motivation. And okay, of course, like you don’t have any source of money or something on your website. This might not be the case. But these type of large scale attacks, they need a number of bots. Basically hacked websites, hacked servers, which they can use to ramp up their attacks basically.

    Or of course, if you want to hide, if you’re hacking a website, you’re going to hide yourself. You don’t want to hack it from your own computer. So you hack a website, you hack another server and use that kind of like a stepping stone. So as long as you have an online presence, whether it’s WordPress or not you are a target.

    That online presence, if it’s WordPress or not, any website or any device that is connected to the internet. It has resources. It has CPU power. It has memory. It has internet connectivity, bandwidth. So yeah, that’s a resource. Now, if it’s being hacked either to hack your website and deface website, or as a stepping stone to hack something else. But yeah, you are always target. So even if you have nothing of interest, even if you’re not doing, I don’t know, commerce to your website, and if you don’t have sensitive data, you are still a target.

    [00:11:31] Nathan Wrigley: If you have an e-commerce website, obviously there’s a real motivation there. You know, possibly break into your website and figure out what kind of orders have been replaced and cause mayhem there. And maybe try some sort of social engineering attack to steal people’s credit card details.

    But interestingly there you also just said just the resources itself, that’s enough. The fact that you have paid for a piece of a computer somewhere, a portion of a computer, the CPU and what have you. That’s enough for people because presumably they want to put their own software on the computer that you’ve paid for, and use it to do nefarious things.

    Now, that button means spraying out emails to people who don’t wish to receive them. But what other things are they up to? So if they’re not defacing things, but they are wishing to take your machine over. What kind of things can they do from there, once they’ve got that bridge established?

    [00:12:23] Robert Abela: They can do quite a lot. For example, there was this, going back to the Lazarus group, one of the smart hacks they’ve done. They targeted some bankers, some people who work in banks basically with a phishing attack.

    Quite frankly, it was the good old trick, like hi, you have won an award. Click here to win via email. Uh, someone from all those thousands of employees in a bank, someone clicked. And malware was injected there. And that led to allowing them to control some ATMs and stuff like that.

    But to get to there, when they managed to inject the malware in ATMs and of course control that, they wouldn’t control that malware, or launch the attack from their own servers. Because otherwise it’s very easy to track them back. They need some sort of proxies or stuff like that. So basically they’re going to use your website, which is hosted on a server. The resources of your website, of the server where your website is hosted to launch this attack.

    And it’s not the first time actually, they have multiple proxies. So from their machine, they send commands to your hacked website, which sends commands to another hacked website, as in hacked server, and then it sends the comment to the actual victim. The resources you’re paying for, the server you’re paying for, is being used purely for them to hide themselves basically as a proxy.

    [00:13:29] Nathan Wrigley: I guess one of the things that I hear sometimes is that people believe that because their website is of a small size, or may not be interesting, in inverted commas, that they therefore assume that the hackers won’t find it interesting. In other words, it goes a little bit like this, but my website’s small. You know, it’s about something really niche. Why would the hackers want to come after me?

    And I think what you’ve just said speaks to that. It’s irrelevant. It’s not really a hacker. There isn’t an individual doing this. It’s an individual at some point who wrote a script, which then got downloaded and redistributed a thousand times over the internet and deployed by a thousand different people.

    So you don’t need to look for an incentive. The incentive is there all the time. It’s not a person deliberately coming after you for a personal vendetta, usually. This is just people trying to gain some sort of bridgehead in the internet, on the internet, on servers somewhere so that they can because mayhem in ways that you cannot even imagine.

    [00:14:31] Robert Abela: Yeah. In fact, even when you say, okay, I don’t know, I have a website about a hobby, some old museum somewhere, whatever. We don’t accept payments. Who would be interested in our website? From the outside it doesn’t apply, because when actually hackers are trying to find, or malicious users are trying to find vulnerable websites. They’re not just browsing one by one.

    They have automated tools. They scan whole subnets, whole networks, you know. And they don’t even know or care whose website it is, or how it looks most of the time. Okay, this website has a vulnerability, we can exploit it. So of course we can run commands, you know, on the operating system or depending of course, what they want to do.

    But yeah, as long as they get access. So yeah, they don’t just target your website, just scan whole subnets. So, your website happens to be one of them. So yeah, if you have a vulnerability, if you have, I don’t know, an outdated plugin for example that has an issue, and you’ve never updated it and the vulnerability is there and they can exploit it, then yeah. They don’t care whose website it is or how it looks, whatever. It just, it flags okay, this website, they get a flag, this website is vulnerable. Exploit the attack, take over, and that’s it.

    [00:15:29] Nathan Wrigley: And I guess the other important part in that, is that this is not a personal thing. It’s very, very, very unlikely, unless you are some kind of nation state actor, that there’s going to be people sitting at computers designing software deliberately to get into your machine. This is just people spraying out bots all over the place, looking for vulnerabilities and then stumbling across them randomly, and then deploying the things that they’ve got to exploit, those vulnerabilities. So it’s not personal, and it’s very unlikely at the other end of that is a real human being. It’s just scripts written, who knows where and who knows when.

    [00:16:05] Robert Abela: Exactly. No, in fact, I’m sure like the bigger companies, you know, like Facebook. I’m sure they have a good share of targeted attacks because when you’re so big, I mean they definitely have some haters. But no, let’s say the normal websites, the normal hobbyist websites, whatever, which is quite funny because usually the hobbyist websites are the ones that people think, oh, who will attack my website? But yeah, it’s just like another number.

    So, it’s not personal, it’s nothing personal. And as you said, most probably not, most probably, like most of the things are automated. So yeah, there’s not one person doing something to you, it’s just the whole process and it’s all automated. So yeah, nothing personal indeed, yeah.

    [00:16:38] Nathan Wrigley: Yeah, which doesn’t make it any better unfortunately, even though it’s not personal. So let’s talk about the tech stack which our WordPress websites are sitting upon. Because again caveat emptor. I know that a lot of the people who are listening to this who are technical, this will be very obvious what we’re going to cover.

    But there’s a proportion of the people who are listening to this who may very well not know that there is layers and layers of things making their website possible, and those themselves are vulnerable. Even though you may never interact with them. You may only go to your WordPress, log in over there. Type whatever it is that you need to type, save, publish, and then log out again.

    That might be your only interaction with WordPress. But WordPress doesn’t sit in isolation. So what typically is the stack that it’s sitting on, and do we need to be concerned about all of the stack, or are there any pieces which are more concerning than others?

    [00:17:30] Robert Abela: It really depends. First of all, your own computer. So if you’re accessing your WordPress website, even just to update. Your own computer needs to be up to date. So that’s part of the tech stack. In regards to the website, it depends like if you have managed hosting where you have access just to this website, the bulk of the work, you still have to take care of some things and updating your software, but the bulk of the work is done by the web host.

    However, if you have a dedicated server or just any hosting where you just have to install WordPress, then of course because a typical, let’s say you have a dedicated server, you host everything yourself. The typical text tech stack, you have the web server, typically a Unix, Linux operating system. Then you have the web server, Apache, Nginx or something similar. You have also PHP, sort of like a framework, the language that WordPress is written in. You have MySQL the database server, that’s the most basic.

    So you have PHP, Apache, the web server itself of course, and the database. And then of course it depends, like if you need to send emails, you’re going to have the SMTP server and stuff like that. So when it comes to securing that, let’s say that one. To be honest when you look at the tech stack software nowadays, it’s quite easy to keep secure as in like, as long as you configure it properly and securely. Like you read maybe a bit, I don’t know about the, the best practices, and of course keeping it up to date. Software in general is not a big issue.

    The more time passes, I think the last few years we’re seeing a small shift, because usually it was always, okay exploiting this issue or exploiting this issue. But most of the cases vendors are quite responsive on their issues. The problem in the tech stack, it’s not actually any component in the tech stack, it’s the users. As in like, it could be even, you’re like, if you forgot to update a plugin or if you received a spam email or a phishing attack and you clicked on some untrusted link. Or downloaded something which you, you don’t know what it is, you know?

    There are so many tools nowadays when it comes to keeping your software up to date. There are so many resources. Like, listen, let’s read the best practices on how to set up a secure Apache server. And there are also, of course, services. You can pay people, you can pay professionals who can do these things for you.

    So the actual tech stack is, I wouldn’t say easy, because you need knowledge to do it, but yeah, it’s relatively easy if you know what you’re doing. You have the tools, you have everything you need to keep it secure.

    The problem nowadays more weak passwords, phishing attacks, and stuff like that. Using public WiFi, using unpatched computers. Using public computers to access some things. Unfortunately the user has become the weakest link in the whole chain, you know?

    [00:19:53] Nathan Wrigley: So you’ve got to really be careful what it is that you’re doing. What machine you’re using. Where you’re using that machine, and so on. I’m just wondering if there is, in your mind, any system which you would regard as pretty safe. I’m going to say a hundred percent safe, and then immediately withdraw that because I think we all know that’s not possible.

    But is there a position you can get into where you can have done enough. You’ve raised your guard up so much that you can relax? Or is this more a story of constant vigilance, constant worry, constantly assuming the worst is going to happen tomorrow? Or is it possible to employ the services of a particular, say, SaaS company, or a professional who might look over things for you?

    And be entirely happy that, okay, that’s now handled by somebody else. I’m entirely safe. Now I know that a hundred percent is off the table, but can we be confident that our sites are mostly safe if we take the right precautions?

    [00:20:51] Robert Abela: Yes. I think nowadays with all the tools that there are and all the services even the web hosts themselves, they really up to their game the last few years, especially the managed ones. As you said, a hundred percent is, you’re never guaranteed. But yeah, there are so many tools. If you inform yourself and if you implement some best practices, you websites are relatively safe.

    I mean, you should always take precaution steps. Like for example, backups, they’re very important. So if something happens, you can restore. Test those backups, of course, because many people miss that part. They take backup, like, have you ever tried to restore it? No.

    So it is very important. because sometimes of course, it’s software as well and it can break. So the restore might not work or something has been corrupted. So that is extremely important. But yeah, from the tech stack point of view it’s pretty much covered. There are a lot of options nowadays.

    Even like with a simple managed WordPress hosting, and installing a plugin or two, you’re pretty much covered, let’s say. What’s important is the best practice and the concept that listen, security is not one stop shop. I don’t think we should, one should be really paranoid to be honest. because as I said, we’re in a good position.

    But it’s very important for people to keep in mind, especially as the team grows. Because if you’re on your own one thing, it’s relatively easy because you know, you have exactly full control between you and the web host. You have roughly full control of, and you know what’s happening. But as the team starts growing, especially nowadays, in the WordPress ecosystem it’s very common to have remote businesses.

    You don’t have full control of your employees, as in like, not the employees themselves, but as in their machines and where they use them and how they use them. So I think what’s very important is of course to raise awareness, train them, train your team. Make them aware that, listen, use your laptop here, or have some sort of guidelines and make sure you can use as many possible tools, documentation, and training to make sure at least you can take care of that part.

    Which is, in my opinion, is the hardest part to secure. Because of course, you don’t have full control of users, users machines. That is the most important, because as I said the tech stack, like of course things can happen, but as long as you keep software up to date and stuff like that, unless there’s a zero day exploit, you really unlucky whatever. Okay, it’s never a hundred percent secure, but you are very near that number, you know.

    [00:22:57] Nathan Wrigley: In terms of the tech stack and the maturity of it, do we often get really innovative and unique vulnerabilities in the tech stack that builds a WordPress website? Let’s say you’ve got, I don’t know, a server, Apache Nginx or whatever it may be.. Do we ever find a new, novel attack? Does that typically come across, I don’t know, once a year, once a decade, something like that?

    So can we lower our guards a little bit or do we find, do you find, you’re the expert? Do you find that there are novel things that are uncovered by security researchers, which have been, maybe they’ve been exploited for a year or more, but kept very much under the radar, kept quiet. Is the landscape changing? Are there new and novel attacks happening all the time?

    [00:23:40] Robert Abela: Not really, in terms of vulnerabilities. We’re still playing with the same, for example, SQL injection was discovered in the late nineties. The first decade of 2000 we started discovering other vulnerabilities, like cross size scripting, cross request forgery, you know, and the other ones.

    When you discover a new type of vulnerability that I would say, of course, that is very innovative. But for the last 10 years, even if you look, there are some websites which keep kind of like an aggregate of the vulnerabilities that are found in plugins. It’s always the same, especially cross site scripting is very common.

    By cross site scripting, it’s also very important to like every different types of cross site scripting, different type of vulnerabilities, have different type of severity. So if a plugin has a cross site scripting vulnerability, it’s not necessarily that one should panic, because I’m not saying, okay, just relax, take it easy.

    But listen, some of the vulnerabilities, for example, are very, very hard or can be exploited in a very particular edge case. So it is very important to keep things up to date. But yeah, in terms of innovation, no. In terms of new vulnerabilities, not much.

    What is really changing? I think the way malicious users are getting much smarter in the way they craft their attack. They’re still using the same exploits and same, same issues. Exploiting old software, old vulnerabilites. The good old SQL injection, cross my scripting. But the way they are approaching it, the way they are building, drafting their tech, it’s much more complex.

    There’s a lot of intelligence behind it, like how they use a number of different vulnerabilities to build an attack. First you send an email. If the victim gets the bait basically, if they click something or whatever. And then if they click, for example, install some malware on the computer, which allows you then, for example, I don’t know, some sort of key logger, and then you see what they’re doing.

    Maybe they are connecting to a website and they’re uploading something. So we’ve seen much more complex type of attacks where people are stringing a number of vulnerabilities together to successfully attack some particular target.

    But in terms of innovation of new type of vulnerabilities, like new ways of exploiting software, we haven’t seen much, no. For the last 10 years, it’s been pretty much same old, same old kind of thing.

    [00:25:42] Nathan Wrigley: Now I’m going to throw a spanner in the works here and ask you about AI. It’s all the rage at the moment for creating content and probably people in the WordPress space know that people have been able to create plugins, and create all sorts of things around the WordPress space.

    Lots and lots of endeavors in WordPress using AI, and I’m wondering if this has started to become a trend amongst the hackers as well? Whether they’re using this technology to refine their processes? Possibly to go and look at the source code of things like WordPress or Linux kernel, or whatever it may be. Speeding up the process, finding new novel things. My question really boils down to, does AI and internet security, is that a point of concern, do you think, in the near future?

    [00:26:31] Robert Abela: I think right now, not really. It’s still too early, but I think AI is a big changer in general, in every industry, every vertical of the internet industry. Having said that, AI is not a human, so it’s not necessarily coming up with something innovative.

    It’s still, at the end of the day, it still has some sort of database where it gets information from. The difference is that nowadays, instead of using Google and browsing through search results, trying to find exactly what you need, okay, this website, no, it’s not here to click on the other one, go on that page.

    Rather than going through that process of course, with AI, we’ve really accelerated that. We’ve really automated that. So nowadays, like with AI, especially if you know how to ask what you need, you’re going to get the answer much quicker. So things that usually would take you, let’s assume a malicious user wants to hack something, a target.

    It used to take them days or weeks maybe to craft something and to think of something original and learn about something. Because of course you have to search for everything and read a bit more, and try this and try that. With AI, of course you’re accelerating this process. And by accelerating that process you’re achieving much quicker results.

    And typically also, true AI, not because AI cannot come up with something new, because it’s always getting information from what there is. But I’m pretty sure it can, because of this fast process, I’m pretty sure it will lead slowly, slowly to also new innovations. In every aspect, content writing, security, security both in terms of attack and defense and every aspect of the internet.

    [00:27:55] Nathan Wrigley: Yeah, that’s an interesting point. I hadn’t really thought about that. I was thinking about that from the attacker side. But of course, the defense side also has the same tools to deploy, and I’m imagining that if you’re the vendor of a, of a security product, whether that’s a firewall or a plugin or whatever, you’re also going to be deploying the same tools to try and mitigate what the adversaries are doing.

    [00:28:17] Robert Abela: The thing is that luckily both the attacker and the, let’s say the white hat vendor have access to the same tools. So yeah, if you use them wisely. Also, this thing is always a bit of a cat and mouse game. The malicious users do something, the vendors up their game, then they do something, then they up their game and stuff like that.

    [00:28:36] Nathan Wrigley: I want to just turn our attention to a typical WordPress user. Perhaps somebody who really doesn’t know a great deal about this. They’re listening to this podcast because they’re curious about WordPress. They’ve got a site which they run, it’s their own. Maybe they’ve got a couple of sites.

    They’re beginning that journey on creating their own freelance business or something like that. Do you have any guidance as to how often things ought to be done? Is this really a process of you really should be logging in every day, checking for updates, and while you’re at it, why not just switch automatic updates for Core and all the plugins that you’ve got on?

    Or is this more of a look, once a week is fine. I’m sure there won’t be a hard and fast rule, but people who are just beginning their journey with WordPress, they probably do need concrete examples of how they should best handle this.

    [00:29:18] Robert Abela: It really depends on the scale of the business and how much traffic your website is getting. And also the number of people working on the website. Because one person or two people from the same room, it’s totally different than being even two people from different locations. And how much the team is security savvy, not necessarily technical, but at least have some basic understanding.

    But yeah, in general let’s say a typical startup where you are switching between kind of like a transitioning from a hobby to a part-time. I think as long as you take care of the obvious, install some plugins, add 2FA, add some logs, add a firewall, make sure that you have backups. Work with a solid web host.

    As long as you take care of the basics, you should be pretty much covered, and yes, like everyone else, for example checking Google Analytics, or any type of analytics software for that matter. Yeah like, people are doing it for SEO, but it also helps keeping an eye.

    Maybe there’s a spike of traffic coming from some unusual location. All these things can lead to something. Check your website every day. You know, like it’s very important, for example especially if you have a very small number of users. You are two or three users. I mean like once a week, maybe you should have some sort of checklist, you know, check how many users are on your website. Run some file integrated scans. You know, like some basic stuff.

    Once a week is more than enough at that level. So yes. But what’s important, I think at that stage, especially if you are growing, it’s very important to draft policies and follow security best practices when the team is still very small.

    Why? Because if you are not organized when the team is very small, it’ll be much harder, and you’ll have much bigger problems when the team is very big. It’ll be much harder to implement a change. Like, I don’t know, like we used to do something one way, and after one year, the team now is a hundred people.

    It’s much more difficult to convince those hundred people, listen, we’re going to change this and we’re going to start doing it this way. And yeah, this can of course, irritate people because people tend to resist change, especially if it affects their productivity or if it’s too complicated.

    So I think what matters is, especially as you’re starting, set up some policy, some guidelines, some best practice for yourself, have some sort of checklist. Yes, once a week or so. You can also do it almost once a month, but again, play it safe. Why not spend an hour every week, have a checklist, check how many users are there on your website, check some logs, check the traffic on the website, you know, check the list of plugins. check the files.

    Especially, a file integrity monitor can tell you lot of things because if there is a file, typically when a website is hacked, there is a file that has changed. A file has been deleted, or a file has been modified, even an actual legitimate file, it has been modified. So yeah, that can tell you a lot.

    Luckily nowadays, of course most of these systems, configure email alerts, you can configure some SMS and stuff like that. So of course you’re automating much and much more. But it’s still good to take a look. And also it’s very important because we, for example, we develop an activity log plugin, and some people are, okay, what should I look for in the logs? It’s very difficult to answer that question, because it truly depends on your business. Because, it’s very important for website owners to understand what’s running on their website and how it’s being used, and only then you can make informed decisions.

    Okay, is this log, not just in WordPress, even the web server logs, even in analytics. Is this traffic normal or not? Because, if for example you are based in the UK and typically you get all the traffic from Germany. So by seeing a spike from traffic in Germany, that’s normal to you. But for someone who’s based in the UK but only has UK traffic, a spike of traffic in Germany is a problem for them.

    So first what’s very important is to understand your website, have some basic checklists. The most basic stuff, once a week or so. Keep an eye on these things. Traffic, and logs usually, and also log into the website. Why not? You know, just go to the plugins page. Are these all the plugins that I installed? Are these all users that I had? That’s a really good step.

    By setting those best practices and those checks once a week, as the team grows it’ll be easier to maybe add something new because of course the team is growing, so you need to add more policies or you need to add, secure something else, you know? So, yeah, that’s very important. It’s very important to keep an eye on things, just check how things are running.

    But of course with managed web hosting, especially for WordPress things, most of these things are almost covered for you. Many web hosts have different packages. Many web hosts nowadays they have their own kind of like internal monitoring systems as well. We’ve noticed you have this plugin, which is outdated, or we’ve noticed this. So at least there is a lot going on for you already.

    And that’s why I said even earlier, it’s good of course, to be aware, and to be conscious that, listen, these things can happen, but we don’t need to be stressed. If you’ve done your homework, if you do your own homework, and you follow best practices, you choose a good web host and stuff like that, then you are in a good place.

    [00:33:53] Nathan Wrigley: Yeah, I guess it’s a good point to mention that the WordPress ecosystem, given its enormous size and reach in the website creation space, you’re in a pretty good spot because there has been so much effort poured into, not only making WordPress secure, but making the update system for plugins and themes trivially easy to switch on.

    And I’m just wondering about that one actually. I’m just wondering what your thoughts are on automatic updating. Personally I’ve, in most of the places where it’s possible, I have switched that on, and have had no negative consequences. You know, none of the plugin updates have destroyed anything in ways which would make me want to switch that off.

    But that is an option which I know that a lot of people don’t make use of, and I’m wondering what your thoughts are on that. So in the WordPress admin, it’s possible to automate the whole process of updating. It’ll just do it on a regular cycle if it knows there’s a WordPress plugin update, it’ll just do it for you and hopefully everything will work out.

    And obviously now we’ve got a safe mode built into WordPress not that long ago. So let’s just talk about that quickly. What do you think about automatically updating everything when possible?

    [00:34:59] Robert Abela: Speaking about ourselves, we have automatic updates on minor version updates. Because we have like 4.0.1, 4.0.2. We allow that. because yeah, most cases, usually these updates are just small bug fixes here and there. The chances of something breaking, especially with a plugin update is with major version changes, because of course the vendor has implemented a new feature or drastically changed a feature and stuff like that. Of course, for the better.

    But, especially for vendors, it’s very difficult. Let’s say you have a plugin, it’s installed onto a hundred thousand websites. It is very difficult to simulate all those a hundred thousand websites, and simulate upgrades. So of course we try our best to do as much as we can to test as much as we can in different scenarios. But it’s impossible.

    So in terms of auto updates, for us and which is something I recommend, I would definitely enable them for minor version updates. In regards to major version upgrades, nowadays again, most hosting providers have the staging websites. Just run it on the staging website, literally, it only takes 10 minutes.

    Run it on the staging website. Check the area on the website that is affected by that plugin. I don’t know if it’s an SEO plugin, for example, you check that the headers are still loading or the metadata is still loading. Or if, I don’t know, it’s the tables plugin, check that tables are still loading properly.

    And yeah, if it works, update the live site as soon as possible. WordPress itself of course, as soon as you log into the dashboard, and you go to the plugins pages, you have that even, you don’t need to go to the plugins pages. You have that icon that you have updates. So it’s very difficult to miss updates. So that’s great.

    But even if, let’s say you’re not logging into your website on a daily basis, there are many services, every vendor usually they have their own change log, you can subscribe to their newsletter. So yeah, whenever there’s an update, you’ll get an email or some sort of notification.

    So it’s very important if you’re not logging into your website every day to see when there are updates. At least subscribe to the vendor’s newsletter or builds updates or something. So at least you get an email that, listen, we’ve released an update, especially if it’s a major update. If you have, of course, the automatic updates for minor version upgrades, especially if you have a big website.

    Like an e-commerce website, you can have a good number of plugins, tons of plugins. At least you don’t have to do almost daily updates. For the major version updates, if it’s a relatively small website, you might get on with enabling, automatic updates on that as well. But yeah, do it on a staging website. It literally takes a few minutes. Just update the plugin on the staging, run a quick test, 15 minutes maximum and turn on updates on the live website. So yeah, definitely.

    [00:37:16] Nathan Wrigley: It’s also the kind of thing that once you’ve done it a few times, it becomes kind of muscle memory and you can do that staging to updating plugin to, you can do that very trivially quickly and get on with your day if that’s not the main part of your business.

    Just one last question. You talked earlier about members of staff and what have you. I’m just wondering if you’ve got any guidance, again possibly for the more inexperienced WordPress user, about the kind of roles that you might assign to people in WordPress. Obviously, if you are giving everybody the administrator role, you may well find yourself in a bit of trouble.

    And also about the nature of cleansing out the users that you’ve got on your WordPress website on a regular basis. So, you know, if you’ve got a big team and you’re constantly churning through staff, that’s probably something you want to be thinking about as well, because that’s an attack that you really can’t avoid if you don’t make the effort. You know, if you’ve given somebody an administrator account and they’ve got bonafide access to get into the website and you don’t revoke it. Or you’ve given them too many permissions and they then get fired and you know, they fall out with you, there could be problems afoot there.

    [00:38:19] Robert Abela: Yeah, indeed. Definitely one shouldn’t give admin roles, assign the admin role to everyone. In fact, as a best practice, I would say have an admin account, really difficult to use and that should only be used by you and only as back up. Because even you as a website administrator, you don’t need admin access whenever you log into the website.

    If most of your work is still updating some posts, or maybe changing something from the theme. So no, admin roles shouldn’t be used that often. WordPress has a number of built-in roles. It depends again on the nature of the website, what you’re doing with it. For some people, those roles work.

    But yeah, the fact that there’s this technology of roles is, it’s already good, because there are also a number of plugins which you can use to create different types of roles to assign multiple roles to users. And most plugins nowadays they either create their own roles on your WordPress website, or they have different types of functions where you can, okay, like, literally some plugins, you can say, okay, I created a new role for them and I want these people to do only these type of things on this plugin.

    So the role control, and what people can do and cannot do, especially when you use a third party plugin to create your own custom roles and to assign different privileges, is very granular. Definitely no admin access for no people, quite frankly. But yeah, the rest, I definitely recommend using some sort of custom role editor so you can create your own custom roles as well if the default ones don’t work for you.

    We always talk about the principle of least privilege. I was a systems engineer when I used to work for their companies and, the easiest way, I was like, yeah, give them admin access because it’ll work for sure. Of course. Unfortunately, it’s a very common practice. But no, the reality is you should, yes, start with the least possible.

    And if they don’t work, see what else they need. Okay. What else do you need? I need to access this page from this plugin, and check. Contact the vendor from the plugin. Listen, do you have specific privileges for this? Or do we need this? Do we need this? And to build slowly. Yes, I understand that it hinders the productivity, kind of slows down things. But it only slows those things for a day or two. Or give them maybe a bit more access for a day or two until you check with the vendor and then reverse that access.

    So always give the least possible. It’s also a question like of user accountability. Some compliance bodies actually have regulations about this. If someone shouldn’t be seeing certain customer data, regardless if you trust them or not, they shouldn’t be seeing it. Why are you giving them access kind of thing.

    So, it’s very important to live by the kind of like principle of lease privilege when it comes to users. Give them the lease possible. Even for them, especially if they’re not tech savvy. This doesn’t have to do with someone being malicious, or even if they make a mistake, at least they make a mistake within their environment, their privileges. Not a bigger mistake.

    Roles definitely should be used. And yeah, there are a lot of plugins. We’re lucky because there are a lot of plugins which allow you to create your own custom roles, assign different privileges for roles and stuff like that. Definitely roles are definitely things that should be used.

    [00:41:05] Nathan Wrigley: This is a topic that we could probably talk about for days.

    [00:41:08] Robert Abela: Yeah, roles on their own, yes.

    [00:41:10] Nathan Wrigley: And more broadly about WordPress in general. You know, should we keep the REST API on, and are there a bunch of things that you would switch off by default. But unfortunately we’re kind of running out of time, so I’m going to leave those questions possibly for another episode.

    Or another way of getting the answer might be, if people want to contact you, Robert, directly. Where can you be found? Do you hang out on social? Is there an email address that you prefer to mention? Where can we best find you, Robert?

    [00:41:37] Robert Abela: Yes. Uh, our website is wpwhitesecurity.com but as I said, we are rebranding. So we are announcing the new name at WordCamp Europe. The new website will be melapress.com. m e l a press.com. So yeah, my email is very simple, robert at melapress.com or at WP White Security. I’m also on Twitter and stuff like that. But yeah, I think email is definitely one of the most efficient.

    [00:41:58] Nathan Wrigley: Thank you very much, Robert. I really appreciate joining us on the podcast today. Thank you.

    [00:42:02] Robert Abela: Thank you. Thank you very much.

    On the podcast today we have Robert Abela.

    Robert is the CEO and founder of MelaPress, formerly known as WP White Security. They make niche WordPress security and admin plugins. He has over 18 years experience in the IT and software industries, and has written numerous web security articles and white papers.

    We all know that your website is potentially under attack 24 hours a day, 365 days of this year, but why is that, and what can we do to mitigate that risk?

    Robert talks about the security of WordPress Core and how it’s matured over the years. He feels that in most cases, it’s not the Core of WordPress that you need to be concerned about, rather the array of plugins and themes which are added on top. The unique cocktail of software that you add to your site makes it challenging for security products to secure it.

    That being said, Robert is optimistic that there are strategies you can adopt which will make your site less likely to fall prey to malicious actors or bots. Updating plugins on a regular basis, keeping fresh backups, and the monitoring of logs all play a vital role and are straightforward to do.

    Robert is also at pains to point out that this is not a one click, or one time fix. You’re going to need to dedicate time and resources to your website security, and those resources and time will need to be increased as the importance and reach of your site grows. Evolution is the key here. What worked yesterday might not work so effectively tomorrow.

    Another topic which we touch on is the automated nature of many of these attacks. Unless you are hosting a website of some importance, hackers are not trying to break your specific website. They’re deploying automated attacks, trying to infect many websites at the same time. But why do they do this, what are the motivations of these bad actors? Robert explains that it’s not personal, but that does not mean that you can ignore the threat.

    We also chat about the many layers which go into making your website work. Typically you’ve got a web server, a database, and often much more, and Robert explains why you need to be mindful of all these when drawing up your security posture.

    Then of course there’s the users of your site, the people who you’ve allowed to have legitimate access to the WordPress admin. If you’re in a large company with a high churn of employees then you’ll need to make sure that only people who need access have access, and that the permissions that they’re afforded are correct for the work they need to do.

    If you’re curious about how you can secure your WordPress website as it grows, this podcast is for you.

    Useful links.

    WP White Security

    Melapress

  • WordPress 2FA Authentication: The Lowdown on This Essential Site Security Element

    The battle for your online personal information is between you on the one side and bad actors on the other. While you can’t control what security provisions other sites have, you do get to control your own site security. Two-Factor Authentication (2FA) is one way to protect yourself from breaches, and WordPress 2FA authentication can help you implement it.

    The post “WordPress 2FA Authentication: The Lowdown on This Essential Site Security Element” first appeared on WP Mayor.

  • Proactively Protect Against WordPress Vulnerabilities

    Proactively Protect Against WordPress VulnerabilitiesWithout a doubt, WordPress remains the most popular content management platform in the world, powering over 43% of websites worldwide. Given its immense popularity and the number of businesses running on the WP platform, it’s no surprise that a WP website is a common target for cyberattacks. Have you done everything in your power to […]

    The post Proactively Protect Against WordPress Vulnerabilities appeared first on WPExplorer.

  • Jetpack 12.1.1: Critical Security Update

    Earlier today, we released a new version of Jetpack, 12.1.1. This release contains a critical security update. While we have no evidence that this vulnerability has been exploited yet, please update your version of Jetpack as soon as possible to ensure the security of your site.

    To help you in this process, we have worked closely with the WordPress.org Security Team to release patched versions of every version of Jetpack since 2.0. Most websites have been or will soon be automatically updated to a secured version.

    During an internal security audit, we found a vulnerability with the API available in Jetpack since version 2.0, released in 2012. This vulnerability could be used by authors on a site to manipulate any files in the WordPress installation.

    Here is a full list of the 102 different versions of Jetpack we’ve released today:

    2.0.9, 2.1.7, 2.2.10, 2.3.10, 2.4.7, 2.5.5, 2.6.6, 2.7.5, 2.8.5, 2.9.6, 3.0.6, 3.1.5, 3.2.5, 3.3.6, 3.4.6, 3.5.6, 3.6.4, 3.7.5, 3.8.5, 3.9.9, 4.0.6, 4.1.3, 4.2.4, 4.3.4, 4.4.4, 4.5.2, 4.6.2, 4.7.3, 4.8.4, 4.9.2, 5.0.2, 5.1.3, 5.2.4, 5.3.3, 5.4.3, 5.5.4, 5.6.4, 5.7.4, 5.8.3, 5.9.3, 6.0.3, 6.1.4, 6.2.4, 6.3.6, 6.4.5, 6.5.3, 6.6.4, 6.7.3, 6.8.4, 6.9.3, 7.0.4, 7.1.4, 7.2.4, 7.3.4, 7.4.4, 7.5.6, 7.6.3, 7.7.5, 7.8.3, 7.9.3, 8.0.2, 8.1.3, 8.2.5, 8.3.2, 8.4.4, 8.5.2, 8.6.3, 8.7.3, 8.8.4, 8.9.3, 9.0.4, 9.1.2, 9.2.3, 9.3.4, 9.4.3, 9.5.4, 9.6.3, 9.7.2, 9.8.2, 9.9.2, 10.0.1, 10.1.1, 10.2.2, 10.3.1, 10.4.1, 10.5.2, 10.6.2, 10.7.1, 10.8.1, 10.9.2, 11.0.1, 11.1.3, 11.2.1, 11.3.3, 11.4.1, 11.5.2, 11.6.1, 11.7.2, 11.8.5, 11.9.2, 12.0.1, 12.1.1.

    If your site is running any of these versions, your website is not vulnerable to this issue.

    We have no evidence that this vulnerability has been exploited in the wild. However, now that the update has been released, it is possible that someone will try to take advantage of this vulnerability.

    We apologize for any extra workload this may put on your shoulders today. We will continue to regularly audit all aspects of our codebase to ensure that your Jetpack site remains safe.

  • WordPress 6.2.2 Restores Shortcode Support in Block Templates, Fixes Security Issue

    WordPress 6.2.2 was released early this morning as a rapid follow-up to 6.2.1, which introduced a bug that broke shortcode support in block templates. Version 6.2.1 was also an important security release, but due to the catastrophic breakage for those using shortcodes in block templates, some users were implementing insecure workarounds or simply downgrading to 6.2 to keep critical functionality working on their websites.

    WordPress contributors worked quickly over the weekend to ensure that users can now update to 6.2.2 with their shortcodes intact. The release post identified the removal of shorcode support in the previous release as “a regression” and a bug. This is an important recognition, as shortcodes are still a tool that users frequently rely on to insert functionality from plugins that haven’t made it available as a block, as well as a necessity for things that won’t work without inline shortcodes.

    Version 6.2.2 is also a security release, as core contributor Jonathan Desrosiers said that the issue patched in 6.2.1 “needed further hardening” in this update.

    Users are advised to update immediately and automatic updates are rolling out. Many reported having turned automatic background updates off for core after 6.2.1 broke their websites. Users who did so will need to manually update as soon as possible.

  • WordPress 6.2.1 Released with Fixes for 5 Security Vulnerabilities

    WordPress 6.2.1 was released today. Those with automatic background updates enabled should see a notice in their email, as updates rolled out earlier today.

    This is a maintenance and security release that includes important fixes for five security vulnerabilities outlined by core contributor and release co-lead Jb Audras:

    • Block themes parsing shortcodes in user generated data
    • A CSRF issue updating attachment thumbnails
    • A flaw allowing XSS via open embed auto discovery
    • Bypassing of KSES sanitization in block attributes for low privileged users
    • A path traversal issue via translation files

    The patches were backported to WordPress 4.1. Now that these vulnerabilities are public, it’s recommended that users update immediately.

    WordPress 6.2.1 also includes 20 core bug fixes and 10 fixes for the block editor, all detailed with ticket numbers in the release candidate post.

  • Essential Addons for Elementor Patches Critical Privilege Escalation Vulnerability

    Essential Addons for Elementor, a plugin with more than a million active installs, has patched an unauthenticated privilege escalation vulnerability in version 5.7.2. The vulnerability was discovered on May 8, 2023, and reported by Patchstack researcher Rafie Muhammad. It was given a 9.8 (Critical severity) CVSS 3.1 score and is not yet known to have been exploited.

    Muhammad outlined the vulnerability in a security advisory published today:

    This plugin suffers from an unauthenticated privilege escalation vulnerability and allows any unauthenticated user to escalate their privilege to that of any user on the WordPress site.

    It is possible to reset the password of any user as long as we know their username thus being able to reset the password of the administrator and login on their account. This vulnerability occurs because this password reset function does not validate a password reset key and instead directly changes the password of the given user. 

    The plugin’s authors published the patch today, on May 11, with the following note in the changelog:

    5.7.2 – 11/05/2023
    Improved: EA Login/Register Form for Security Enhancement
    Few minor bug fixes & improvements

    The vulnerability affects sites using versions 5.4.0 to 5.7.1 of Essential Addons for Elementor. Users are advised to update to the latest version 5.7.2 immediately now that Patchstack has published the proof of concept for exploiting it.