There has been a flurry of WordPress security and vulnerability articles over the past week or so. It is no surprise that the world’s most popular website builder is a target for threat actors, especially as Automatic’s core code can be added to with third-party, open-source or even self-written plugins, which may or may not come up to the required security standard. WordPress.org states there are over 55,000 plug-ins available – there is no indication if they are all secure.
PayPal phishing kit added to hacked WordPress sites for full ID theft (bleepingcomputer.com)
Attackers scan 1.6 million WordPress sites for vulnerable plugin (bleepingcomputer.com)
Buggy WordPress plugin allows complete site takeover • The Register
My advice: Either you or your IT support need to check whether these issues impact your systems. You need to have a master document that details your systems, hardware, software, online, networks, back-ups, suppliers etc – so when cyber security (or operational) issues arise you and your support teams can quickly check if you are affected. From there you can take fast, effective action.
For a while Octagon Technology and Smart Thinking have been working to improve the security stance of WordPress for our clients. From this we have implemented, for those clients that have opted in, an updating and backup procedure for WordPress installs – which includes monitoring and management – something we discovered many web designers did not do.
We have tackled MFA and the inappropriate use of administrator accounts – creating a security schema to enable working from anywhere or from smartphones for content producers. This was such an important security step for one person and micro-companies that it is included in our WordPress Consultant‘s Website Package as standard.
We also encourage our clients to carefully consider how many user accounts they have. We have found that regular contributors need their own account, but for occasional contributors it is better to reduce the risk and have them submit Word documents. To make this work for our clients we have produced a schema that enables the site Editor to upload the completed blog post quickly, making the whole process very efficient.
Simple but strong steps to improve your WordPress security – and you do not need to be one of our hosting clients to take advantage of these services.
Clive Catton MSc (Cyber Security) – by-line and other articles
