Security: WordPress Maintenance Series – Part 3

Security Protects Your Investment, Your Brand, and Your Site Visitors

Over the years, as popularity grows in numerous platforms and operating systems, nefarious agents are also trying to invade sites with malicious intent for many possible reasons intentionally:

• Steal data
• Compromise functionality by embedding code that will redirect site visitors to other locations
• Embed malware on a site designed to infect the devices of site visitors
• Take over the control of a website for ransomware — no longer just the enterprise but now seen in smaller businesses, too.

While no one can rationally guarantee that a website will never be hacked, there is much we can do to dissuade attacks and utilize due diligence and best practices to protect them.

Shared hosting with hundreds of websites installed on a single server box might be economical with cheaper hosting plans, but one has no idea what sites share that server box.  Unless the host has strong security in place, there is a silent threat of cross-contamination and compromises that put a website at higher risk.

There’s no single line of protection, but these items are prominent on our list:

• Does the host have a WAF (Web Application Firewall) in place?
• Is there a host-provided “Security Scanner” tool in place? Even if these involve a small annual fee, they are worth it as the site is scanned frequently, and the tool sends email notifications should anything untoward be found. Depending upon the assessed severity, some hosts may isolate a website to alleviate potential damage to their servers.
• Use SSL Certificates
• Force HTTPS so that all content is delivered by HTTPS versus HTTP in the URLs. The browser bar will display the secure padlock and prevent “mixed content.” Browsers prevent an HTTPS website from loading the most insecure resources, like fonts, scripts, etc. Migrating an existing website from HTTP to HTTPS means identifying and fixing or replacing mixed content.
• When setting up WordPress, use strong passwords for all logins, including configuring the MySQL database.
• Use a more secure MySQL Database table prefix. The default is wp_, often guessed by bots; we use lengthier and more cryptic labels.
• Regular backups to ensure a fast rollback should anything go awry.  We recommend a host that keeps 30 days of backups in place and our own WordPress-based backups on-demand or scheduled.  » See Backups: WordPress Maintenance Series – Part 2
• On the WordPress site itself, force strong passwords and prevent some usernames (never use “admin”) for new users created by site admins, especially for public-generated subscriber or customer roles.
• Use one or more all-in-one security plugins, such as Wordfence Security, Solid Security (formerly known as iThemes Security), SecuPress, Defender, or Sucuri Security. Some hosts have their own tools, such as SiteGround Security. These allow you to activate a firewall, two-factor authentication, and security scanners while fighting brute-force attacks. Other plugins have a special focused function we may use in combination with those above.
• Keep software updated, but only after researching the safety of the update, and be prepared to replace a plugin if it’s abandoned or unpatched. » See Updates: WordPress Maintenance Series – Part 4
• Use high-quality themes and plugins to include a prevalence for selecting highly-rated free plugins with thousands of installs and premium plugins.  The majority of free plugins we select to install also have a premium upgrade available for purchase (we may not need the extra functionality, but these tools often remain more compatible with WordPress core and other popular plugins, are better supported, and if a security fix is needed, it is rendered very quickly (often within hours).
• Monitor Security Bulletins published by WordFence and Solid WP, amongst others.
• Monitor the WordPress Developer Forums for “buzz” about problems with WordFence core, themes, and plugins.
• Use 24/7 Uptime Monitoring to receive alerts if there is downtime. This might be a signal that either the host is having a problem or there is a serious issue on the website. There is the potential that this is security-related.

While Sullivan Solutions WordPress Maintenance Care always utilizes best practices to prevent security threats and optimize performance, we closely monitor the threat levels in any Security Bulletins to see if any plugins listed are installed on any client sites.  We dive in to learn the details and see if a patch is available.  If so, we triage our workflow according to the threat level.  As we do not use a centralized dashboard to manage all our client sites, we do access each individually and take quick action to provide a remedy, whether it’s to update to the patched version or deactivate and remove the vulnerable asset if unpatched (and find a replacement).

Recent Increases in WordPress Security Threats Requires Nimble and Proactive Prevention Best Practices

• About 90% of attacks perpetrated against a CMS affect WordPress. 2,800 attacks per second target WordPress installations worldwide!
• Abandoned Plugins Spike As a Risk Factor
  • In 2022, Patchstack reported 147 abandoned plugins and themes to WordPress.org. Of those, 87 were removed, and the remainder were patched.
  • In 2023, abandoned plugins exploded from 147 in 2022 to 827 plugins and themes in 2023.

When known, we may see a specific type of attack looking for a named script in monitoring WordFence live traffic and logs, and our weekly Security Bulletins identify the threat level of plugins with known problems — either patched or unpatched (Critical, High, Medium, Low).  We triage our services based on criticality.  Those plugins that are Critical or High threat levels with available patches are

What’s a patch?

A patch is a software update that provides a fix for the specific issue that is a threat. Consider it a software Bandaid for a theme or plugin and sometimes for WordPress core.

Top WordPress security teams, such as WordFence, publish a weekly security threat bulletin (and immediately when massive issues present).  They have a “bug bounty program,” where talented WordPress developers (with considered coding acumen) are rewarded financially for identifying WordPress security vulnerabilities in:

• WordPress core,
• Free and premium themes, and
• Free and premium plugins.

The original software author/developer is notified as soon as possible and given a brief time to develop a solution to fix the security vulnerability. If the theme or plugin is fixed, the update is published, e.g., in the WordPress Plugin Repository. The item is listed as “patched” in the weekly security bulletin with all the details about the safe version number.

However, if not patched, using the example of a free plugin, it is listed as unpatched in the security bulletin.  Subscribers are warned to deactivate the plugin immediately until a patched version is available.  It is not uncommon for the WordPress plugin repository to either temporarily or permanently remove the plugin from its directories.  This may mean that the developer has been either unresponsive or unable to provide a fix. There are times when the risks are so high that we remove the plugin from websites and look for a five-star rated replacement to provide the same functionality.  This is a time-consuming process, so we often must do a bit of site redesign.  » See more about plugin updates in Updates: WordPress Maintenance Series – Part 4.