Round up of WordPress Security News and Tips
The Weekly round up of Security News, Tips, and information to help you keep your WordPress website safe and secure.
This is a weekly round up of WordPress Security news I have accumulated from across the web some old some new but always useful. The new relates to keeping a WordPress secure.
This week we have the following Security News for you.
The Ultimate Guide to WordPress Security
Hackers attack WordPress sites both big and small with over 90,978 attacks happening per minute. Fortunately, there are numerous ways you can protect your WordPress site.
Today, I want to share with you how you can make your WordPress site’s security air tight with basic through to advanced techniques. I’ll also explore how WordPress can be vulnerable to attacks, how hackers compromise websites, how to troubleshoot a hacked site and security plugins you can install.
Feel free to jump down to any section you want to see first: Read original article here…. premium.wpmudev.org
Hackers Are Using Automated Scans to Target Unfinished WordPress Installs
Experts from security firm Wordfence say they have observed a wave of web attacks that took aim at unfinished WordPress installations.
These are sites where a user had uploaded the WordPress CMS, started but never finished the installation process.
These sites remained open to external connections, and anyone could have accessed their install panel and complete the installation on behalf of the user.
According to Wordfence, this is exactly what happened. For almost a month, starting with the end of May and through mid-June, an attacker had mass-scanned the Internet for WordPress installations that still featured their installation file. Read original article here…. bleepingcomputer.com
Rotate Your Site’s SALT Keys for Better Brute Force Protection
Your WordPress site has a set of master keys to protect your login.
They are called SALT keys.
And they need to be periodically rotated for better security from Brute Force attacks and/or having your site hacked.
Discover what your SALT keys do, where they are located, and how to rotate them.
When you input your username and password into the login screen of your WordPress site, they have to be checked against something to ensure they are correct.
https://api.wordpress.org/secret-key/1.1/salt/
Read original article here…. blogaid.net
Let’s Encrypt Passes 100 Million Certificates Issued, Will Offer Wildcard Certificates in January 2018
Let’s Encrypt, the free and open certificate authority that launched in 2016, has issued more than 100 million certificates as of June 2017 and is currently securing 47 million domains. Earlier this year, the web passed a major milestone of getting more than 50% of traffic encrypted. Let’s Encrypt has been a major contributor to that percentage growing to nearly 58%.
“When Let’s Encrypt’s service first became available, less than 40% of page loads on the Web used HTTPS,” ISRG Executive Director Josh Aas said. “It took the Web 20 years to get to that point. In the 19 months since we launched, encrypted page loads have gone up by 18%, to nearly 58%. That’s an incredible rate of change for the Web.” Read original article here…. wptavern.com
Configuring WordPress to Always Use HTTPS/SSL
SSL encryption adds a layer of security to your website that makes it harder for malicious actors to collect personal information submitted through forms on your website.
This post will walk you through obtaining an SSL certificate (Let’s Encrypt or Other Providers), installing it on your web server (Let’s Encrypt or Other Providers), setting up your WordPress site to use HTTPS URLs, and fixing any “mixed content” type errors that come up when a page served over HTTPS links to non-HTTPS content. Read original article here…. paidmembershipspro.com
7 Tips to Improve WordPress Security
You just spent many days and sleepless nights to make a blog on WordPress or simply a WordPress website. Now that it is up and running, you are on cloud nine. What if, without a moment’s notice, it goes down due to a security loophole and you are left clueless. This is some nightmarish stuff, but fret not. Here is our detailed guide to help you cover some security patch for your WordPress website so that you have lesser things to take care of. However, you must accept the fact that maintain your WordPress website’s security is an ongoing job and will require you to get back at regular intervals to introduce new changes and make necessary fixes over time. So, let’s begin.
If you are new to the realm of WordPress, keep this glued to the back of your head that never use “Admin” as a username for any of your WordPress websites. You might consider this a smart choice, but hackers know this. Choose a unique username with capital letters along with special characters. Also, you can consider adding a new user providing it with administration privileges. This will be indeed a nice move to make. Read original article here…. codementor.io
So you’ve been using WordPress for a while, maybe even for years. You’ve implemented themes for your own projects and for a few paying clients. But now you’re feeling stuck, unable to get from advanced WordPress user to WordPress developer.
As a website owner it is the most disappointing and most annoying thing to discover that your website is down. This happens when you type in your domain nameand instead of seeing your beautiful website design, you’re greeted with a blank screen. This is never a good experience, but it happens to many websites and itcould happen to your website as well and of course using these hacking tricks mentioned this post.
But is that actually true? I mean, people tell me I shouldn’t swim after eating, but I’ve done that my whole life and I’m still alive and kicking! So is the common knowledge that “too many plugins is bad” good for WordPress?
This is the story of how I failed to proactively prevent every WordPress blog on the Internet from ever being conscripted into a Mirai-like botnet.
Scott Arciszewski, Chief Development Officer for Paragon Initiative Enterprises, who is most widely known for his cryptography engineering work, published a post on Medium criticizing Matt Mullenweg, co-creator of the WordPress open-source software project, for not caring enough about security. Arciszewski has since retracted the post but you can read it via the Wayback Machine.
Is your WordPress website sluggish? Are pages and posts loading slowly and you don’t know why? In this post, we’ll discuss the reasons and show how to speed up a WordPress site.
I’ve been doing several WordPress Theme Shop interviews lately. The original reason for the interviews was that people kept asking me where to find well-designed WordPress themes. (Yes, I know the irony because I also create solid themes.)
It’s starting to seem like there’s another post about bad behavior within the “WordPress community” every time I turn around. There have certainly been too many to list, some of them very thoughtful, but the one that made me decide I had to say something was James Dalman’s “Goodbye WordPress” post.
OK, before I get a ton of hate mail/comments from every WordPress lover out there, let’s get something straight. I use WordPress ALL THE TIME. I have no issues with it, in fact, I love using it. It makes life super easy, it makes building much faster than having to start from scratch, and I really enjoy it.
Once you have a grasp of the top-rated choices, you’ll have an easier time determining which ones would benefit your site the most. Take a look at the top 11 WordPress plugins that these marketing experts recommend.
I’ve struggled whether it would be appropriate to share my experience and struggles in the WordPress community. A few people have encouraged me to open up. A few people have begged me to remain silent.
Free SSL certificates, like Let’s Encrypt, are now easy to obtain through most hosts.
There’s a WordPress error that’s frustrating to no end because if you’ve come across it, you probably didn’t actually do anything wrong. Still, plastered across your site will be these words:
According to our small survey, 90% of users say they don’t care if a free plugin they’re getting from the directory is only a limited, “lite” version of the fully-featured PRO.
WordPress vulnerabilities which were discovered recently have been negatively and sometimes fatally affecting countless websites thus far. Initially, there were three flaws (identified about two weeks back) for which WordPress has already released security updates. However, we later learned that there was another huge vulnerability that allowed cyber-criminals to obtain unauthorized remote access to manipulate WordPress sites by editing or even deleting pages. This vulnerability was disclosed by the security firm, Sucuri. 
Sometimes you just need a simple fix. Something bugs you and will confuse your shoppers, but the solution is just not built into the WooCommerce core. Such is the case with the sorting options on your shop page.
At the end of January, WordPress 4.7.2 was released to fix four security issues, three of which were disclosed at the time of the release. These included a SQL injection vulnerability in WP_Query, a cross-site scripting (XSS) vulnerability in the posts list table, and the Press This feature allowing users without permission to assign taxonomy terms. The fourth and most critical issue, an unauthenticated privilege escalation vulnerability in a REST API endpoint, was fixed silently and disclosed a week after the release.
A hello bar is a great alternative to using a pop-up, an option that is unpopular with so many. Hello bars are less obtrusive, yet are constantly on display. This means you can present a specific message to your visitors, without distracting them from your regular content.
In today’s roundup we are looking at: Duplicate Post, PDF Embedder and Redirection Plugin.
Membership Sites are quickly becoming a mainstream method to generate income, provide support, training and connect with niche communities. We will review and discuss 5 different Membership Site models that can transform any business into a dynamic, content-rich membership site.
Automattic announced today the company is bringing WP Job Manager back to life. The plugin became an Auttomattic project after the company acquired WooCommerce and its employees in 2015 but it has not been actively developed since then. Today’s announcement also requests feedback from WP Job Manager users who want to help shape future development:
Envato has been rolling out author-driven pricing across ThemeForest categories throughout 2016. The new pricing options have finally hit the WordPress category and authors are now experimenting with pricing changes outside of the average $35-65 range.
In an earlier post, I mentioned my upcoming workshop at WordCamp Seattle, October 29th and 30th. As it gets closer, I wanted to create a full post on this event. Why?
In October 2016, Matt Mullenweg called out Wix for using GPL-licensed code from the WordPress mobile app and distributing it in its proprietary app. After identifying a path for Wix to comply with the license, Mullenweg confirmed he would be willing to go to court to protect the GPL.
Best. It’s a word meant to rank similar things in a given category by established comparison points, providing an unbiased view on how they stack up.
Over the last couple of years, membership sites have been popping up in the WordPress world. Launching a membership site seems to be a growing trend. Or should I say the idea of a membership site is growing.
You work hard to make your site awesome. And with all that work you put in, the last thing you want to do is lose your site to some malicious hacker. When it comes to hackers and WordPress, plugin vulnerabilities are one of the easiest ways for the bad guys to get in.
We realize that many of you don’t keep up with the latest Google trends and updates. How can you? Many of you are busy running businesses and there is only so much time in a day. Another large portion of you might outsource work on your website to an agency or WordPress maintenance company. But they too are juggling lots of clients. As of January 10th, 2017, the Google mobile popup penalty went into effect across the web. If you are seeing a major dip in mobile traffic lately, you might want to check your WordPress site to ensure you are using popups correctly. Read more about what what this penalty entails below and what you can do about it.
Whether you work with WordPress full-time or just as a hobby, one thing’s for sure – you’re reading this because WordPress means something to you.
SiteLock, a web security firm, has sent two DMCA notices to rival White Fir Design and asked the latter to remove two images of the SiteLock homepage from two articles that criticized its web security services.
Hey, we just took your WPMU DEV membership to the next level by giving you 10GB unlimited site managed cloud backups.
Bleeding edge technology combined with our security expertise has brought one of a kind security suite for your WordPress website that nullifies all threats with ease.
A while ago I reviewed a WordPress theme called Pile. It was a paid for review, however true to form I always review warts and all irrespective of payment or not. To my surprise today I got an email stating that theme itself had shot up in price.
There are literally thousands, if not tens of thousands, of WordPress tutorials at your fingertips. You can find them on blogs and YouTube and in online courses. They seem to be everywhere. And they run the whole gamut of quality, from the extraordinary to the totally worthless.
The web is a rapidly evolving space. Technologies and development techniques can appear quickly. Ever improving tools allow for greater freedom when designing interfaces and interactions. And because of this, web design patterns and techniques can begin to trend within a short period of time.
The web is a rapidly evolving space. Technologies and development techniques can appear quickly. Ever improving tools allow for greater freedom when designing interfaces and interactions. And because of this, web design patterns and techniques can begin to trend within a short period of time.
This Wednesday saw the release of WordPress’ latest version, which the team categorized as a security edition for every version before 4.7.1, the number of the latest rendition of this CMS. The release notes accompanying the launch of the updated version of the software explain that it fixes 62 issues along with 8 security vulnerabilities.
Don’t get me wrong, a fresh installation of WordPress is great and all, but if you really want to kick your site into gear, you’re going to need some top-notch plugins to get the job done.
The WooCommerce blog shares some ways that you can start building solid customer relationships that can lead to higher sales, better shopper satisfaction and customer loyalty.
In this episode of WordPress Weekly, Marcus Couch and I discuss some of the major headlines of the past two weeks. We talk about the unprecedented move by the Theme Review Team to suspend Zerif Lite from the theme directory leaving 300K users without a way to get updates. We share what’s new in Edit Flow 0.8.2 and the troubles users are encountering upgrading W3 Total Cache to 0.9.5.
If you manage a number of WordPress sites, you may find yourself inundated with emails each time a new version of WordPress is released. If you’d like to quickly disable these types of notifications, check out Control WP Core Emails, a brand new plugin developed by Andrew Norcross of Reaktiv Studios.
I just updated the .htaccess tutorial and am revamping the robots.txt tutorial, both in Level 2. Both of these root host files are at the core of your site security and performance.
WordPress plugins are developed and maintained by thousands of independent developers. Over time, it’s inevitable that some of these plugins will stop being supported. Developers move on to other projects, or become overwhelmed by the task of keeping their code up to date. Sometimes, WordPress evolves to cover the functionality that plugins once provided.
WordPress 4.7 was only recently released in December and numerous user experience and developer, not to mention Twenty Seventeen, a brand new default theme.
Statistics from w3techs suggest that 1 out of 4 websites (around 25%) on the internet are powered by WordPress. WordPress’ popularity is derived from its ease of setup and use, its contributing community, and the big repertoire of plugins and themes that are available.
WordPress is the most popular CMS out there. But, there are a lot of things slowing it down.
No one today likes to ‘Wait’. It is becoming tough for slow websites to stand out and engage with their users. As mentioned on kissmetrics blog, one-second delay in page response can result in a 7% reduction in conversions.
If you’ve used WordPress for a while, you know keeping regular backups can save you from losing your website (you know, the site you’ve put all that time and effort – literally hours – into building). But have you tested your WordPress backups to see if they actually work?
Since the rise of Twitter, every WordCamp has a designated hashtag for aggregating tweets about the event. Tweets using the hashtag are often a good measure of attendees’ excitement and connection to the speakers and activities.
Paul Bischoff, security and privacy advocate for Comparitech.com is warning website owners who use the Simple Share Buttons plugin for WordPress that clicking to “accept” the terms and conditions of the latest update could allow their websites to subject users to threats.
The LAT Multilingual team of translators from around the world specializes in adapting and crafting clients’ marketing messages for other languages. They understand marketing, the linguistic communities they live in and the industries they work in, and are able to provide translations customized to the market needs of their clients.
The most recent version of WordPress ships with new REST API capabilities which plugins, apps, services, or the WordPress core can utilize.
Have you found that your WordPress site’s on the fritz and all you can say is “I didn’t do anything, I swear!?” Yet, you see errors that say your files or database are broken, missing or corrupted.
The WordPress core makes it’s easy to password protect posts and pages — a handy feature if you want to easily limit access to certain content. The only problem is that any images or videos you display on those pages can still be accessed by going straight to the media attachment pages.
WordPress is the most popular CMS in the world and is used by nearly 75 million websites. According to WordPress, more than 409 million people view more than 23.6 billion pages each month and users produce 69.5 million new posts and 46.8 million new comments every month. It also powers more than 25% of the world’s websites.
Take a look at the top 15 WordPress plugins that are used by bloggers around the world to beef up the security of their site.
“I have no idea what I should be saying when I meet with a new potential client.”
We receive a lot of enquiries from WordPress developers wanting to buy our premium plugins for a client with no ongoing costs. They say they want to buy the plugin for a client and then hand over the website without the client having to pay to pay any future costs. It surprises me that so many WordPress professionals have such short-term relationships with their clients, as well as so little understanding of the issues around WordPress and ongoing maintenance.
Have you ever installed a theme, plugin or widget that asks for a post, page or category ID? Over the years I have come across this tons of times. It might be a setting to exclude a category from your blog archive. Or to choose a specific page or post. In most cases, I have found that people who have started using WordPress, and even some who have used it for quite sometime, don’t know of any easy way to find that little bugger.
Overall, WordPress (WP) is a great content publishing system, but it’s not perfect. In my humble opinion, WP’s worst flaw is its error handling. Perhaps it’s because WP is built using PHP, which is an interpreted language. In any event, even the tiniest of errors can result in a white screen – perhaps with a cryptic error message, perhaps not – commonly known by those in the know as the “WordPress White Screen of Death” (WSOD). On high volume sites, this drives both users and the site owner completely batty! As the developer of such sites, it keeps me on edge, as I never know when I’ll be getting panicked calls and/or emails.
This is a question I get asked a lot. There are many things that can happen when changing your theme and you can learn more about that in this video post. But in reality, we are mostly concerned with content. If you have 25 pages and 999 blog posts on your site, the thought of them evaporating is downright horrifying.
There are two main ways to monetize WordPress: you can use it to set up an online store and sell products, either physical or virtual. Or you can use it to power a Software as a Service (SaaS) business, like our own Edublogs.
If you move your site using plugins, you’ll be able to move two things: your content (posts, pages, custom post types, menus – all of your content) and widgets. But what it doesn’t let you move is the settings for your site. If you’ve got some heavy plugins installed (like an e-commerce plugin) or you’ve made lots of tweaks to your site’s settings, you;’ll then have to go into the admin screens for your new site and set those up manually, copying what you did for your old site.
A critical remote code execution vulnerability in PHPMailer has been discovered by Polish researcher Dawid Golunski. The vulnerability was announced on legalhackers.com yesterday but proof of concept exploit details were not included.
A new security issue has been found in the PHPMailer used to send emails from your WordPress site.
Gravity forms is a very popular WordPress form plugin and over a half million WordPress users are already using Gravity Forms. But main package of Gravity Form doesn’t come with everything. For example, if you want to integrate Geo conditional fields, there is not option in the main package. But thanks to the WordPress developers that they have created many extensions / add-ons for Gravity Forms. Also check out Best WordPress Contact Form Plugins.
It is never easy to set up a new blog. It can take quite some time to get picked up by the search engines. Nevertheless, as your blog starts to grow, you’ll probably face new SEO problems. In the upcoming weeks, I’ll discuss some of the difficulties you might encounter as your blog really starts to grow. How do you come up with new content? Should your keyword strategy be adapted as your blog gets bigger? How do you manage different authors? And how will you keep the structure of your blog in shape? In this post, I’ll discuss some techniques to improve the structure of a growing blog.
I’ve been reading WPMU’s article 4 Ridiculously Obvious Mistakes I Made Building WordPress Sites for Clients. This has made me reflect on my own biggest mistakes as a WordPress designer.
Believe it or not, SEO is still an ultra-powerful tool in 2016.
WordPress out of the box is great, it can load a webpage in less than half a second! However if you don’t take care of your website, it can become slow, cause random errors and be exploited by hackers looking to take advantage of your audience and resources. Like running a business, WordPress websites need maintaining and improving over time, however WordPress maintenance can be easy once you know how.
One of the most frequent questions I’ve been asked by students completing the WordPress Multisite course in The Academy is this: how do you move an existing WordPress site into a Multisite network?
With more than 25% of the internet running WordPress, beginners are creating a web presence for the first time using the platform.
Headway Themes, a popular drag and drop WordPress layout builder is in financial trouble. Father-son duo Grant Griffiths and Clay Griffiths owns Headway Themes which works as a visual layout builder for WordPress based sites. Problems at Headway started appearing after 4.0 release in May 2016.
Headway Themes publicly apologized to its customers on the company’s blog this evening for a lack of communication, the decline in support, and the extensive issues with the most recent 4.0 release.
Please don’t follow any of these steps!
A lot of posts on this blog attempt to explain WordPress concepts and terminology, or at least those that are relevant to the post. And the WordPress Codex does a great job of explaining the concepts used by WordPress.
Security is a myth
The insecurity of WordPress plugins has been well documented, especially over the last year, but in the grand scheme of things, it’s not as bad as it seems, experts claim.
I’m a woman obsessed. So once I decided I wanted to get that perfect 100 score from Google PageSpeed Insights, I went for it and wouldn’t. Let. Go.
Eventually, you have to talk about cost.
Three weeks ago I received the following message on LinkedIn:
WordCamp Milwaukee is set to take place September 17-18 at the University of Wisconsin-Milwaukee School of Continuing Education. More than 170 tickets are still available at $40 each and provide access to both days of the event, including the after party.
I traveled from VMworld to the lab last Wednesday, and during that time, something infected two websites I control.
Last week one of our customers opened a support ticket describing a weird issue—when he tried to use our plugin, its UI was broken, rendering it completely unusable. Since I’m the one who usually takes care of incoming issues, I’m quite familiar with the problems our customers face… but this was the first time I heard about “a broken UI that makes our plugin unusable” Indeed, a weird issue.
Do you want to import and export WordPress users from one site to another? This could be really helpful when you are merging sites and want to automatically add all users from existing websites. In this article, we will show you how to easily import and export users in WordPress.
Reading between the lines, the truth of the matter is that the vast majority of holes in the CMS code base, whichever platform you look at, have been found and fixed over the years. Kolochenko actually reckons that 99% of exploitable vulnerabilities in core CMS code fall into this category. So, CMS usage is pretty safe now then? Well, yes, but not 100% so and admins are partly to blame here. Weak passwords and password reuse are right up there at the top of the insecurity tree, along with social engineering attacks against CMS administrators. The compromise crown has to be placed upon the head of XSS vulnerabilities in plugins, made effective because of both the previous weaknesses.