Joel Barbara: …three months at this point. We develop a number of plugins mostly related to WordPress security and management. Our biggest plugin is WP Activity Log, it’s the most well-known. Before Melapress I had different roles, mostly systems administration, so that’s my sort of background. Love literature, so I eventually moved into writing.

Nestor Angulo De Ugarte: What’s the turn now, me? Me, okay. So I’m Mr Angulo. I have been working as security analyst at Sucuri until 2023, and then started in Patchstack, which is a company who works towards making the world more secure, just trying to identify, control and inform, give information about vulnerabilities in WordPress. So at this moment I’m working in the security department as the data and research lead, so making all the tools for identifying, storing, and making all the users aware about these vulnerabilities.

Eric Ellis: Do you hear me?

Nestor Angulo De Ugarte: You’re mute. This kind of comments, that is normal in this new full remote society, right?

Milana Cap: One or two things. First, I would tell them it’s not enough, but then if that’s like the most you can do, I would say secure your passwords and enable two-factor authentication for a start, and make sure your website is using SSL. Okay, I’ll stop there if it’s only two things.

Joel Barbara: Sure, so not to repeat what Milana said, which I agree with 100%, those definitely should be done. Keep everything up to date, definitely, that’s one thing. And session management, so look at the active sessions on your WordPress, make sure that there are no people who are logging in with the same account, multiple people the same account from different countries, that could be a sign of fraud, especially if you have an e-commerce website, that’s very very important. And activity monitoring, so keep a log of what’s happening, so whatever happens you can always refer back to understand what happened and when and whom.

Eric Ellis: I don’t hear if there is any question. Yeah, actually I didn’t get the question, I was in the middle of my troubleshooting. Milana, can you repeat the question, because I can’t hear the question, or someone?

Milana Cap: Yeah, okay, so give me a second.

Eric Ellis: Sure, mine’s a real easy one. Install Imunify360. So yeah, that one’s quite simple, it’s a great way to pay a little bit of money and get some security software out of it that can just basically make sure that you don’t have to put effort into doing the security every day on your system. The second thing I would do is make backups. If you have a backup plan and you’ve got it remotely, not all is lost. Sorry, I wasn’t here in the question, so I just had to refresh, you know, F5.

Nestor Angulo De Ugarte: Well, I think it was mentioned before, but I’m a huge fan of getting everything updated, so one of the things should be that one, definitely. And the other one will be, I don’t know, there are too many, but maybe just installing a security plugin that will help a lot, because there are a lot of aspects we have to take into account. So I would say that those things, if you are an expert, just, I mean, everything updated and install a good security plugin.

Joel Barbara: Sure, so as you mentioned previously, look at last updated, look at the reviews, if there is feedback go through it, see what other users are complaining about. If it’s possible at all, depending on how mission critical the website is, have a staging environment. A lot of hosting providers are offering that now, which comes in the package, so it’s very easy to maintain it, you don’t need an extra server or anything like that. Is there, use it, get the plugin, install it, see if it plays nice with all the other plugins that you have, and once that’s fine you can roll it back to life. [Attribution uncertain: this plugin-vetting block could be Milana rather than Joel.]

Eric Ellis: Well, the very first thing I would do is run it through VirusTotal, just kind of see if anybody else has anything that they’re complaining about, and just before I even go any step further in my research process, that’s the first thing I would do.

Nestor Angulo De Ugarte: Yeah, I mean, taking for example the reputation is also interesting. In WordPress you can check into the plugins repository about their reputation, also checking, Googling about that. But the main key points to check, as mentioned from Eric, I will pass it through VirusTotal, but also I will check how many stars it has, if they have been active in there, and the support forum, and if the code has been updated. Those are more or less the key points. I’m not going to get into the comparison of which of the plugins are best or not, that’s something different, but at least you might know that the development team behind the plugin is active.

Milana Cap: Well, first I would like to add, for the first question, I often see people, when they start thinking about security, then they get paranoid, and then they install all the plugins that they find. Please don’t do that. Please first assess what you need, and then see what exactly is which plugin offering. And well, before even choosing the plugin, I would say, someone said in chat and I tend to agree, everything you can do on server level, do it there, and then the things you cannot do there, if your hosting provider doesn’t allow, then look for the plugin. And all that people said, like see the reviews and how many issues they have resolved and all of that, that would apply, but first research what is that you need and which plugin has the most of that. Don’t install 16 security plugins because this one is doing this and that one is doing that, they will clash, they will break your website, they will impact your performance and all the other different issues. So please give it some time and do the real research, don’t just read two blog posts, “these are the best, I will install all,” and that’s it.

Now, WP-CLI can help. I just have published an article about security and using WP-CLI at wordpress.org. So WP-CLI can help a lot specifically in this area, with verifying if the plugin that you have, if those files are actually the real files from wordpress.org. You can verify files for core and plugin and theme. You can also do a lot of stuff with user management, this is also very important for the security. You can see the updates, you can update plugins and core and themes, and you should do it regularly, especially for the security patches. And many other things, I can’t recall all of them, it’s just a lot. You can profile your website, you can see how it behaves and what is the performance, and there is a doctor command that you can use for many things. So you should stop me, because I can talk about WP-CLI for weeks.

Nestor Angulo De Ugarte: No, because every time I’m typing or something like that, I just make annoying noises. Yeah, it’s a tricky question, because it depends on the audience, right? If you are not an expert, how can you tell if the hosting provider is taking security seriously? So I will say that, in the very moment you get into the hosting, if they provide recommendations about strong passwords, second factor authentication, if you see that they apply by TLS, SSL, if they apply some details about security, like for example disabling the wp-config file access, or they talk about database security, these kind of things are good marks for realizing if the hosting provider is taking security very seriously. The thing is, probably all hosting providers out there will tell you that they are leaders in everything, but also in security, they are the most secure hosting out there. So the thing is, how can you tell from there? So in the moment you get onboarding, if you see these kind of details and these marks, probably they are at least taking it seriously.

Eric Ellis: Well, it’s a bit of a niche group, I mean, it’s different from keeping customers’ business systems and client systems safe. It’s finding like the very specialized malware that likes to live inside of a WordPress JavaScript file, that’s very popular. So we have a very good malware scanner that’s really fast and hooked into the Linux kernel. It reads every single file as it would get written, and then batches it up to just immediately run it through, every new file that touches the file system runs right through the malware scanner, and it just immediately knows that this is a good file, or this is known to be sus, and so we’re going to do what we normally would plan to do, which is automatically remediate. So that the administrator can go in and un-remediate if necessary, which is very seldom, but for the most part the default action is to clean up the nasty file, because we know what it looks like, and get the customer website safe and never ever have a downtime outage with it.

Nestor Angulo De Ugarte: Yes, that’s what it’s doing on Cloudways right now?

Eric Ellis: Yes, yeah. I would recommend scanning every day. I scan every week. It’s super important. Before you find out you’re in the lucrative, you know, secondhand Rolex industry, you can take care of this yourself, instead of somebody coming to you and saying, I didn’t know y’all were selling Rolexes this week. [Attribution uncertain: the “scanning every day/week” line may belong to Nestor.]

Milana Cap: Well, I would say again, spend some time there, research, ask questions, there is some person, like an entry point to answer the questions, ask questions, Google what does that mean. But also, for me as a developer, when I want to host a website that is WordPress, first of all I want WP-CLI there, and I want some kind of GitHub integration, I want hosting that doesn’t give me any file manager on the hosting, you know, so you cannot access any other way other than your GitHub. That means a lot, and that says a lot about accessing those files on the server.

Joel Barbara: To build on what everyone said, which are very valid points, check their socials, see what people are complaining about, if they are responding. Socials tend to be, if it’s on their blog they can restrict it, but if it’s on social they can’t. And check how easy it is to get in touch with them, so if something happens can you reasonably get in touch with them very fast to fix any issues that you might have. Check their knowledge base, if they have a chat system, they have a telephone, try to give them a call, how easy is it to get through, do you wait five minutes or five hours. Because ultimately no system is 100%, so you need to make sure that if something happens you can fix it quick. [Attribution uncertain: this hosting-support block could be Eric or Nestor.]

Nestor Angulo De Ugarte: Yeah, the thing is, for the sake of the audience, I don’t know how technical they are, but the thing is we have to separate two parts that are important in security, the before and the after. The before, getting any kind of infection or any kind of malware in, is all the proactive measures we have available to avoid attackers getting into our website or accessing sensitive information. And then we have the after, so if the worst scenario comes in, then you have tools for cleaning up, like for example Imunify360 or Sucuri, this kind of malware scanners. So one of the things I wanted also to enforce from you all is that the support from the hosting company is super important as well, because they can solve more or less 80% of any security issue directly, right away, in the support system. So I just wanted to clarify this, because we have been jumping into different things related with hosting, but it would be interesting to bridge that and some of the measures that hosting can provide for avoiding being attacked or being hacked, and then when you get hacked, if the hosting provider has solutions, or at least a responsive support forum, a responsive support channel.

Nestor Angulo De Ugarte: The main one from my point of view is that WooCommerce has payments, right? So one of the things that you have to take special attention to is the payments process, that you comply with the new regulations, that you take care about the communication between the payment process, and also how you store information in your website. So those are the main key points related with WooCommerce or e-commerce places using WordPress. With the new regulations that are coming in Europe, it will be even more enforced. So mostly all the e-commerce websites are very vulnerable to be hacked, but also to get fined by these authorities of regulations. So you can check, for example, there is a website that’s called enforcementtracker.com, I think something like that, so there you can see a lot of cases of e-commerce companies, big companies and small companies, that have been fined because they didn’t follow the GDPR rules. So for me that’s the main thing to get into when you are into e-commerce using WordPress.

Joel Barbara: Yeah, sure, so keep in mind that everything that applies to WordPress applies to e-commerce, so what Milana said, strong passwords, offer 2FA to your customers, make sure they are using strong passwords as much as possible. One thing that maybe is more important on WooCommerce sites, or e-commerce sites rather, is fraud, that’s something that you need to be on the lookout for, it is a form of security as well. So monitoring user activity and keeping logs, so that, for example, there are cases where someone makes an order, it ships out, and then they will go in and they will change their address, so you need a record of what changes happened and where, that you can always refer to, to ultimately protect yourself.

Eric Ellis: Sorry, I get really excited and I don’t want to talk over somebody, so I mute a lot, sorry about that. The first thing I would always recommend is just keep updated everything that you can without breaking the website, WordPress core files, PHP versions, Apache versions, mod_ssl, everything in your stack that you can, and that goes on top of the actual core, which would be the plugins for WordPress itself and the themes, everything that can get updated to just the safest version that we know is out there. So having that in a very good situation, and then block known bad actors. If you know you don’t do business in a certain region, you’re not real popular in Hong Kong or Cuba, just don’t waste the resources on those bots, go ahead and add those to your list of bad actors, and don’t waste the time, you’ll get back those resources for valid customers.

Milana Cap: Well, I don’t have much experience with e-commerce, but there is one thing that comes to mind, like, you have a lot of users and their data, and you are doing, because you’re a good owner, you’re doing regular backups. So first thing to come to mind, like, you don’t want to lose money, so if something happened, when you restore that backup, are you sure it’s a working backup? So are you testing that also, when you are restoring, are you sure you have the correct data, that you still can have, like maybe some users deleted their data in between? So how regular are you doing backups, and what data do you have there, is it first and foremost a working backup when your shop is going to work or break, and how is that going to mess with the orders and all the other info that you have in there? So maybe something to keep in mind.

Nestor Angulo De Ugarte: I have a lot, a lot of experience about that. I mean, when I was working at Sucuri, it’s an incident response system, and yeah, hacked sites, “oh no,” “yeah, I have a backup,” “okay, yes, send it to us,” and it’s corrupted or something like that. Yeah, it happens.

Milana Cap: Well, okay, so regular update, and different forms of updates, you want your backup, you want your database, but you also want your files. Regularly scan the changes on the files, you can do it with WP-CLI, and you can use some more serious tool from the server, but you can do it every single second with WP-CLI, so do it. Another thing, regularly update your core, your themes, your plugins, be careful about the compatibility, so first update plugins and themes and then core, and then see if there are still more updates. And use two-factor authentication, please, that’s just, two-factor authentication is a great tip.

Joel Barbara: I would also limit exposure to the APIs to somebody who’s not an authenticated user, because with the API just kind of dangling out there, that allows somebody to kind of fast track trying every user imaginable and see what they get. Two-factor authentication, easy win, low hanging fruit, doesn’t take a lot of time to implement, definitely worth it. And to not repeat what the other people have said, to offer new advice, maybe check security headers, like HTTP headers, implement HSTS to make sure that your visitors are always being served HTTPS through TLS. If you have team members, make sure that they are aware of security best practices, do take the time to train your staff. And for your customers, if you can offer them tips, maybe have a page on how to make sure that your password is secure. We do have a plugin that allows you to enforce password policies, but what we also do is we offer the user some tips on how to achieve a password that meets your policy requirements. Aside from that, you can limit the login attempts, and one last thing I would add, update.

Milana Cap: And yeah, sorry, just one more thing on my head, speaking of updates, do not leave updates on the same server as you have WordPress, save them somewhere else, take a copy. [Attribution uncertain: this “save off-server” line could be Joel continuing.]

Nestor Angulo De Ugarte: Exactly, exactly. We all know the CrowdStrike example, right? Yeah, definitely, even in that case I think updating is always the key. I have like a formula, something like, change my mind, something like, the cost of a hacked site is always more than the cost of a down site because of an incompatibility or an update thing. So I just throw the challenge, change my mind. So, seconding that. Yeah, for sure, I would recommend if your site has some kind of high impact, because you are e-commerce, or you have a lot of traffic, or you are sharing important information like APIs in the server or something like that, try to make the updates in a staging server first, then when everything goes okay just apply in the production. So that’s one of the things related with that. But the other will be linking back with my measures in security that are separated in before and after. In the before part, a site doesn’t get infected because of thin air, right, it’s infected because there are vulnerabilities. So it would be a very good practice for all the site owners to get their site scanned via a vulnerability scanner. There are services out there like for example Patchstack, and then we scan all the plugins, all the code you have in the website, and we just match with our database of vulnerabilities. So if there are vulnerabilities in any of the plugins you have in your website, you are exposed. So having your website free of vulnerabilities, with everything updated, or if you find that there is a plugin and it has a vulnerability, you have to find an alternative plugin instead of getting along more with that plugin. So having your website free of vulnerabilities would be one of my best recommendations as well.

Milana Cap: Thank you, bye bye everyone.