All Things Cahill

Wordpress Security 101

Last Wednesday I delivered a presentation entitled “Wordpress Security 101″ which got the discussions started in earnest about Wordpress Security among our team.

| View | Upload your own

Here are the takeaways:

• Keep your blog up to date
• Don’t use plugins that aren’t in general public use unless you know who wrote them or have thoroughly reviewed the code
• Forms for reader upload/feedback are the single biggest point of attack - be sure if you code one you use the Wordpress “Nonce” function to keep junk off your server
• Watch out for other programs you may add to your site
• Keep up to date on both OS and DB - if your host doesn’t do this, get a new host
• Keep your Wordpress installation up to date.  Recent versions will warn you that there is an update available
• Remove the XML-RPC file if you don’t use an external blog editing program.

Tags: blog security, Wordpress, Wordpress Security

23 Jun 08 | Personal | Comments (2)

Techcrunch Says Wordpress a Massive Security Risk

(The link to the article is lower in this post, to ensure the proper text appears in the Techcrunch trackback…)

Techcrunch yesterday featured an article by Nik Cubrilovic with the salacious title “Wordpress Security Issues Lead To Mass Hacking. Is Your Blog Next?“  - from that article:

Due to its popularity as a blogging platform, Wordpress has become a prime target for hackers looking to take over blogs for search-engine optimization (SEO) of other sites they control, traffic-redirection and other purposes. Recently there have been a spate of automated attacks which take advantage of recently discovered security vulnerabilities in Wordpress.

To date, Wordpress has been keeping up with the security holes by releasing updates within a few days of new exploits being found, but in the past few days new exploits have appeared that nobody seems to have answers for.

Okay, that kind of talk gets my interest.  Funny thing, when I was talking with the Automattic guys (who develop Wordpress) yesterday, no mention was made of any new security vulnerabilities.  So I had a look at the stuff he cites  as “the past couple days” and the issues are all over a year old, and affect out of date versions of the software, and are remedied in current releases.

So we have a situation in which one of two things is happening:

• This is a “hit job” on Automattic by Techcrunch for reason or reasons unknown - if so, shame on you…
• Or…there are vulnerabilities which Techcrunch did not identify so as to allow Wordpress to come up with a fix.  If this is the case, I applaud their handling of the issue.

Either way, Techcrunch in general, and Nik Cubrilovic in  particular need to clarify the existence of new security holes, and they need to do it fast.

Tags: Automattic, Michael Arrington, Nik Cubrilovic, security issues, techcrunch, Wordpress, Wordpress Security

13 Jun 08 | Blogging, Technology | Comments (3)