Welcome to WordPress Security Monthly! 👉 Lesson #1 inside

Welcome to WordPress Security Monthly!

What do cheese, cake, and cybersecurity have in common? That's what you're about to find out.

Thank you for signing up for Patchstack's WordPress Security Monthly newsletter!

Before you receive the next newsletter, we'll get you started with 5 WordPress Security Lessons, covering:

• Why would someone hack your site?
• What's so bad about getting your site attacked?
• How do attacks actually happen?
• How can you protect the 3 critical security layers?
• What tools can you use to set up your WordPress site correctly?

Ready? Let's dive into Lesson #1!

Why would hackers attack you?

We get it; we hear it all the time: But I have a simple site. I don't process financial information. Why would hackers even attack my site?

The truth is: you don't need a big eCommerce site to get attacked. It doesn't even matter how many pages you have.

You don't need a big website to have a hacked website.

Attackers choose sites based on the plugins they have installed, not size or other parameters.

There are no lists – attackers don’t have time to compile them and then decide which sites they'll strike.

Instead, they launch attacks against as many public IP addresses as possible, striking gold if there’s a backdoor because of a vulnerable plugin.

There are plugins which seem to be installed on almost every other WordPress site. And while the WordPress core code is constantly reviewed, the code of the plugins is not. Most websites rely on some plugins whose code has essentially never been audited, and the attackers know it.

A single vulnerability can give attackers access to (hundreds of) thousands of websites.

Attacks are completely automated, and targets are not chosen.

The only thing that matters is whether the website happens to have that unprotected vulnerable plugin.

Attackers strike fast

You've probably heard of "zero-day hacks" spoken about in hushed tones. Zero-day hacks come from vulnerabilities that have become known to attackers before the developers have become aware of them.

And if devs didn't know, they couldn't have released a patch to prevent an exploitation.

For example, in the Bricks incident, hackers exploited the vulnerability within just a few hours.

Zero-day hacks are caused by vulnerabilities that hackers discovered before the plugin developers.

What about one-day vulnerabilities?

1-day vulnerabilities become disclosed after the developer has issued a fix.

However, attackers monitor the WordPress repository for changelogs mentioning security fixes. Then, they launch attacks because they know most people won't update the plugins right away.

(This is also a part of the reason why Patchstack exists. It protects you, so you don't get exploited before you update the plugin.)

In a way, the plugins become a target because the security fix was issued.

One-day vulnerabilities happen when attackers monitor the WP repository and launch attacks against plugins recently updated for security, knowing that people won't be able to update immediately.

So, what happens when you get hacked?

Most attacks against plugin vulnerabilities happen in just hours after the disclosure, when most websites have not yet been updated.

With more than 60,000 plugins in the WordPress repository and more than 20,000 premium ones in other marketplaces, there are still many vulnerabilities to uncover. Relying solely on updates is not an effective security strategy.

Now it's time to prepare for lesson two: the consequences of hacks, landing in your inbox tomorrow!

If you have any questions, just hit "Reply" and let us know.

💚 from Patchstack