The attack surface is the sum of all the different points where an attacker can try to gain entry into your system, extract data, or add/modify data. For a WordPress website, your attack surface would include things like: Login function…
I encourage my clients to blog, once a week if possible. Yesterday I was was reviewing Google Analytics metrics with a client. He was surprised at the number of people reading his blog, and the number that subsequently started exploring…
A few days ago, an old friend for whom I built a website a few years ago asked me to take a quick look and tell her my recommendations. One of the things I told her her was "You are…
Scanning the log for the website of one of my clients this morning, I saw something that made me smile: http://[domainname]/wp-content/themes/twentyeleven/footer.php I had just spotted a hacker. Unused themes are favorite places for hackers to install a backdoor. They will…
As a professional company engaged in the business of website support, maintenance, and security, we have developed several best-practices. This article describes two of them. It happened again today. The vendor of a popular WordPress plugin released a new version today.…
I understand that you’re busy. You have more to do than you can possibly accomplish, and a lot of it needs to be done RIGHT NOW. I’m going to add to your burden. Maintaining the security of your website is…
A long-time friend called me and told me his website was running very slowly and asked if I would take a look at it. I quickly discovered malware. His .htaccess file contained a bit of code that under certain conditions…
WordPress 4.7 was release a few days ago, and the REST API is now incorporated into the WordPress core. The WordPress REST API allows programmatic access to your website's data. Think of it as RSS for the 21st century. Most…
If you are using WooCommerce and their legacy shipping methods (Flat Rate, International Flat Rate, Local Pickup, and Delivery) then beware they are depreciated, meaning they are still supported for now but will be removed in a future version. If…
The website of Panamanian lawyer Mossack Fonseca was hacked. 11.5 million confidential documents that provide detailed information about more than 214,000 offshore companies – including the identities of shareholders and directors – was made public and made front-page news in every major…