Eric Karkovack (00:00) Hi everyone, and welcome to the WP Minute. I'm Eric Karkovack. On today's episode, we're taking a closer look at the WordPress security landscape. Melapress founder and CEO Robert Abela is here to discuss the results of his company's annual security survey. Robert, welcome to the WP Minute. Robert Abela (00:18) Thank you very much for having me, Eric. Eric Karkovack (00:19) Thank you. we we talk a little bit about security here on the WP minute, but I I like that your company d does this survey that kind of gets people's attitudes and reactions to it. but before we dig into that, I just wanna know, can you tell us a little bit about what your company does with regards to WordPress security? I know you have some some interesting products out there. Robert Abela (00:43) Yes, we develop a number of plugins. Our flagship product, the plugin with which we started is WP activity log and it is a plugin that keeps a log of what the logged in users are doing. So it's not like analytics front end, it just keeps a log of what logged in users are doing. You know, who installed a plugin, who updated something, who changed the content, et cetera. Of course, it's not just the logs, it has many other features. You can manage user sessions, you can create notifications. via email or SMS or Slack for when something specific happens, reports, et cetera. Then we have WP2FA, which is a MFA plugin. We started with 2FA, hence the name, but now we also support hardware keys. We are looking into SS, so there are different number of 2FA authentication methods, MFA methods. And you also have MelaPress Login Security, which is a plugin that you can use. to enforce login and user management policies. So for example, you can configure or restrict the login times for specific users. You can have what we call known devices. So when a user logs in from a new device, similar to what you see in Google or Facebook, you get this email like, hey, someone logged in from this IP address, is that you, et cetera. So those three plugins are, they are freemium models, so I have the free plugins. And then of course, you buy the premium to get more functionality. We also have a few other free plugins, Melapress file monitor, which is basically a file integrity check of WordPress that's completely free. And we also have Melapress role editor, which is the latest plugin we've launched just a few months ago. And the idea is to help users create custom roles. Cause as we know, WordPress has a number of user roles built in, but Eric Karkovack (02:28) Yes. Robert Abela (02:28) they're not enough. It depends of course on the website. So if you need to create custom roles, you can use our plugins. So we focus a lot on security, but not cause Many people, typically when you talk about security, they think of firewall and malware only kind of thing, like the hard link. We focus a lot on the user visibility, monitoring, helping the user, keeping their website secure, et cetera. Eric Karkovack (02:48) Yeah, I think for for enterprise users especially, you wanna keep you wanna keep a little bit more control over what your users are doing, when they can log in. I know I've used the the login security plugin before just to t actually I think one of my clients wanted sessions to end after a certain amount of time of inactivity. Robert Abela (03:07) Yes. Eric Karkovack (03:08) That's kind of a a thing that we don't talk about in WordPress, but I love that the product does that. So congratulations on that. I think that's a it's an awesome Robert Abela (03:15) Thanks. Eric Karkovack (03:16) product. so What can you tell us about your annual survey? When did you start it, and what are you hoping to learn from it? Robert Abela (03:27) I'm not sure if it started in 2022 or 2023. We started honestly just for fun, as in not for fun, but it was a good idea to get an idea of what people are using, what plugins are they using, how they are keeping their website secure, especially with WordPress being a bit, unfortunately, always a bit in the limelight as an insecure platform, which is not, but it's portrayed so in the news. So we started the survey and the idea behind it was for us to learn like why are our WordPress is portrayed So but also we realized that by knowing or understanding what people are using right now and what's working, what is not working hopefully and by publishing those results we and everyone else can learn from it, you know, so in fact originally it was for us to learn but now it's since we started it's basically also published as a blog post. and people can see for themselves what's typical, what people are using, what's not, what works for some people, what's not. In fact, it goes almost hand in hand with this one. This year we started what we call the security stories or security wall where we published a number of use cases of people who were hacked and how they were hacked, et cetera. And I really believe that by publishing this type of information, people get a better understanding of really secure WordPress is, how secure it can be, what can go wrong, what you should know, etc. Because from these numbers you start automatically, hopefully, instigate some curiosity in the users, in the readers, and then hopefully they'll do what they need to do to keep the website secure and learn as well. In fact, a common problem is that people usually feel overwhelmed, don't know what they need to do, and hopefully this server kind of like points them a bit into the right direction. Eric Karkovack (05:18) Now who would you say the audience is for that survey? Like who is the typical respondent? Is it is it more of a a professional or an end user? Robert Abela (05:28) It's a mix. fact, so first of all, we collected the results. This year we had 219 confirmed responses. Actually we had more, but we removed any duplicate ones. Also, since this is run by us as a commercial company, there are some questions which might obviously be a bit more like asking about activity logs, because we do logs of course. So we also... took into consideration who is client or not and remove them to make sure this is as organic as possible. It's not biased. We've got the answers from in-person events like WordPress Europe, WordCamp Europe. We've got also through a number of online summits, third-party online summits, our own newsletter, also partners newsletter. In fact, more than half of the answers are not even our customers or our leads, which is good. So definitely. It's a organic. Now in terms of user based, after seeing the results, it's a mix we have from agencies, developers, designers, but also business owners Eric Karkovack (06:33) Okay. Robert Abela (06:34) or representatives. And in general, they work across these type of websites, either a brand or corporate website, service websites, which are websites which provide the service, blogs and content sites such as news or something similar, membership. sites, e-commerce and of course the rest. Eric Karkovack (06:52) So it sounds like you got a pretty good picture of the overall WordPress landscape. I did want to ask you about a c a few of the numbers that that came out, because there's some interesting stuff. so on average it seems like participants ranked security a seven point eight five out of ten on their on their concern scale. what does that mean to you and like how does it not a ten out of ten for everybody? Robert Abela (07:16) Yeah, there is a bit of nuance to that as well. In fact, because we're talking, it's a vast... the respondents, they come from different walks of life, different... they have different technical expertise. In fact, in the next coming weeks, we will be releasing more kind of like different types of survey answers based just for the technical people, for the non-technical. And you see, actually the concern, you see it's changing a lot. It's funny because... Non-technical people. like I was so for example, if you compare designers developers So the global was seven point something concern but designers have seven point zero three concern but developers eight point two three, which is a bit higher and I don't know if it's I would have expected it the other way around because usually technical people Know what they need to do to to secure a website. So maybe they have a bit less concern, a bit more confidence, where a designer who can design things but maybe they are not technical would have more concern because they don't know what they need to do. However, it's the other way around. So I would say maybe designers or the non-technical people, maybe they don't know what can go wrong or maybe it's also there is this idea, many people have this idea, unfortunately, that security is like a checkbox thing, you install a plugin once and I'm done. Maybe that could also be the Eric Karkovack (08:39) Yeah. Robert Abela (08:39) case. So it's... You need to split it a bit more, as I said, technical people, non-technical, but it's very hard to read because I said I would expect the non-technical people to have a higher concert level. However, it's actually lower. And I don't know if it's lack of awareness or just because they did the checkbox, they installed a plugin kind of thing. So at the back of their mind, we are secure. Eric Karkovack (09:01) Yeah, security means different things to different people, doesn't it? there Robert Abela (09:04) Yes. Eric Karkovack (09:05) was a time for me personally where I would install a security plugin, like, you know, seven, eight years ago, and I thought, okay, I'm good. I don't need to do anything else. I've got secure passwords, I've got this plugin protecting me, and and you find out that that's not the case when you start getting security incidents. And that's the other thing that that really stood out to me is that a lot of of your respondents had Experienced at least one security incident, if not more. Robert Abela (09:34) Yes, first of all, when we ask the question, we ask specifically, it wasn't just a generic security incident. We asked such as defaced websites, hijacked user session, broken website due to a hack. So there's a whole list. I'm not surprised that most of the people experience a security incident, especially on the bigger websites, because it's very hard to control. or to know what's happening in WordPress out of the box is very hard. So I'm really not surprised. And yeah, I don't know of anyone, even me myself, not at Melapress, but before, I don't know of anyone who has worked online, managed some websites and hasn't had to deal with a hacked or broken website. Eric Karkovack (10:20) So I also noticed in the survey results that a lot of folks had more than one security incident. what does that tell you? What it what what stands out to you about that number? Robert Abela (10:31) Good question, I think there's this... this idea that when you have a hacked website, you simply restore the backup of this website. And there are a few problems with this approach. It's a very common practice kind of thing. And the problems are, first of all, you are not sure, unless you check it, of course, if the backup that you have in place is already a version of the hacked website. And even if it is not, when you restore that website, you are not closing the security hole. So if someone hacked your website by exploiting a vulnerability, for example, or by guessing a password, for example, or brute forcing their way into an account. Yes, once you restore that website, the security hold will still remain. So it's very normal that you will restore your website and your website will get hacked within a few hours, quite frankly. So and that is why we believe a lot. in logs, not just WordPress logs, web server logs, everything. And that is why when you have a hacked website, you should definitely look into the backups, of course, and restore them on a staging environment at first, but you should really analyze the website that is hacked and first identify why it was hacked, through which problem etc. And only when you identify that and you are sure of how it happened and you close the security hole, then of course you can restore the rest. But yes, it's... This is most common practice and it will keep on happening. People get their website hacked, they restore a backup and gets hacked over and over again. Eric Karkovack (11:57) Yeah, that's one of the things people don't necessarily realize about backups. even if you have like, for example, a core WordPress file that was hacked, I've seen that one before. you know, where something from the includes WP Includes directory gets compromised. Yes, you can replace that file, but there's still a backdoor in there that would allow somebody to come right back in and reinfect. And that's why this happens Robert Abela (12:22) Yeah, Eric Karkovack (12:22) so often. Robert Abela (12:23) yeah, especially if the attackers uploaded some PHP files, which are not part of WordPress, which is a backdoor. It's very common as well. So even if you replace the WordPress core files, they still have access to the backdoor basically, which is a custom web application they built themselves to upload to your website. So yes, you can restore the core files, but the problem will remain. Yes, very good. And that is why it's very important to find out what happened first and through which security issue or what happened, how they managed to gain access to their website and you need to solve that one first before actually restoring a good working website. Eric Karkovack (12:58) Yeah, and I I'm sure like something like WP activity log can help with that. you can see I mean I I know I've seen from logging plugins before, like where you have like a user account was created that shouldn't be there. definitely seen that one before. logging can catch that. And then recently I mean I've even seen where we're, you know, starting to use AI to analyze server logs too that can kind of point to you know s mo possible malicious activity. Robert Abela (13:27) Yes, if you get, especially now with AI, it's getting easier. But yes, if you have a hacked website and you have activity logs, for example, from WordPress, but also the web server logs, maybe the database server logs, the error logs, the PHP logs, if you put them all together and analyze them, you can get a wealth of information from that. In fact, even pre-AI, there are actually tools which you can use to parse, for example, Apache logs, and they give you an idea roughly of what's happening. But with AI, of course, it became much easier. and also that's why I say it's important to have when it comes to analyzing a hacked website, also about user visibility in general, when it comes to managing a website, the more logs, the better. It's never, you never have enough logs, especially when something happens, something negative, you never have enough logs. So the more logs you can have, the better it is. The more you can store, the better it is because then you can actually analyze those logs and find out what happened. Eric Karkovack (14:17) So I I found it interesting too that looking through this survey that so security is a big concern. We know that, but a lot of people do not have a plan for what to do when a security incident happens. Is that do you think that's a matter of education on on our part as developers and and freelancers agencies, maybe to help people understand that they need to have a plan? Robert Abela (14:43) I think that's part of it for sure. We can do better from our side. I think I think we can always do better. Not just us in general. But I think it's also like maybe lack of awareness, but also the people always believe that it will never happen to them, especially we speak to Eric Karkovack (14:59) Sure. Robert Abela (15:00) website owners, small startups, small e-commerce store. They will tell you. website is not that popular, who would want to hack it? The issue is that, yeah, it's first of all, most attacks are not targeted. People are just scanning IPs and web servers at random and trying to find probabilities. So the popularity of your website doesn't exactly determine the probability of someone attacking it or not. But on top of that as well, it's getting worse with the AI. targeted attacks against specific websites are becoming more and more popular. So let's say Eric Karkovack (15:32) Yeah. Robert Abela (15:33) someone is scanning the web server on which your website sits, they found an issue. Even though it's maybe something specific to your website with AI, it's much easier to craft some sort of an attack that targets your website specifically. So regardless how popular it is or not. So I think that is it. yeah, kind of like people not. Sorry, I'll just repeat this one. So I think that is what it is. People believing their website is not popular, so it's not a target. However, I think it's also a bit like insurance. Sometimes people are like, insurance, like, do you really need it? We can do without it. However, there's a problem, especially with travel insurance, people go to a new country. Eric Karkovack (16:11) yeah. Robert Abela (16:11) it's a safe country. Let's not get insurance. It's fine. Then if something happens, even just something simple like their luggage is lost, it cannot be retrieved, et cetera. then it's too late, you cannot pay Eric Karkovack (16:20) Yeah. Robert Abela (16:20) the insurance then. And I think it's the same. fact, both at Melapress, but even before Melapress, I always worked for security startups, non-web security startups. And most people come to buy software. Like I used to work for a company which used to develop a web vulnerability scanner. And most people used to come, you have two types of people. Those who come because of... compliance, are the bigger companies and there is awareness that they need to secure their website or those who like I've been hacked last week. So now I need to take action. Eric Karkovack (16:48) Yeah, yeah, that that's a common thing. I think a lot of us humans do that. We we don't Robert Abela (16:53) Yes. Eric Karkovack (16:53) we we're not proactive enough when it comes to things like security and then we react when something happens and that's when we we buy a security plugin or we put our site behind Cloudflare or or that type of thing. So that that leads me to the discovery of how we're discovering these incidents. I notice that a lot of people aren't noticing anything I mean aren't discovering it until someone tells them that their website is acting strange or that they notice their website is acting strange. Maybe it's down, maybe there's gambling spam ads popping up. Robert Abela (17:29) Yes, and that goes hand in hand with the tools that you use like logs, alerts, user visibility, etc. Because let's say you have the right systems in place to monitor user sessions, terminate sessions automatically as you said. First of all, the chances of our website being hacked are much lower because you're taking precautions to make sure your website is not hacked. However, Even let's say if your website is hacked, if a session is hijacked and you can spot something suspicious, you can actually stop that attack before that person goes to the next step and I don't know, install a third party plugin, add the backdoor, add something to your website or remove something or break something. So the more tools you have, this goes hand in hand with the, what we did just discuss in the previous question. So the more tools you have, yeah, the better it is. to detect earlier and unfortunately most of the time, yeah 42.6 % answered that they find out through third parties and when their website has some strange behavior at that stage it's already very late because let's say someone managed to hijack an account then they installed some third party plugin to gain access via something else which led to installing some sort of backdoor. which led to doing something else on a website to distribute malware, for example. Those are four steps which, from step one, identifying a user hijacked user session, you would have avoided all those three. You would have saved your reputation. Your website will be still online. Recovery is also much quicker, much less hassle, maybe even no client data is affected, no clients are affected, et cetera. So, yes, so the more tools you can use to monitor what's happening on your website in terms of user visibility, not just locks, because locks, you can of course use locks to lock plugins that send you alerts when something happens. But even like when it comes to user visibility sessions, et cetera, the more knowledge you have, the more your own users, especially your team, let's say if you have an e-commerce website, I'm not talking about the clients, but your users, the more your team is informed, someone logged in from your machine. or someone logged in using your username from this IP address. This is not normal, let me check. So the more of these things you have in place, the more the chances are that if your website gets hacked, the earlier you can find out and the less damage you have and the easier it will be to recover. Eric Karkovack (19:43) Yeah, it it's it's definitely not a one one tool fits all type of problem you really do need a a set an entire workflow based around security especially if you have you know like a an e-commerce site with that's dealing with transactions, dealing with customer data. You want to make sure you have a lot of tools in place. Now what else stood out about the survey? Is there anything else that that you think that people should really know about? Robert Abela (20:11) Yes, so first of all, fact, continuing on your last question. So when a hacked website, when the owner of a website realizes their website was hacked via search engine because they get some warning from search engine, the negative impact on the website is much higher. So again, that's another reason why you should really invest in the right tools to make sure at least even if something happens and account is hijacked, whatever. they don't get to the website. the more tools you have, and as you said, we need to look at security holistically. There's no one solution that fixes everything. You need a good firewall. Eric Karkovack (20:46) Sure. Robert Abela (20:46) You need ideally some sort of batch management. You need user visibility. You need locks. need everything. There's no one thing that will solve them all. In fact, I gave a presentation at Wellcamp US this year about this thing that... everything even like 2FA authentication, 2FA is great and MFA is great. However, if someone manages to launch a certain attack and steals the cookies from your session, can have 2FA, you can have a strong password, but it's game over anyway because they hijack your session. Eric Karkovack (21:14) Yeah. Robert Abela (21:15) So that's very important. So that is why, as I said, it's very important to realize as early as possible because as we've seen, for example, when the search engine identifies that website has been hacked, the impact is much worse. We had some of the respondents who said even after a year, the traffic never actually recovered to where it was before. And it stays around 65 to 70%. So yeah, Eric Karkovack (21:39) Wow. Robert Abela (21:40) that highlights what an impact it has, a hacked website. Eric Karkovack (21:43) So one final question for you. What advice would you give for a freelancer or an agency that manages a lot of clients' sites? What can they do right now to to protect themselves? Like if say they're they maybe they have something in place, but what would you recommend they do at this point? Would it like a full audit be the the thing to to to go for or would it be something else? Robert Abela (22:06) First of all, freelancer versus agency are a bit different because agency, especially if you have a team and you manage more websites, you have different tools typically. However, we talk a lot about firewalls, about user visibility. We talk about a lot of things which are very important. However, one thing which we can correlate from this year's survey, last year's survey at Chesa, that there is a big correlation between user education and hacked websites. The more educated users are, I wouldn't say the lower chances of website being hacked, but of course that helps. Let's assume a team, an e-commerce team, for example, or an agency which manages hundreds of websites or a freelancer. The more the agency is aware about certain things, certain best practices, keeping websites up to date, using MFA to a favor, always using password manager. the team knowing at least have a basic understanding that what's a phishing attack, what's a scam, etc. The more knowledge they have, the better they will operate the client's website, quite frankly. So yes, mostly, I mean, there's a lot that we need to do, that we can do, but just starting with user education, educating your team, especially as an agency, if you have a team of two, three, whatever, how many people, by educating your team and educating yourself. That's already a very big step because by educating yourself, you can then of course start discovering the tools that are needed, the best practices that you need to put in place, et cetera. So user education is definitely the number one solution at this stage. Eric Karkovack (23:29) Yeah, I could even see that for clients where we you know, I often tell clients, please don't install a plugin without asking me first because you don't know where it came from. Robert Abela (23:35) Exactly, simple things. Exactly. It starts with very honestly, especially if you look at a simple website, I mean, of course, the more functionality you add, if you have a membership website, e-commerce, the more tools you need. But if you make a simple content website, honestly, if you keep that website up to date, use the FFA, use a strong password, you don't share accounts, not everyone has an admin access, know, these simple best practices, you'll be in a very good place. So that is why I believe that user education is very important. Eric Karkovack (24:04) Well well thank you for the advice, Robert, and thanks for for coming by and letting us know about the survey. We'll post the results here in the in our show notes and and we'll also link to your security stories that people shared with you as well, 'cause I think that's that's that's a good thing to have. I think it's good to see that other people have gone through it and how they got through it. where can people connect with you online? Robert Abela (24:27) Yes, I'm very active on LinkedIn and X, RobertAbela A-B-E-L-A. I also have my own website, but it's just me rambling. It's RobertaBella.me. And of course, melapress.com There's all the information about our plugins, what we do, et cetera. Eric Karkovack (24:43) Wonderful. Well, thank you. And thanks to everyone who watched and listened today. Visit us over at the wpminute.com/subscribe, grab our newsletter, and become a part of our community. You can even join our Slack channel for free. thanks to everyone, and we will see you next time. Robert Abela (25:00) Thank you very much.