WordSesh 2018

Slides: https://adcwp.me/wordsesh2018

Our Goal

Keep WordPress Users Secure

31.3%

Code Review

Bug Bounty Program

https://HackerOne.com/WordPress

Bug Bounty Success

• Increased number of issues reported
• Reporters feel appreciated
• Average bounty – $350
• Over $17,000 paid out for valid issues
• Better Tools (as part of HackerOne)

Bug Bounty Struggles

• Only about 13.4% of reports are valid
• High Touch

Relationships

• Plugin Devs
• Other CMSs
• Hosts
• WAFs

Automatic Updates

Automatic Updates are Fast

Over 100k sites updated per minute

Automatic Updates are Extremely Reliable

More than a 99.9% success rate

Only about a .001% failure rate

What Can You Do?

• Make sure auto updates work on your site
• Report issues to https://HackerOne.com/WordPress
• Do your part – Great Passwords, 2FA, etc
• Teach others

Q & A

Aaron D. Campbell – @AaronCampbell

Slides: https://adcwp.me/wordsesh2018

This presentation is running on WordPress using the Presenter plugin