Cleaned Isn’t Fixed
Operation Endgame’s SocGholish takedown was good news. It was also a warning. The cleanup bought time. The fix is what happens next.
WordPress Security
-
-
In Support of Stronger Passwords – Not Secret Usernames
I can discover usernames in WordPress, which means I’m halfway to compromising an account. It’s a common security report. The details vary – sometimes they find usernames through CSS classes, sometimes they’re using enumeration, sometimes it’s from a REST API endpoint – but the real problem is that the underlying logic is flawed. WordPress has…
-
Website Security – Simple Steps to Take
Website security is important. We all know it. For many though, it’s a topic they prefer not to talk or think too much about. They don’t really consider it in very many areas as they build or manage their site. Why? Security is Scary You know you want to be secure, so you start to…
-
The Difficulties of Security Disclosure
Security is ever a game of balance. Ease of use against safety is the one I find myself thinking about most often; locks on your door inconvenience you with having to get out your keys, long and unique passwords necessitate working with a password manager, two factor requires additional equipment and steps. Most often adding…
-
WordPress Security – The Big Picture and What You Need
I’m pretty passionate about WordPress, I’m pretty passionate about security, and I’m heavily involved in both. I’ve been working with WordPress for over ten years and helping build WordPress for over eight. I’m also on the WordPress core security team and have recently taken a lead role working on the iThemes Security plugin. There has…