WordUp Pompey!

Join the Online WordPress Portsmouth Meetup on 20th November 2024 for a discussion on Security Best Practices for your WordPress websites.

After a brief introduction by the organisers we’ll open the meeting to a general discussion on the main topics of interest, allowing members to share their experiences – both good and bad – on the subject of WordPress security.

Topics we may cover include:

• Threats
• Hosting
• Backup & restore
• Two Factor Authentication
• Security plugins
• Monitoring
• A to Z of security
• Top 10 tips from around the world

🏕️ WHO CAN ATTEND?

All levels of experience of WordPress and website publishing welcome. We are a learning and development group. We welcome WordPress beginners.

Please sign-up if you intend to join the Meetup. If you are new to the group, please can you complete your Meetup profile to help us plan topics.

⏱ AGENDA

The event starts at 7pm BST.

Slides

As usual slides will be available here.

Threats

Here’s the full extract from ChatGPT’s response to “What are the biggest threats to website security?”

---

The biggest threats to website security stem from a mix of vulnerabilities in code, infrastructure, and user interaction. Here are some of the most common threats:

1. SQL Injection: Attackers exploit vulnerabilities in a website’s database queries by inserting malicious code into an input field. This allows them to view, edit, or delete sensitive data.
2. Cross-Site Scripting (XSS): This occurs when malicious scripts are injected into webpages viewed by other users. It can lead to data theft, session hijacking, and other malicious activities.
3. Cross-Site Request Forgery (CSRF): This attack tricks users into performing actions they did not intend by exploiting their authenticated sessions. For instance, an attacker might manipulate a user to unknowingly change their account settings.
4. Broken Authentication and Session Management: If authentication mechanisms (like password storage) or session controls are not securely implemented, attackers can take over accounts, often by stealing session tokens.
5. Insecure Direct Object References (IDOR): If users can access data by simply changing parameters in URLs (e.g., viewing another user’s information by modifying their user ID), this can lead to unauthorized data access.
6. Remote Code Execution (RCE): A severe vulnerability that allows attackers to execute arbitrary code on the server, potentially leading to full control over the website and server.
7. File Upload Vulnerabilities: Allowing users to upload files without strict validation can let attackers upload malicious scripts or executables, leading to data breaches or malware injections.
8. Distributed Denial of Service (DDoS) Attacks: Attackers overload a website with traffic, rendering it unavailable to legitimate users. This is often used to disrupt services rather than gain unauthorized access.
9. Misconfigured Security Headers: Missing or incorrect security headers (like Content Security Policy or X-Frame-Options) can expose websites to XSS, clickjacking, and other attacks.
10. Weak Password Policies: Allowing weak passwords or lacking brute-force protection can make it easier for attackers to gain unauthorized access through credential-stuffing attacks.
11. Outdated Software and Libraries: Using outdated CMSs, plugins, or libraries can expose websites to known vulnerabilities. Regular updates are crucial for maintaining security.
12. Social Engineering and Phishing: Attackers target users or admins to gain access to credentials or sensitive information through deceptive tactics.

Proactive measures like secure coding practices, regular vulnerability assessments, strong access controls, and constant monitoring can greatly reduce these risks.

---

References

The last meetup we had on security was 6 years ago. Is it really that long?

WordUp Pompey! – 15th Nov 2018 – Practical Security Workshop

• https://www.hostinger.com/tutorials/how-to-secure-wordpress
• https://wpastra.com/guides-and-tutorials/wordpress-security-guide/
• https://www.wpbeginner.com/wordpress-security/
• https://www.siteground.co.uk/wordpress-security-ebook
• https://my.siteground.com/support/tutorials/wordpress/security/
• https://www.bluehost.com/help/article/basic-site-security-checklist
• https://www.bluehost.com/blog/website-security-how-to-keep-your-site-safe-from-digital-threats/
• https://jetpack.com/blog/wordpress-security-tips-and-best-practices/
• PS. 20th November is Name your PC Day
• From Learn.WordPress.org
  • https://learn.wordpress.org/lesson/7-tips-to-improve-website-security/
  • https://learn.wordpress.org/tutorial/7-tips-to-improve-website-security/
  • https://learn.wordpress.org/lesson/essential-security-plugin-features-and-settings/
  • https://learn.wordpress.org/tutorial/extending-wordpress-common-security-vulnerabilities/
  • https://learn.wordpress.org/lesson/tools-site-health/
• More from WP-Pompey
  • https://www.wp-pompey.org.uk/meetup/wordpress-portsmouth-meetup-20-mar-2019-website-health-check/
  • Backup & Restore

Information