1 of 41

Evaluating Plugins

Strategies to Effectively Extend WordPress

#WCROC

2 of 41

Your Presenter: Kathy Zant

  • Data-driven websites before they were cool
  • WordPress for well over 10 years.
  • Wordfence & WordPress security for the last 3 ½ years

3 of 41

Our Goals

Learn strategies for choosing plugins to safely and effectively extend WordPress functionality.

  • Is it the right tool for the job?
  • Is it high quality?
  • Is it actively being developed? (Will it last…)
  • Is it safe?

Have some fun -- plugin horror stories.

4 of 41

Why evaluate plugins?

Ingredients matter.

Plugin code is like an ingredient in the dish of your website.

5 of 41

What is a plugin?

A script or group of scripts in PHP that extend the functionality of your WordPress site. Plugins seamlessly integrate into WordPress to add new features to your site.

Themes: display/layout, but can also add functionality.

Plugins: add functionality, but can also add to your site's layout.

6 of 41

What can plugins do?

“There’s a plugin for that.”

  • Contact Forms (Contact Form 7)
  • Search Engine Optimization (Yoast SEO, All in One SEO, Google XML Sitemaps)
  • eCommerce (WooCommerce)
  • AntiSpam (Akismet)
  • Backups (Updraft Plus)
  • Security (Wordfence)

7 of 41

Plugins turn what started as a basic blogging platform into a full-function, data-driven website that supports your business.

8 of 41

What a plugin can do

Plugins provide new functionality & bring your site new life.

And with that power…

9 of 41

What a plugin can do

...comes great

responsibility.

10 of 41

What happens on your site is your responsibility.

Make good decisions based on good data.

11 of 41

It’s all about performance

What can a plugin do for you?

Will it do what it says it will?

Will it do no harm?

12 of 41

Plugin Horror Story: Pipdig

WordPress themes & a management plugin, P3.

Premium.

Not open source.

https://www.wordfence.com/blog/2019/04/pipdig-update-dishonest-denials-erased-evidence-and-ongoing-offenses/

13 of 41

14 of 41

Plugin Horror Story: Mason Soiza

Supply-chain attack.

  • Escort website
  • Payday loans
  • UK Meds

Caught by the community and plugin team.

Why

15 of 41

Types of plugins: Open source

The WordPress Plugin repository: 54,709 free and open source WordPress plugins.

wordpress.org/plugins

  • Contact Form 7
  • Duplicate Post
  • WP Super Cache

16 of 41

Types of plugins: Freemium

Offering basic services for free while charging a premium for advanced or special features. Free version of the plugin in the repository with some locked features.

  • Yoast SEO
  • Smush (Image Compression)
  • Updraft Plus
  • Wordfence

17 of 41

Types of plugins: Premium/Commercial

Source is not in repository and is only available after purchase.

Commercial sources like Envato Market:

  • ThemeForest.net
  • CodeCanyon.com

18 of 41

Types of plugins: Nulled

Freemium or premium plugins made available for free.

Often have backdoors, spam links.

Spoiler: It’s a trap!

19 of 41

Do You Get What You Paid For?

Not necessarily.

Plugins from repository are open source

Paid plugins don’t have visibility in the marketplace

Not all paid plugins are bad; due diligence is on you, no help from the community

20 of 41

Plugin Horror Story: The Tunnel

WordPress Premium SEO Pack support backdoor.

No visibility, not open source.

21 of 41

Researching Plugins

Google search phrases

  • [plugin name] hacked or vulnerability
  • [plugin name] broke, broken
  • [plugin name] slow site, performance
  • [plugin name] support

Thankfully, we’ve got the repository...

22 of 41

Plugin Effectiveness

Questions you can answer on WordPress.org:

  • Is it updated?
  • Has it been tested?
  • Is it supported?
  • Is it loved?

(All factors are important!)

23 of 41

Not updated or tested

24 of 41

Not supported

A 5-star review! This plugin should be good, right?

No longer updated.

No answers to support questions.

Add Categories to Pages

25 of 41

The Changelog

Under Development, look for the Changelog.

Are vulnerabilities disclosed and fixed?

(No changelog? Hmmm.)

Ultimate Member

26 of 41

Reviews

How many reviews? How many 5-star reviews?

Read a selection of mid-range and 1 star, too.

Take everything with a grain of salt; look for patterns.

WooCommerce

27 of 41

Resources: WPVulnDB

https://wpvulndb.com

Version number with the vulnerability.

Just because a plugin is here, doesn’t mean it is currently vulnerable.

28 of 41

Resources: ManageWP

https://managewp.org/plugins/compare

Choose two plugins and compare.

29 of 41

Resources: ManageWP

SEO Framework

vs.

Yoast SEO

Metrics are simple, but the interface gives you a quick view of them so you can quickly compare.

30 of 41

Resources: RIPS CodeRisk

https://coderisk.com/statistics

31 of 41

Resources: RIPS CodeRisk

32 of 41

Resources: RIPS CodeRisk

Contact Form 7

33 of 41

Sez Who: Not Me!

34 of 41

Code Review

You could take a look at the code yourself.

Download the zip file, unpack it.

Use a text editor to look for anomalies.

https://github.com/ethicalhack3r/wordpress_plugin_security_testing_cheat_sheet

35 of 41

Code Review part 2

https://wpdirectory.net/

36 of 41

Wordfence Scans

Malware scanning.

Security problem alerts.

Upgrade alerts.

Abandoned plugin alerts.

37 of 41

Plugin Resource Utilization

How does the plugin affect your site’s performance?

Debug Bar https://wordpress.org/plugins/debug-bar/

38 of 41

Best Practices: Testing

  • Create a replica of site.
  • Duplication plugins can help.
  • Don’t test new plugins on production.
  • Look for effectiveness, compatibility issues with other plugins.

39 of 41

Best Practices: Plugin Management

Uninstall plugins you’re not actively using.

Keep plugins updated.

Audit/review plugins periodically.

40 of 41

End Result

  • Functional site
  • Safe site
  • Happy customers
  • Entertained site visitors
  • Performance!

41 of 41

Keep in touch!

My personal site: zant.com

Twitter: @kathyzant

wordfence.com/podcast

kathy@zant.com or �kathy@wordfence.com