1 of 38

Plugin Security: Best Practices for Hardening your WordPress Site

Lax Mariappan

Eternus Global

#WCDAVAO2019 @LaxMariappan

2 of 38

Lax Mariappan

Co-founder of Eternus Global
Open source enthusiast
Halo-halo lover

Follow me @LaxMariappan

#WORDCAMPDAVAO2019 @LaxMariappan

#WCDAVAO2019 @LaxMariappan

3 of 38

dolphyquizon.com

#WORDCAMPDAVAO2019 @LaxMariappan

#WCDAVAO2019 @LaxMariappan

4 of 38

WHY?

#WCDAVAO2019 @LaxMariappan

5 of 38

Myth Vs Facts

#WCDAVAO2019 @LaxMariappan

6 of 38

Stats

#WCDAVAO2019 @LaxMariappan

7 of 38

Type of Vulnerabilities

8 of 38

9 of 38

For Site Owners

#WCDAVAO2019 @LaxMariappan

10 of 38

Secure your login credentials

#WORDCAMPDAVAO2019 @LaxMariappan

#WCDAVAO2019 @LaxMariappan

11 of 38

Stay updated

#WORDCAMPDAVAO2019 @LaxMariappan

#WCDAVAO2019 @LaxMariappan

12 of 38

Harden your site

#WORDCAMPDAVAO2019 @LaxMariappan

#WCDAVAO2019 @LaxMariappan

13 of 38

Monitor regularly

#WORDCAMPDAVAO2019 @LaxMariappan

#WCDAVAO2019 @LaxMariappan

14 of 38

Never underestimate logs

#WORDCAMPDAVAO2019 @LaxMariappan

#WCDAVAO2019 @LaxMariappan

15 of 38

Consider “Static” or “headless”

#WORDCAMPDAVAO2019 @LaxMariappan

#WCDAVAO2019 @LaxMariappan

16 of 38

17 of 38

wpvulndb.com

#WCDAVAO2019 @LaxMariappan

18 of 38

Tools

Malware Scanner Sucuri

Scanner & Firewall like Wordfence

WAF like Cloudflare

Backup plugins like UpdraftPlus

19 of 38

Trusted Security News

20 of 38

For Developers

#WCDAVAO2019 @LaxMariappan

21 of 38

Plugin Boilerplate

Credits: https://wppb.me/

#WORDCAMPDAVAO2019 @LaxMariappan

#WCDAVAO2019 @LaxMariappan

22 of 38

Sanitize data

#WCDAVAO2019 @LaxMariappan

23 of 38

Prepare your SQL queries

#WCDAVAO2019 @LaxMariappan

24 of 38

POST vs GET

#WCDAVAO2019 @LaxMariappan

25 of 38

Verify Nonces

#WCDAVAO2019 @LaxMariappan

26 of 38

Restrict Access

#WCDAVAO2019 @LaxMariappan

27 of 38

Review your code

#WCDAVAO2019 @LaxMariappan

28 of 38

Say no to

nulled plugins

imgflip.com

#WCDAVAO2019 @LaxMariappan

29 of 38

30 of 38

31 of 38

Notify admin

Credits: premium.wpmudev.org

#WCDAVAO2019 @LaxMariappan

32 of 38

Be a beta tester

#WCDAVAO2019 @LaxMariappan

33 of 38

Report bugs and suggest new features

#WCDAVAO2019 @LaxMariappan

34 of 38

Spread the word

#WCDAVAO2019 @LaxMariappan

35 of 38

Takeaways

Choose a secured hosting service & official plugins

Stay updated

Keep an eye on the site

Stick to coding standards

Get help and help others

#WCDAVAO2019 @LaxMariappan

36 of 38

Security is a team effort

Credits:star2.com

#WCDAVAO2019 @LaxMariappan

37 of 38

Any questions?

#WCDAVAO2019 @LaxMariappan

38 of 38

Salamat gid

* Photos of Garfield taken by me

Game of thrones images from vox.com, Esquire

#WORDCAMPDAVAO2019 @LaxMariappan

#WCDAVAO2019 @LaxMariappan