Having a distrusted SSL certificate is much worse than having none at all. While Chrome displays a not secure message for websites still using HTTP, it will all but prevent visitors from viewing websites with broken SSL certificates. A red triangle with an exclamation is shown in the URL address bar and on a blank page with a stern warning. If your website is facing the issue it should be fixed immediately.
You should always exercise caution when receiving emails requiring you to submit information or perform an action. Usually, phishing emails are targeting bank accounts or other financial institutions. Even if an email looks legitimate, if there is doubt, always make a phone call to the institution that the email appears to be from.
This is news to me. Before coming across this article I had never heard of HSTS (HTTP Strict Transport Security). Now that I have an understanding of the purpose and benefits it provides, there really isn’t a reason not to implement it. Unless of course, for some strange reason you plan on removing HTTPS and your SSL certificate from your website.
The majority of WordPress website administrators shouldn’t be freaking out. Basically, your security has to be pretty lax in order for the sequence of events to take place for a complete system takeover. Any good admin knows to install a firewall application for WordPress. There are several plugins available that are fairly easy to set up. I suggest All in One WP Security & Firewall if you’re looking for a robust solution.
The nice thing about these security updates is that they should be automatic unless explicity configured not to update. This certainly comes in handy when you manage dozens or even hundreds of WordPress websites for clients. Not having to manually update each site lessens the time (and risk) for a patched exploit to be abused on older installations. If you generally use the same admin email across all of your websites, you should get a notification about a successful automatic upgrade for those sites. It’s a welcomed reassurance that your sites are safe from a potentially dangerous vulnerability.
Last year, Chrome slowly began to implement the “Not Secure” message on non-https websites. Specifically, where a contact form was present. Now, no matter what page a user is on in Chrome 68, that message will be clearly visible. Thankfully, it isn’t as shocking as some predicted. There is no giant red x or stop sign next to the warning. I think that visual cue alone would have even made a bigger impact.
If it weren’t for the fact that “Author” privileges are needed for this attack, this bug would be huge. Usually, the WordPress team are very quick to correct flaws that have been pointed out to them. It’s hard to believe that this particular flaw has not been fixed since it was first discovered in November.
Talk about dedication. I’ve had to deal with several cases of infected WordPress websites. The good news with spammy malware is that they generally don’t want to delete your existing content. It can be difficult to identify infected files and remove malicious code. I’ve used Eli’s Anti-Malware scanner plugin with great success to assist in removal of such code. It appears that this BabaYaga malware doesn’t play well with other malware and will remove them altogether.
I must’ve missed this news last month. I’m a huge proponent of anti-spam measures and contact form security. Especially Google’s recaptcha service. A form without captcha will almost certainly be pummeled with spam messages. This can make filtering out legitimate messages difficult as well as consume resources for your website and server. Over the last several years it has been standard to include Recaptcha for all of the contact forms on clients’ websites.
File this under the weak passwords category. This is not a hack or breach of WordPress’s systems. Rather, it is a matter of hijacking credentials for wordpress.com and utilizing jetpack to install a spam plugin on linked self-hosted websites. The most common trend sees usernames and passwords that were discovered through data breaches of other systems and then using that information to see if those credentials match up with a WordPress account. Since many people like to use the same username and password combination across multiple platforms, there was bound to be success in this method of attack.
© 2025 · Precise Online Management, LLC.
This site is owned and operated by Ryan Faucher