Table of contents of the article:
Keeping WordPress safe from hacker attacks, bots and worms is something extremely easy if you follow simple good practices, such as using strong passwords and always updating the WordPress core and its themes and plugins.
Unfortunately, however, when dealing with complex installations, it is not always possible to rely on a simple click on all the plugins and themes to be updated, under penalty of malfunctioning of the site which can return very conspicuous errors at PHP level or more bland and silent. plugin errors that may continue to run without generating blatant 500 errors at the PHP level, but which may produce malfunctions in terms of functionality and business logic.
It is not always easy to update.
For example, imagine a complex installation with WordPress, WooCommerce and a few dozen plugins that deal with extending the functionality of WooCommerce, for calculating the cost of shipments, for calculating the weight of the packages, for product customization.
We have had many cases in which a developer updating these components would generate an insurmountable and difficult to solve error, which is why in fact it was not possible to proceed with a quick update even for the simple reason that the site was in a particularly profitable seasonal period and the summer sales certainly could not be interrupted.
However, although it is possible to accept to continue to run the site with plugins that are not updated but certainly functional, it is not acceptable to be violated the site and still suffer damage deriving from the offline site, from the damage of image that would undermine the trust of customers who they would come across a visibly hacked site, or worse still, steal the entire customer database to resell it on the black market.
Learn about vulnerabilities inherent in the WordPress world.
A good compromise (obviously waiting for all plugins and themes to be updated to the latest version) is to inform yourself and stay up to date in terms of new vulnerabilities both at Core level, themes and plugins.
It is no coincidence that there are excellent sites to be able to constantly monitor the security situation of your WordPress site.
wpvulndb.com
Directly sponsored by SUCURI, a company among the leaders in terms of security, wpvulndb is in its essence the abbreviation of WPScan Vulnerability Database.
WPScan is a free for non-commercial use WordPress black box vulnerability scanner written for security professionals and blog maintainers to test the security of their sites. WPScan is written in Ruby, the first version of WPScan was released on June 16th 2011. Today WPScan is managed by the WPScan Team and other contributors.
WPScan Vulnerability Database
The WPScan vulnerability database is a WordPress Core, Plugin and Theme vulnerability database. This database has been compiled by the WPScan Team and various other contributors since the WPScan publication.
You can visit the site here: https://wpvulndb.com/
