Month: July 2017

We have been involved in the WordPress community and helping with security for five or six years, but many people still haven’t heard our name. So, let’s help catch you up to speed on who we are, what we do, and who we’ve helped.

We have published a list of some of the companies we’ve helped in the WordPress community, because we want you the reader to understand our goal. Unfortunately, a lot of the companies wanted to credit the person who reported the bug and not our company.

What is our goal in the WordPress security space and with all code?
Our goal is to create a more secure world of code. We want websites to be more secure, we want cars to be more secure, we want drones to be more secure. Yes, we’ve done research and communicated with teams on all those topics. Our end goal is to help people be more secure.

The problem we have with making people more secure is that a lot of developers ignore help, even when you offer it to them for free, like what happened with the WordPress plugin Redirect editor, which was pulled from the repo about 9 months ago and still no one has had an update, so we have a free version you can download of redirect editor with a ton of security fixes.

The history of the security community is long and tedious, but in short companies caused chaos for researchers, so the companies with a lot of money made a term called responsible disclosure. What does responsible disclosure mean? To most companies it means tell us about our issues, we won’t fix them and don’t you dare tell anyone else. There are some great companies to the contrary of that, but our experience over the last six years has been extremely negative. Companies can yell at us, but our goal will and always will be to help the users not be hacked by criminals.

Why is that our goal?
Without a safer web, we won’t ever be able to move forward and do more innovative things, we will continue to run into sites or servers covered in pictures of dead bodies, which is something we’ve dealt with. Without safer code, all of this will continue to happen.

When it comes to the open source community the reason code isn’t more secure from the get-go is like in other industry, lack of knowledge on the subject, but most importantly there is no budget for security, because the majority of WordPress plugin developers make products that leave your site at risk of being hacked, and for all those hacked WordPress sites wondering how this happened, it’s because you took something for free that generally has limited security added to it.

There are some projects that are quite the exception to this rule, but they almost always have a profit model, like Genesis does and is one reason we like it.

Why did we create a more secure shop of code?

This is simple, our goal is to take the products that were made and make them more secure to use for websites. We can not do major overhauls on products for free very often, because our time is valuable and we know that you also value your time and want to stay as secure as you can.

This is why we have the more secure shop, with plugins that you indeed get for free, but in our professional opinion the free versions are not as secure as ours, nor is it likely that they will get continued security updates by a company dedicated to security.

We helped out Cookies For Comments in version 0.5.5 sanitize their cookie key before utilizing it. We strongly appreciate the dedication Donncha shows to security of his products.

We helped w3 total cache fix a potential log injection and CSRF issue. The w3 total cache team is always working on making their product better, which is something we appreciate.

We helped make the most downloaded plugin on WordPress more secure, which is WordFence as is noted in version 5.2.5.

We helped Vladimir from manageWP fix an xss issue in his plugin Friendly SEO images in version 3.0.5.

We’ve reported a lot of plugins to WordPress Security.

We helped the great team at WPML with their security over multiple security audits in multiple plugins, in which we were hired to help improve their product security. It was indeed a treat to work with a GPL team who cared so much about security and we may write blog posts about their awesome products in the future. This is a team that is indeed an exception to the rule and truly cares about security. WPML is a lot like Genesis, in the sense that they both have a profit model, so their products are far more secure, unlike the majority of companies who do not have a profit model or do have a profit model and don’t want to address security.

We helped make WP book more secure.

We helped make WP-Post Ratings more secure

We helped make the great team at Mailpoet more secure and were thanked in their changelog

We helped make shortcodes ultimate more secure, and these are just a few of the plugins that we’ve helped.

We love, absolutely love the Genesis Framework and their Genesis child themes. We did a code review for someone awhile back and were unable to find a single mistake in the Genesis framework. This is saying so much, because on average we find 150 vulnerabilities in software.

We believe it is good to praise those who do an impeccable job in security and are focused on usability and security. Genesis falls under both those categories and we look forward to them continuing their incredible work.

What Genesis child theme do we use?

While there are a lot of them, we liked the design and usability of Centric. It allows for so much customization, that we can’t say enough about it. We certainly believe that if you are looking for a good solid framework you can use on multiple sites, that Genesis is what you are looking for.

We have had customers not want to use Genesis and download other software, which falls below sub-par and they are so upset, because they paid a fortune for it. The reason for this is because people don’t know how customizable Genesis makes their software.

We will only recommend products that we trust, because we are doing our best to make more secure software for plugins and themes in our more secure shop. Unlike other companies, if we make a mistake, we will own up to it, but what many don’t know is that we are writing multiple patches for every piece of more secure software we release.

To conclude our post, we look forward to the Genesis team keeping up their good work.