WordPress Site Security (On the Cheap) (NAATW 2025)

Transcript

This transcript has been lightly edited for readability from the original caption file. Speaker names are standardized using first name and last initial where available. Timestamps are adjusted so the edited audio begins at 0:00.

Presentation: WordPress Site Security (On the Cheap). Presenter: Sean R., Area 26 Webmaster. From the NAATW 2025 Workshop, Cincinnati.

[0:00] Presenter Introduction

[0:00] Host: Without further ado, here’s Sean. Thanks, Sean.

[0:06] Opening Context

[0:06] Sean R.: Hi, as she said, I’m Sean R. from Area 26. I'm the webmaster there, and I haven't been in that position for a very long time, but in the short amount of time I've been there, I've found a wealth of opportunity to make improvements. and improve security. a little bit about myself. I started in computers about 45 years ago, and in corporate America 35 years ago in computers. I've been an IT leader, I've done databases, architecture, and a long list of… all kinds of different things related to IT. I was a HIPA.A. security officer for 12 years.

[0:42] Sean R.: And I have been around the block on the security frontnt. when I saw this opportunity to help the Area 26 website, I took note of numerous things that could be improved upon, and my goal today is as quickly as possible, to share what I learned and what I did about what I learned, so that you could take that back with you. This will hopefully help mostly the webmasters out there, but if you're on a tech committee and want to share this with them, that'd be great. Also, I want to mention that, I did throw out, as a candidate for Birds of a Feather today, the security option. vote for security if you want to have more than 15 minutes to talk about this. alright, great. WordPress security on the cheap. Oh, here we go. Got the button.

[1:29] Sean R.: let's see here. All right, and by the way, one of the challenges, to have a little fun, find all the little ways that the AI graphics that were generated managed to screw up. It's a great, example of my faith in AI. understanding the risks. So…

[1:48] Understanding the Risks

[1:48] Sean R.: Lots can go wrong on the internet. You already know that, but, what can happen when it comes to security? the first thing is data loss. Accidents happen, sometimes it's not even an accident. Having a good site backupup ensures that your site… ensures your site from intended and unintended user action, as well as mistakes by developers and service providers. I don't think very many of us haven't been in a situation where your host provider made a mistake, right? Maybe a bill didn't get paid, your account

[2:18] Sean R.: disappears, right? having a backup is critical. I'll talk more about that in a minute. Access control. Trust is great. I love trust, but when bad things happen, it's really nice to know, how, so that you can help educate your community, to avoid it happening again. Availability. DDoS attacks happen. DDoS stands for Distributive Denial of Service. So that's where some program or some person decides that they don't like your website, and they decide to beat the crap out of it. And there's very little you can do. As a matter of fact, in most cases, you won't even know it's happening. All of a sudden, there'll just be an outage. And you'll be like, gosh, what's going on? And if you have a decent hosting provider, they'll figure it out, and they may take action on your behalf. Sometimes they won't, often they won't. It's your problem.

[3:07] Sean R.: And also, on the subject of availability, your site needs to be performing well, right? If it's not performing, people often won't want to come back to it. there's that. how… what did I do? first thing I did was I cleaned up the website. I removed

[3:23] Taking Action: Step by Step

[3:23] Sean R.: plugins and themes that were unneeded or unsupported. Now, to find out what's unsupported, it's helpful to have a plugin, I'll talk about that in a minute. I implemented backups. not just backups, but you want off-site backups. That's critical, right? If they're on-site, then their backup files are just as susceptible as your website to loss or manipulation. And by the way, hackers, one of the first things they want to do if they take over your website is to sabotage your backups, because they're jerks. Manage credentials. you want to secure your accounts. A lot of us, take this… a lot of people take the attitude, “well, just a username and a password.” Well, that… you just can't rely on that, and that's because you can't rely on the average individual to use a unique password for every website.

[4:09] Sean R.: And that's just human nature. using multi-factor authentication, or better yet, social logins. I'm going to talk about that more here in a minute. And then build up your defenses, implement firewalls, filter visitors, automate updates, and monitor your website. the most important topic there is automating your updates. a lot of people don't recognize the fact that if you're using WordPress, it does have an auto-update feature. If you're using a decent hosting provider, they will also supplement WordPress's updating process.

[4:42] Sean R.: And you should take advantage of all of that, because every day that goes by that one of your plugins, or your themes, or something else that you've done has a vulnerability, something, not a person, a program is out there looking for that vulnerability, and they're trying to tap into it. And you might be thinking, why does my website possibly… why would somebody target my website? Well, they could use it to host porn. Make a long story short, they could use it to relay communications from a country in, maybe Pakistan to do damage somewhere else, right? You just become… your website becomes a zombie, essentially. So,

[5:17] Your Security Home Group

[5:17] Sean R.: your security home group, right? I put these four plugins and services together. This is what I'm using. You don't have to use these plugins, but I'm telling you, every last one of these is free, which is why I found them appealing. They're also the best known and most reliable and updated plugins that you can pick. to handle the different things they do. So Cloudflare, I'll talk about more in a minute. Word, Wordfence, Nextend Social Login, and UpdraftPlus Backups. I'm gonna move quickly, because I know time is short. I've got 9 minutes, 15 seconds, so… I forgot to hit that slide, my apologies. So those are the… those are the four plugins. Well, one of them's a service, the other three are plugins. This will be, obviously, in the group chat thing. So,

[6:07] DNS Is a Meeting Guide for Websites

[6:07] Sean R.: Next slide. DNS is a meeting guide for websites. So most people in this room understand what DNS is. If you don't, that's basically the description, right? It is like a catalog, it's an address book, it's your phone book of the internet. Every web server has an address. Not necessarily a website, but a web server has an address on the internet. And, Let's see, DNS's job is a… it's a service out on the internet that all happens in the background. Nobody other than a nerd has to get involved with managing or doing anything with it, but we're a bunch of nerds, so you should know what DNS is. DNS mappings can be static, or they can change quickly. Now, before Cloudflare came along and I started to understand how it worked.

[6:55] Sean R.: my DNS mappings were always very static. They did not change, and that made a lot of sense, right? Why would they change? The only reason they would change is if you move to a different web server, which nobody wants to do. It's a pain in the butt. But Cloudflare makes that, takes it, like, a whole other level. They make DNS mappings, dynamic, right? And what that allows them to do, as long as you're registering your DNS with Cloudflare, if you have a denial of service attack, you have any kind of a problem, they can very quickly move your website to a different IP address and update your DNS And it will be visible to the world in less than 20 seconds, right? So it's that efficient, and that's why they are the 800-pound gorilla of internet security right now.

[7:40] Sean R.: it's important to know the web servers use the URL to return the correct data, so www will get your front page, and then if you put slash meetings, it's going to run the meeting guide API, slash events, it's going to run your event calendar. That could be different for your website, those are just examples. Cloudflare replaces your website's address with its own, and acts as a middleman. I had this whole, like, exercise where people would be on the… Stage doing a little… act for us, but, we'll skip that. my apologies, I had no idea how big or small this text would appear, so if you can't read this, my apologies, but I will have this again up on the internet for you to check out. So.

[8:21] Cloudflare: Your Site’s Higher Power

[8:21] Sean R.: I'm gonna talk first about Cloudflare. It is a protective shield for your website. It doesn't have to be WordPress. This is the beauty. The other three solutions I used are WordPress plugins, but even if you have a static website, even if you have something on a completely different platform, as long as it has it, well, I'll just say, it'll work with Cloudflare, right? Cloudflare is, is, It just works. it becomes your front door. It excludes non-humans and those from specific countries. That's really handy, because I've seen the results of monitoring for security vulnerabilities. You would be shocked how many attacks come from Ireland, of all places, Ireland.

[9:03] Sean R.: But it also happens to Great Britain, it happens from Pakistan, it happens from all around the world. People are attacking your website. They're not, like, individuals. That's an important thing to remember. There is not… there is hardly ever a human being that gives a crap about your website. The reality is that there's a human being that wrote a piece of software whose job it is to scour the internet looking for these vulnerabilities.

[9:25] Sean R.: And then what they do is they just index it, and believe it or not, they use AI to figure out which websites are worth taking further action on. And the scripts go on and on and on and on. They trigger, like, a cascade. So once they figure out you're running this old version of WordPress, or this old version of PHP, they're gonna go, oh, okay, great, well, let's see if I can exploit this, and if I can exploit that. And that's… that's basically how bad things happen to your website. as I mentioned earlier, if you need to, if you're having a DDoS attack, you just change your IP address.

[9:58] Sean R.: Which is all run by Cloudflare. It's a Cloudflare IP address. And Cloudflare, this is a technical term, it acts as a proxy server, alright, with that, which means that every time you make a request of the website, it's being sent first to Cloudflare, Cloudflare scrubs it, it analyzes the request, and then it forwards it to your website. And then your website says, oh yeah, sure, here's that webpage, and it sends the results back to Cloudflare. Cloudflare says, yeah, these results look perfectly normal, nobody's injecting some crap into it, and then it sends it back to the person who asked for it. So it really is a middleman between the public and your website.

[10:37] Sean R.: and URLs, SQL injection and malicious URLs, they're nasty little beasts, right? Those are techniques that hackers use to get into your website. If you ever go to any website, Google included, you'll notice there's a slash and a question mark and a bunch of gobbledygook afterwards on the address bar. Right? Those… those parameters can be exploited. There's all kinds of hacks people can use to make those parameters, like, 500 characters long and expose some memory bug, right, in the web server that gives them admin access. It's absolutely insane, but Cloudflare blocks all of that. It handles your encryption needs. There are so many financial trickery on the internet, people trying to get you to pay for everything.

[11:22] Sean R.: you don't have to pay for a security certificate, right? If you go with Cloudflare, they'll give you a free wildcard certificate for your website, that you can use for all kinds of cool purposes, and then what you do is you download the… their… they will provide a certificate for you to put on your web server. so that your web server can talk to Cloudflare. Remember, your web server doesn't have to talk directly to the public anymore. It's gonna talk to Cloudflare. Cloudflare is gonna relay everything back and forth, right? So you just need their security certificate. to talk to your server, and they provide the wildcard certificate for the rest of the world. If you're not using a security certificate at all, shame on you. I mean…

[12:05] Sean R.: this is the internet. If you don't have a little lock symbol, then people probably aren't going to trust your website, for good reason. A content delivery network caches copies of your website. static content. as you well know, a lot of your website is composed of graphics. It's composed of things that don't change. There's really no reason for the engine inside your web server to keep generating that all the doggone time, every single time somebody asks for something like an image. if you're not using a service like Cloudflare or another content delivery network, then… then your server's working really hard. There's a graph… okay, let me see… here's some… here's some statistics and some stuff that I did some screen captures from our Cloudflare account.

[12:54] Sean R.: So you could kind of get an idea. You probably can't read a lot of this, sorry, you can't read a lot of this, but, the number… the top left is the number of requests mitigated and served by Cloudflare. So you can see there's this orange peak right over there. That, oh, Lord, I am running out of time fast. Okay, yeah, this is gonna go by really fast, guys. Hold on to your seats. So there's security rules on the right. On the bottom right, you can see how much content Cloudflare is saving our web server from having to generate. So the dark blue is everything that the caches were feeding the end user, everything in the light blue above it is what our web server had to generate. Roughly 70-80% of all the content That our users are receiving is cached.

[13:45] Wordfence Security

[13:45] Sean R.: Right, so our web server works much more efficiently. All right, I'm gonna fly through this, guys. Wordfence Security is a plugin. Wordfence is free. There is always going to be an add-on to all of these plugins, but I haven't found a need to buy them yet. Wordfence watches the door, does continuous monitoring, and provides security insights. Here are some screenshots of Wordfence, where you can see the kind of things that it's doing, such as blocking people who are trying to enter the back door to our website. So they're not using Cloudflare, they're going directly to the IP address of the server, and they're trying to get in that way. So it's blocking those attempts, it's blocking brute force attempts.

[14:25] Sean R.: Also, it's enforcing multi-factor authentication for anybody who's an administrator. And this is a nice little feature, because you don't want to annoy everybody in your area, you just want to annoy the admins who can, those accounts can do the most damage. there's that.

[14:42] Nextend Social Login: Credential Management

[14:42] Sean R.: The Nextend Social Login. I love this tool. It's free. This tool, it's free for things like Google Workspace, right? what you do is, Okay, provides a single-click login option, integrates with Google, Facebook, etc. It's a more mature identity tool, so let… let these $8 billion companies build complex login and identity management systems What you’re doing, and you can see this in the little box in the center, is all you're doing is providing a button there underneath the login name and password that says continue with Google. They click on that, they authenticate with Google, and now they're in your website.

[15:22] Sean R.: Right? So you don't have to manage multiple accounts, one here, one there, if they're members of your Google Workspace account, like, maybe it's a DCM with their own account. Well, you can have an area in your website dedicated to DCMs, and all they have to do is click that link to be able to access it. Alright.

[15:41] UpdraftPlus: Your Backup Partner

[15:41] Sean R.: UpdraftPlus backups, I said, were really important. Reliable backup, easy restoration, and scheduled backups. That's what UpdraftPlus does for you for free. This next screen will show you the difference between the free version and the paid version. UpdraftPlus Personal is $70 a year. That is not a lot of money, but you don't need to pay it unless you need to be able to upload your data to one of the, cloud service providers that isn't included with the free version. Ours is included. We use Google Workspaces, so I can upload my backups to Google Drive at no cost. Okay. I'm sorry, I'm… I'm pressing the green button, is it because I'm out of time?

[16:32] Living Happy and Secure Online

[16:32] Sean R.: Oh, no, wait a minute. Oh, yeah, living happy and secure online, briefly. Here's one of the fun things, you'll notice in the bottom right corner, the person does not look happy. And then finally, this last slide. Everybody's hugging AI, but if you'll notice, they're holding the upside-down head of a Doctor Who Cyberman. and then the last thing, which is in… I have this nice little,

[16:56] Unsolicited Advice and Closing

[16:56] Sean R.: a two-page document, and this is the last thing I'll say, and then I'll have to get off. I have this two-page document, which is full of thoughts and advice. I called it unsolicited advice. I spent hours just taking everything I learned and put it on a piece of paper, front and back. Here's a list of all of the WordPress plugins our website is using, and what they do, and then Cloudflare Tips down here. Here are the things I learned taking over that Area 26 website, the do's and the don'ts, and the tools that I used, and I can't wait to publish it for you on the Slack channel, and I want to thank you all very much for your time.

[17:52] Post-Presentation Note

[17:52] Host: So I realized that was entirely unfair to have a presentation like that, and no questions or comments. So thankfully, we'll be able to do that in the Slack channel. So I'm going to.