WordPress Vulnerability

First, Let’s talk about popularity. WordPress is by far the most popular website creation tool in use today. WordPress is popular and dominates over 30% of the Internet. WordPress used by a multitude of people and even used on big business websites. 

You may use a couple of free online tools to find out what a site is built with. Built With and Is It WP Below I’ve listed a few large sites using WordPress.

• BBC America
• Bloomberg
• Sony Music
• Microsoft News
• Tech Crunch
• The Walt Disney Company
• Facebook News

The popularity of WordPress alone can cause people to worry about security. I would like to say that is not the case. Yes, there are a few steps that you should take to add security to your site. 

WordPress is an open-source application it opens a ton of doors for content creators. WordPress has over 50.000 plugins available for it. There are premium versions of many plugins as well.

As one might expect with the volumes of plugins available for WordPress. You may design almost any website you dream of. 

Are WordPress sites slow?

WordPress out of the box is fast. The use of themes and plugins will increase page load time. The use of plugins and themes adds calls to different JavaScript and CSS files. An overuse of plugins may slow your site down. 

Some themes are heavy and although they offer functionality, they may, in turn, slow your site as well. In most cases, the site is image-heavy. Not to say that the site is using too many images but that the images are not optimized to the size they need to be. If your page is loading an image 400 x 300, but the image size is 1000 x 900 the page will load slower.

There are other factors at play as well. The knowledge of how to repair a combination of items comes into play. You must reduce image sizes, minify JS & CSS, and remove page calls for items not used on a page. This is important when speeding up a website.

Why are some themes bloated?

Every theme has within it certain functionality that others do not. A heavy theme may consist of several ways to handle blog posts. A theme may have different headers and footers available. Simple themes do not offer the same functionality. To display the items the same on a simple theme would need code. This in turn increases the length of time a page takes to load.

Isn’t WordPress Security Terrible?

WordPress is written with PHP. Your server supplies the PHP your site uses to run WordPress. PHP updates with security patches and increases in speed. It is not up to WordPress to change the version of PHP your site is running. If you do not update your PHP then your WordPress could contain security issues that are present in PHP. These issues are coming from your version of PHP the server supplies your site. In essence, this is a fault of the end-user and not the fault of WordPress. 

Many plugins and themes have security vulnerabilities that must be patched. As threat analysts search for these vulnerabilities, the creators of the themes and plugins are notified. The creator may address the issues and submit an update to the plugin or theme with the vulnerability patched.

A great site that tells us about vulnerabilities in WordPress, themes, and plugins is WP Vulnerability Database. 

Does WordPress use poor coding practices?

WordPress was first released in 2003. In that amount of time coding practices have changed. Some coders do not adapt to changes quickly. There is a team of coders using different coding practices. The combination can lead to the code looking poorly written.

Many of the core features of WordPress are still there. They still adapt to older versions of PHP. There is not a reason to invest time in cleaning or rewriting code that works. Some parts of the code have been re-factored, but many older code portions have not.

I do not believe that WordPress at its core is bad code. The team behind WordPress does a fantastic job of testing before any update is made. Developers of both themes and plugins have been known to submit poor quality code. That is to be expected in an open-source environment. 

To Sum It Up!

I am a firm believer that the primary cause of security issues and vulnerabilities in WordPress lies in the hands of the site owner or webmaster. 

It is your responsibility to ensure you have security and a firewall on your website. It’s your responsibility to harden your WordPress site against threats. It is up to you to remove the default WordPress functions that notify a potential hacker when they have made a mistake. It is your responsibility to not use cracked files to gain functions without paying for them. It is your responsibility to update WordPress, themes, and plugins. Securing potential vulnerabilities is a must. The core of the security is from the end-user and not from WordPress.