This article is from Ask Wordfence, WordPress Security on March 14, 2018 by Dan Moen

At a high level, an attacker views a vulnerable website as a juicy collection of resources that they can steal or exploit:

• It’s backed by a server that they can use to run their own programs
• It’s connected to the internet and likely has a squeaky-clean reputation
• It might include interesting user data
• It probably has traffic coming to it
• It is likely important to you

Most of the time, they use those resources to make money. And they continue to find new creative ways to make a buck.

> Read full article

This article is from Ask Wordfence, WordPress Security on November 8, 2017 by Dan Moen

“According to survey results we published last year, vulnerable plugins are the top way that attackers gain access to WordPress sites. Reducing your plugin security risk is one of the most important aspects of protecting your site.

There are a number of things you can do to limit the risk of security issues on your site.

Use as Few Plugins as Possible

Every plugin you install on your website increases your “attack surface”. You are running more code, so your odds of having a security vulnerability exploited go up. Every plugin you add to your site also represents another developer you are relying on to keep you safe. That includes writing secure code, responding quickly to vulnerability reports and keeping your best interests in mind.

Only Download Plugins From Reputable Sites

If possible we recommend that you limit your plugin downloads to the official WordPress.org plugin directory. A great team of volunteers manages it, alongside a large community of users and security researchers helping out.”

> Read full article