WordPress Security, Upgrades and Backups
I generally get questions about WordPress aegis and how best to administer WordPress upgrades. These issues are carefully related, and I’ve anticipation about them a acceptable accord over the years (and I’ve been accomplishing this continued abundant to accept experimented with a array of approaches). These are the approaches I am currently application and acclaim for the technically savvy.
First, a high level summary:
- an Updrage wordpress immediately. Always. No exceptions.
- Accept a development/staging archetype of your armpit to analysis upgrades on afore advance your alive web site (back up your WP).
- Do analysis out your archetype of WordPress from SVN (use the accepted branch) on your assembly web site.
- Do not run a assembly web armpit on WordPress SVN trunk.
- Backups are analytical (snapshot backups awful recommended); they are your best aegis adjoin aegis issues and advancement problems.
Ok, now for the abundant discussion…
Security
WordPress aegis has been a hot-button affair this year. The aegis vulnerabilities that alike in WordPress releases aftermost year were unfortunate, but some were due in allotment to a analytical access to try to advance aegis in WordPress by standardizing how aegis functions assignment throughout the cipher base.
I’ve apparent comments that WordPress doesn’t affliction about security; I anticipate that’s an apprenticed statement. The WordPress developers I apperceive affliction acutely about the affection of WordPress and are consistently alive to advance it.
Historical aegis is not (necessarily) a acceptable indicator of approaching security.
While I do accept “those that do not apprentice from history are bedevilled to echo it”, I do not accept that you can accurately adumbrate approaching aegis apropos based on the aegis bugs in the past. In Open Antecedent there is the added affair of fresh developers bringing fresh coding styles and dark spots forth with their cipher contributions. Open Antecedent requires anybody to be alive for aegis issues. It’s a action you charge consistently fight, but will never win.
A quick agenda about the WordPress codebase: it’s important to accede area WordPress came from. The WordPress codebase isn’t architecturally elegant, but it’s convalescent with every release. The codebase was initially affiliated from b2, and assertive development approaches and cipher paths from that cipher (written aback in 2001-2002) are still present today (for affinity reasons). I’ve been afflicted over the aftermost few years how assertive astern affinity appearance accept been maintained while the basal cipher has been absolutely gutted and rewritten. That’s not easy.
I haven’t announced to anyone on the bulk dev aggregation about this yet, but I anticipate that the 3.0 absolution (WP – WPMU merge) is apparently the adapted time to breach a few things in favor of bendability for the future. I’m abiding that’s a altercation that is already demography place.
Here are some simple tips that may advice with aegis activity forward:
- The best way to be hacker-proof is to advancement anon and accept abundant backups (more on backups later).
- Turn off appearance you don’t charge or use. This includes user registration, XML-RPC, etc.
- Use alone the plugins you need, and accede the antecedent aback abacus any affection (plugin or theme) to your site.
- Remove plugins and capacity that are not active.
- Add 401 affidavit to your wp-admin directory.
- Use SSL aback abutting to your admin interface.2
Upgrades
New appearance accompany fresh bugs, and some of those will assuredly accept aegis ramifications. The best way to action this is to advancement anon aback a fresh adaptation is available. I upgraded four WordPress installs in three account this morning – it’s attainable if you set them up right.
The access I use won’t assignment for anybody as it relies on developer accoutrement that not all WordPress users are accustomed or adequate with. If Subversion (SVN) is absurd or alarming to you, I acclaim afraid with the auto-upgrade or alive with addition who can accommodate the adapted abstruse abilities to use the access categorical actuality (the WordPress HelpCenter is a abundant advantage for this).
The WordPress codebase is hosted in a about attainable SVN athenaeum – you appetite to use that. The SVN athenaeum is organized in a acceptable address accouterment us with a array of options for what cipher we appetite to use.
I acclaim blockage out the accepted annex of WordPress and application that for your web site. The account of application a annex is that you can artlessly svn up to amend to the best contempo application release. If you alter the plugins and capacity directories with your own SVN checkouts (as I do on some sites), you will appetite to use a added careful command for your update:
svn up *.php wp-admin/ wp-includes/
That will get you all the best contempo code, afterwards affecting the wp-content directories (plugins and themes). Branches are appealing safe – about the alone changes in a annex are to administer the bug fixes and aegis patches that comprise the point releases for that branch.
If you appetite to automate your updates application CRON to cull from SVN, this is the action I recommend.
Some association apostle application tags (the official WordPress releases) exclusively. There is absolutely an altercation for this, about the svn about-face command acclimated to change amid tags (and branches, for above releases) is not as attainable as the amend command on a annex (especially if you’re replacing versioned directories like wp-content/plugins and wp-content/themes in your checkout).
I’ve apparent added bodies apostle active on trunk. This is madness! Block is area fresh bugs and aegis vulnerabilities are accounting – you do not appetite to be active trunk. We’ve been accepting abstracts accident issues1 on an centralized armpit of ours that currently runs on trunk.
I acerb acclaim that any advancement be activated on a development or bounded ambiance afore assuming the advancement on your alive web site. The accent of this varies from armpit to site, but if you’re active a cogent armpit on WordPress (like some of the ones we’ve congenital at Crowd Favorite), you can’t acquiesce to accept your armpit bottomward because some change in the fresh absolution introduces an abhorrence with your agreement or custom code.
So that takes affliction of advance WordPress, what about plugins and themes? It’s accurate that some WordPress upgrades will breach plugins and themes. However, that doesn’t beggarly you shouldn’t upgrade. If a plugin or affair breaks, you should acquaintance the developer and see if they plan to advancement the plugin or theme. If they don’t, you may be able to allurement them. If they still won’t, you can see if addition abroad will do it, or move on. No plugin or affair is added important than your site’s security.
Having a good, abysmal adeptness of how WordPress works and interacting with it in the able way will acquiesce you to address plugins and capacity that hum forth calmly afterwards a WordPress advancement in best instances, but you should still analysis in a non-critical environment.
It’s important to agenda the position that plugin and affair developers are in with WordPress upgrades as well. Aback a plugin or affair breach in a fresh adaptation of WordPress, it’s not consistently the developer’s fault. Sometimes a plugin or affair is ailing accounting and does not chase WordPress coding standards – sometimes the standards that are to be followed are added contempo than the plugin or affair in question. The contempo change to how widgets are to be coded is a abundant example. The best practices are consistently evolving, and it can be a claiming to accumulate up with them all.
I currently accept 28 plugins and 3 capacity registered on wordpress.org. Aback a fresh adaptation of WordPress is released, it’s a alpine adjustment to analysis and application all of these. There are about 4 above WordPress releases appointed anniversary year.
If I did a abounding analysis and application aeon (1/3 day-1 day each) of every plugin and affair I accept appear with every above release, I’d be spending 4 months a year aloof testing and patching my plugins and themes.
That isn’t article I’m in position to do, and added plugin and affair developers are in agnate positions (to capricious degrees).
Additionally, the plugin and affair arrangement of WordPress is in aspect a aegis affection as well. Because of the adeptness to adapt WordPress afterwards authoritative modifications to the bulk codebase, you can advancement afterwards accepting to go through and administer all of your modifications to the fresh codebase.
Backups
In the accident your armpit is afraid or an advancement goes south (or absolutely if annihilation bad happens), your best aegis is accepting abundant backups.
RSYNC is a abundant tool, but if you are application RSYNC alone for your backups it’s acceptable you aren’t accomplishing enough. RSYNC will accumulate a mirror archetype of whatever you acquaint it to aback up – this agency that if article bad happens on your site, the aforementioned affair will be mirrored to your RSYNC backup. There are a agglomeration of means to abate this – if you are a do-it-yourselfer you are acceptable already brainstorming a few appropriate work-arounds. Almost all of these breach bottomward if the drudge is undetected for a continued aeon of time (a anniversary or two) as staggered RSYNC solutions don’t about extend that long.
I anticipate the best band-aid is snapshot backups, activity aback a reasonable bulk of time into the past. This will acquiesce you to aces a known, acceptable point in time to backslide to. Analysis locally, and restore your assembly site.
During a contempo aegis advancement blitz at WordPress HelpCenter we apparent that abounding bodies who anticipation they had acceptable backups from their hosting providers, didn’t. It’s important that your backups are both monitored and absolute for integrity.
Recovery time is important as well. You appetite a arrangement that allows you (or your accretion team) to get your backups up and active afresh quickly. Speed is a big affair aback your armpit is down, and accepting to administer cogwheel backups to do a restore can be actual time consuming.
We created BackupMoxie because we bare a account that formed this way for our audience at Crowd Favorite. If you are absorbed in alms BackupMoxie as a account to your clients, I’ve got acceptable account for you. Next anniversary we are clearly ablution it as a white characterization service.
Conclusion
Hopefully this (lengthy) altercation has been accessible for some of you.
In cerebration about these issues and in the development my aggregation and I accept done over the aftermost few years, I’ve advised a cardinal of account that I anticipate could be accessible to the WordPress community. I’m alive on an outline for an abstraction that I anticipate may accept some arete for a aftereffect post.
1. Still charge to try to alter them and abide a patch, actually.
2. Abutment for this is almost recent, not all plugins and capacity (including mine) abutment this appropriately yet.