Unupdated plugins and weak passwords, the main risk factors for websites

The lack of updating of ‘plugins’ and the use of weak passwords are presented as the main risk factors for web pages, which are exposed to the constant threat of cyberattacks if administrators do not reinforce them.

In the last six months alone, approximately 480,000 malicious requests per minute have been blocked globally, which is equivalent to 8,000 failed attack attempts per second, according to data provided by WordPress.com’s Web Application Firewall (WAF). the web creation and e-commerce platform owned by Automattic.

For this reason, the company’s team has identified the main risk factors that expose websites to vulnerabilities, which range from lack of updates to inadequate password management, as stated in a press release.

Vulnerabilities in plugins and themes are the most common points where attackers access websites. Some so-called ‘nulled’ (hacked) plugins carry backdoors that allow malicious access to the website and through which attackers can upload malicious code or execute arbitrary commands on vulnerable sites.

In addition, hosting websites on non-specialized hosting services or the continued use of outdated versions of the software by users can expose them to vulnerabilities known and exploited by attackers.

WordPress.com highlights the need to adopt preventive measures such as keeping plugins and themes updated, since the most recent versions usually include security patches that correct known vulnerabilities.

The use of weak or recycled passwords and the lack of multi-factor authentication are other causes of security breaches. While not the primary vector, these vulnerabilities allow attackers to access websites with relative ease.

Therefore, the WordPress team believes that website administrators should adopt secure password management practices, such as using strong, unique passwords and implementing multi-factor authentication to prevent unauthorized access.

WordPress.com emphasizes the importance of always being one step ahead when it comes to cybersecurity. The combination of regular updates, good security practices and the adoption of advanced technologies significantly reduces the risks of cyber attacks.