Is there any guarantee that the plugins I find on the wordpress site are legitimate and don't have any malicious code in them? Or is it up to me to check them?
If so, what would be the best way to do that, given that I have little knowledge of php
1
-
Asking for "the best way" is highly opinionated. No one can really know what knowledge you got and what you are able to recognize as "malicious". Please rephrase your question.– kaiserCommented Apr 25, 2014 at 8:23
Add a comment
|
2 Answers
Plugins on wordpress.org has always been a debateble question for me. According to my opinion all plugins submitted to wordpress.org should be tested thoroughly and should be bug free.
However, I come across many highly used plugins that are not up to scratch. More that 50 percent of plugins I've tested have some kind of bug, some are so full of bugs like you can't believe. A while ago I tested a social plugin for a user that had problems using the plugin, and that sad to say, functions was used in that specific plugin that is depreciated since wordpress v2.0
So it seems that there aren't any proper control of what goes into the wordpress.org plugin directory and what not.
As for malicious code, I haven't came across that as of yet. But I'm still very warry of just using a plugin without properly testing it out in a test enviroment. And on that test enviroment I have permanently set debug to true in wp-config.php. Once a plugin has passed in my test site, only then will I install it in my live site
answered Apr 25, 2014 at 8:10
-
That's good advice, is there anything in particular that you look out for when looking for malicious code? Commented Apr 25, 2014 at 8:12
-
Malicious code is usually encrypted code that should not be to difficult to spot, but as I said, you should not worry to much about malicious code in wordpress.org plugins. Apart from normal bugs, they should be fine to use. And if you test plugins first on a test site and something bad happens, you will know not to use that plugin again. You should also always rerport problems with plugins to their respective authours Commented Apr 25, 2014 at 8:18
-
Ah I see, so I should look for any code that's trying to hide what its doing and investigate that, thanks for the help! I'll be sure to use a test site as well Commented Apr 25, 2014 at 8:27
-
The plug in from wordpress.org are community driven. So while there is no guarantee, the larger community usually stuffs out ones that aren't any good. A good suggestion might be to check the number of downloads and the reviews. I may suggest that you consider spending a little bit of money for a plug in at codecanyon.net. I've never had problems there.
answered Apr 25, 2014 at 7:57
-
That's a good point, however I'd like to be as certain as possible, another worry is possible security vulnerabilities in plugins, I don't know nearly enough to be able to spot them Commented Apr 25, 2014 at 8:01
-
My assumption is that outside of inspecting the code you couldn't be certain. I've been using WordPress since version 1.8, I've had no issues with plugins that cause me to suspect I'm being hacked. Commented Apr 25, 2014 at 8:04
-
That's comforting, however I'd like to be as certain as I can, its not my site that's on the line, its my employers. Commented Apr 25, 2014 at 8:08