3

Our new hosting company ran a security check on our installation and I was very surprised to hear that a premium plugin we had purchased (Easy Media Gallery Pro) contained malicious code.

(It may just be coincidental, but our site was hacked around the time we upgraded to the Pro version of that plugin.)

Anyway, I would like to know if there are any reliable utilities out there than can perform an reliable, independent security check on a plugin before I install it on my site??

Improve this question
3
  • 1
    Read and understand the code. There is no other reliable way.
    – fuxia ♦
    Commented Aug 10, 2015 at 10:07
  • I don't think me reading and understanding all the plugin code is very practical... By the time I finished (if I ever did, and if I ever got paid for it) the plugins would probably need updating again. Good on you if that's what you do, but I am looking for a service like Patchman or Securi, but something I can run on a plugin before I install it.
    – Boycott A.I.
    Commented Aug 10, 2015 at 10:19
  • I have seen some vendor puts base64 encoded string with eval(). Just to make there source code "secure". Not sure if that is your case.
    – Sisir
    Commented Apr 12, 2016 at 13:06

2 Answers 2

Reset to default
3

There are several options/plugins to do that but nothing can provide you with 100% security. Following good practices, daily/weekly backups and using themes/plugins that follow good code practices will usually help you to stay away of troubles. But again nothing will give you 100% security. As for plugins you can try several that will give you a little peace of mind:

I've worked mainly with Wordfence Security since most of the plugins I use come from the official WP repository and it has some neat settings that allow you to compare your theme's/plugins' code against changes directly with the theme's/plugins' repo and scan the code for potential issues.

But again this is not a 100% solution.

Improve this answer
4
  • Thanks, Denis. I had just discovered Wordfence via a comment from someome else who had uses it to find malicious code in the Easy Media Gallery Pro plugin. I'm using it now and it looks the business. Cheers.
    – Boycott A.I.
    Commented Aug 10, 2015 at 11:05
  • Those plugins are more likely to lock you out than solve any security problem, and probably neither of them would have pervented your security issue. The only way to make sure plugins are secure is to audit their code @ban-geoengineering
    – Mark Kaplun
    Commented Mar 3, 2016 at 19:46
  • See my comment beneath my question. It's not a practical solution - and even worse for WordPress site admins that aren't coders.
    – Boycott A.I.
    Commented Apr 12, 2016 at 12:59
  • @ban-geoengineering Yeap, you are 100% right. It is not practical especially if the website owners' are not developers. If that's the case something like Sucuri or hiring a freelance security pro would be a more practical solution.
    – denis.stoyanov
    Commented Apr 12, 2016 at 15:24
5

Effectively at the moment, there are approximately 30,000+ plugins that are not empty in the WordPress.org repository. These plugins are submitted for inclusion and are manually reviewed by volunteers before making them available on the repository. Inclusion of plugins and themes in the repository is not a guarantee that they are free from security vulnerabilities.

Keep in mind the fact that even though some plugins may be secure at the moment the new plugin updates may bring the security issues.

One great resource to read is: https://www.owasp.org/index.php/OWASP_Wordpress_Security_Implementation_Guideline

Because of the dynamic nature of the plugins (read: they are updated), keep in mind to check the plugins on daily bases.

In order to perform static plugin source code audit, the following tools can be used:

  • RIPS: A static source code analyzer for vulnerabilities in PHP scripts

  • PHP-sat: Static analysis for PHP

  • Yasca: It could best be described as a "glorified grep script" plus an aggregation of other open-source tools.

And other tools based on Linux grep command.

There are also tools that work dynamically (runtime) as you may read in the OWASP document, and this is also important.

Let's just say some "bad" plugins may contain images with hidden data that can dynamically convert to bad PHP code instructions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.