0

Just have my fist website up and running with WordPress. Using the tool like Wappalyzer and WPScan. A lot of webite is being exposed. I already use hide my wp plugin(s). but still received this information from WPscan

 | [!] 3 vulnerabilities identified:
 |
 | [!] Title: PWA for WP <= 1.0.8 - XSS
 |     Fixed in: 1.0.9
 |     References:
 |      - https://wpscan.com/vulnerability/f737a5c7-6c40-4a75-9145-045cc707cdc0
 |      - https://plugins.trac.wordpress.org/changeset?reponame=&new=2057552%40pwa-for-wp&old=2041924%40pwa-for-wp
 |
 | [!] Title: PWA for WP & AMP < 1.7.33 - Authenticated (Subscriber+) Arbitrary File Upload
 |     Fixed in: 1.7.33
 |     References:
 |      - https://wpscan.com/vulnerability/db9d5a08-a16a-4767-8d85-1b3e02dbbfbd
 |      - https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/
 |
 | [!] Title: PWA for WP & AMP < 1.7.33 - Authenticated (Subscriber+) Settings Change
 |     Fixed in: 1.7.33
 |     References:
 |      - https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134
 |      - https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/

and enter image description here from Wappalyzer.

Don't get me wrong. I don't mind letting people know that I use WordPress to build my site. but I would like to hide all the other information as much as possible since I feel like the more information those hackers know, the less security my site is.

So should we worry about these information being exposed ? any methods to improve it? how much information can we hide when using wordpress?

3

but I would like to hide all the other information as much as possible since I feel like the more information those hackers know, the less security my site is.

99.999999% of attacks you get will be fully automated bots. Actual humans trying to break in are very rare, and when they do they'll either use the same tools the bots use to do it, or they'll target the humans with low-tech attacks that are easily defeat-able with basic protections such as 2FA or login throttles.

So should we worry about these information being exposed ? any methods to improve it? how much information can we hide when using wordpress?

It is irrelevant, and hiding it does not improve your security.

Hiding which plugins you're using and which versions they're at does not fix security issues, bots don't check the plugins you use before trying an exploit, they just use the exploit and if it works it works.

Bots use a fire and forget strategy. If you look in your servers logs you'll see bots firing Drupal or Joomla exploits at your WP site. Why check waste time checking if an exploit is usable when you can just fire it and if it works the site will phone home with success? Time is money, make the request to as many sites as you can get away with as fast as you can, if it doesn't apply to them well you've saved yourself a series of checks.

Then What Should I Do?

The best thing you can do is not to hide that you're using PWA for WP & AMP or the version it's at, but to uninstall it or update to a version of that plugin that fixes the issue. That's what WP Scan is suggesting by telling you the version the problem was fixed in ( at least upgrade to Fixed in: 1.7.33 ).

You can't fix an insecure theme or plugin by hiding it or installing a plugin.

In general, security through obscurity/hiding things makes you feel better, and that's it, it doesn't actually make your site more secure. The false sense of security can actually make your site less secure in the longrun.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.