WP Minder

Debbie Campbell

WordPress 6.0 Due Out Today

by Leave a Comment

6.0 is due to launch on May 24, 2022. Here are some of the main changes for WordPress website owners and managers:

  • The ability to select text across multiple Gutenberg blocks.
  • Select and drag multiple same-level blocks in in List view.
  • New block transformations – make changes to block layouts on the fly while editing – and styles are now maintained when you transform a block.
  • You can now use the Featured Image in the Cover block.
  • New Stack block for vertical grouping (reponsive).
  • New block for Author Bio.

Read (a lot) more about it here.

Excluding WooCommerce Pages from Caching

by Leave a Comment

If you run a WooCommerce shop and you’re using a caching plugin on your website – or your host is providing one as a service, like Varnish – make sure caching is disabled for key WooCommerce pages and cookies.

What is Caching?

Caching is ‘saving’ website information and content in the user’s browser on their first visit and displaying that saved page in the future rather than having to pull it from the server. It allows for faster page loading than if the page had to be ‘rebuilt’ from scratch each time the user views it.

But caching has its drawbacks, as you probably know from being told to ‘clear your cache’ to try to fix any website issue. Caching impacts on WooCommerce can include:

  • Users seeing old versions of the checkout page when they try to finish an order
  • Users seeing other users’ carts or finding strange items in their carts
  • Users seeing other users’ account info
  • Issues with WooCommerce checkout pages never loading

WooCommerce logoThese problems can cause your customers to trust your site less as well as privacy issues. But it can be fixed easily by excluding dynamic pages from the cache. Note: some caching plugins automatically exclude cart and checkout pages for certain ecommerce plugins. Check your plugin’s documentation.

How to Disable Caching for WooCommerce in WP Rocket

WP Rocket is a popular commercial caching plugin for WordPress. It does automatically exclude the Cart, Checkout and Account pages automatically, but there are a few more things you need to do.

1. Go to the WP Rocket settings, Advanced Rules.

2. In the Never Cache Cookies section, add the following lines:

woocommerce_cart_hash
woocommerce_items_in_cart
wp_woocommerce_session_
woocommerce_recently_viewed
store_notice[noticeid]

3. Save the changes.

Cookies help track products in carts and power the ‘recently viewed’ widget – they need to stay dynamic as they change a lot.

This process should be simliar for different caching plugins.

How to Disable Caching for WooCommerce in Varnish

Varnish is a server-side tool that speeds up website loading as well as providing security protection. Part of its job is to temporarily store the content of your web pages (a cache), which will be served up when a user requests them rather than making a call on your host server (just like the plugin-based caches).

If you have access to the server settings, you can add the following WooCommerce exclusions to Varnish.

Pages/URLs:

\?add-to-cart=
\^/(cart|my-account/*|checkout|wc-api/*|addons|logout|lost-password|product/*|wp-admin|wp-login)
\/checkout/
\/my-account/

Cookies:

woocommerce_cart_hash
woocommerce_items_in_cart
wp_woocommerce_session_
woocommerce_recently_viewed
store_notice[notice id]

The Latest US Privacy Law News

by Leave a Comment

On April 28th, the Connecticut legislature passed its new Connecticut Data Privacy Act, which is now going before the governor. It’s based on the Colorado Privacy Act which became law in July 2021. Here are some key features of the Connecticut Act:

  • Consumer approval is required for managing sensitive data
  • Controllers have to allow consumers to later withdraw consent
  • Opt-out regulations are very strict
  • Childrens’ data privacy rights match California’s.

If passed, Connecticut will become the fifth state having passed broad consumer data privacy bills. The others are Colorado, California, Virginia and Utah. More on the new Act here.

Eleven other US states currently have privacy bills in progress:

  • Alaska
  • Louisiana
  • Massachusetts
  • Michigan
  • New Jersey
  • New York
  • North Carolina
  • Ohio
  • Pennsylvania
  • Rhode Island
  • Vermont

The importance of having a comprehensive, up-to-date privacy policy on US-based websites is at an all-time high. That’s why WP Minder offers our dynamic privacy policy/cookie policy tool for our Care Plan clients. Contact us for more information.

The Risky Business of Displaying Only the Best Reviews on Your Website

by Leave a Comment

Did you hear about the case the FTC (US Federal Trade Commission) brought against an online fashion shop called Fashion Nova in January 2022? It was the first case of its kind, alleging that the retailer was deceiving customers by only showing positive reviews on their site.

Fashion Nova settled the case for $4.2 million.

Learn more about what happened and why you should reconsider showing only those 5-star reviews on your website…

Using Backup Plugin UpdraftPlus? Upgrade It Now

by Leave a Comment

UpdraftPlus logoIf your WordPress website uses the popular UpdraftPlus backup plugin, you’ll want to read this…

UpdraftPlus is installed on over 3 million WordPress websites and is relied upon for securely backing up WordPress site files and databases, which contain sensitive user data.

UpdraftPlus was found by a security researcher at WordPress parent company Automattic to have a ‘severe vulnerability’ that allowed hackers to download usernames and passwords.

Here is the announcement from UpdraftPlus from Feb. 17. They were on top of things, working to release the fixed version about a day after the problem was found and being transparent about reporting it.

WordPress took the unusual step of forcing auto-updates on installations that were still using the older versions of this plugin, but you do need to check your site anyway to make sure. Upgrade immediately if you find one of the older versions.

If you’re still using the following you’ll need to upgrade right away:

3 Common WordPress Vulnerabilities and How to Prevent Them

by Leave a Comment

WordPress is the most popular content management system (CMS) in the world, powering over 39% of all websites in 2021. But despite its increasing popularity, even long-time WordPress users are often unaware of common security issues that put their site at risk…

Three very common vulnerabilities of WordPress sites include:

  • Outdated plugins and themes
  • Abandoned plugins
  • Outdated WordPress core

A WordPress “vulnerability” is a flaw in the software (in plugins, themes, or WordPress itself) that makes your site more susceptible to attack. A WordPress vulnerability can allow an attacker to execute arbitrary code on your site or bypass authentications, which can lead to major data loss or site defacement

Vulnerabilities in WordPress can be exploited by attackers using a variety of techniques, including SQL injection (where a hacker tries to access a WordPress dashboard by injecting malicious queries into the SQL database) and cross-site scripting (where hackers upload malicious Javascript code to a site, usually designed to trick users into sharing sensitive data).

If you’re using WordPress, this post will teach you how to protect yourself against these very common problems. And thankfully, that’s pretty easy to do.

#1. Outdated Plugins and Themes – The Top Reason Sites Get Hacked

Research consistently shows that plugins are the main way that a site gets hacked – usually over 50% of all hacker entry points involve plugins. And Sucuri’s 2019 Hacked Website Report found that over 44% of sites they worked with had at least one vulnerable plugin.

And plugins are critical – the ability to add a huge array of features to your site with plugins is one of the things that makes WordPress so wonderful!

Yet many WordPress users don’t seem to realize that plugins and themes are actually software – just like software on your phone or computer – that has to be updated from time to time. The longer the plugin or theme has been around without an update, the more likely it’s going to have issues, either with security vulnerabilities or by no longer playing well with the newer version of WordPress on your site. You’re asking for trouble by avoiding updating plugins on your site.

What To Do About Outdated Plugins and Themes

Updates Available
Updates are available

Make it a habit to login to your WordPress dashboard at least once per week and check for any available updates to plugins and themes. Just run the available updates you see in your WordPress dashboard – that’s all you need to do (making sure that you have a fresh backup available first, especially if you’re running complex plugins like WooCommerce).

This is simple, rarely results in any problems with your site, and is one of the very best ways to protect your site. And if an update does cause a problem – that’s what backups are for.

For commercial plugins and themes, make sure you keep those licenses updated, otherwise you’ll lose the ability to update the plugin or theme (making your site more vulnerable to hackers) and miss out on bug fixes and new functionality.

Also make sure you’re using a security plugin on your site that provides malware scanning. Automated scanning is best because it can be set up to alert you when a problem is found so you can take care of it quickly. But a manual scan is also fine if you can remember to do it when you check for updates.

If eventually you no longer need a plugin, deactivate it and remove it. Keeping an unused plugin on the website is still providing a potential entry point for malware.

A Special Word About Updating Themes

In my experience, once in a while I’ll run across a client’s site where the theme is wayyyy outdated. That’s a warning sign, and typically shows up where the site’s developer did not properly use a child theme for modifications and the site’s owner was either told not to update it or is prevented from updating it by a code change. If changes were made directly to a purchased commercial theme, it can’t be updated without losing all those modifications, and that’s bad news.

If you’re in that situation, unfortunately you really need a new, correctly-built theme for your site. The longer you wait, the more risk you’re taking on that the site could be a target of hackers or will stop working well with the current version of WordPress.

#2. Abandoned Plugins

An abandoned plugin is one where the developers no longer actively maintain it and haven’t made any changes to it in over 2 years. That means it’s not tested for compatibility with current versions of WordPress, and is also not checked for bugs. If problems have been found, they haven’t been fixed.

The longer the plugin has been around without an update, the more likely it’s going to have issues, either with security or by no longer playing well with the rest of your site causing it to break or behave oddly.

Having these on a site makes me uncomfortable, because I know it puts the entire site at risk, and it’s an unnecessary risk!

There are some very popular abandoned plugins that used to be go-to’s that are still installed on hundreds or thousands of websites. For example, the WordPress plugin called Limit Login Attempts was great in its time. It helped prevent Brute Force attacks, where the hacker would try random username/password combinations until they found the right one.

However, Limit Login Attempts hasn’t been updated by its developer in over 9 years. It’s still installed in over 800,000 WordPress sites! That’s a potentially big problem waiting to happen.

What To Do About Abandoned Plugins

The View Details block
For plugins, this is the View Details block.

For plugins that you notice haven’t had an update in quite a long time, go to the Plugins page of your site. Under each plugin you’ll usually see a ‘View Details’ link in the Description section. Click it and it will show you when the plugin was last updated and WordPress version compatibility. If a plugin hasn’t been updated in the last 2 years, it’s a good idea to begin looking for a replacement (or if you no longer need it, just remove it).

Fortunately, it’s usually pretty easy to find a replacement that does what your old plugin does if you still need that functionality. Just be careful to check your site once you replace a plugin to make sure that it’s working correctly. That goes for removal too – check your site after removing an unneeded plugin.

 

#3. Not Keeping your WordPress Installation Updated to the Latest Version

When you have a WordPress site, you quickly learn that WordPress gets updated a lot. A major WordPress update may happen a few times per year, and it’s always a little bit scary because they usually involve some significant changes. Minor updates happen much more frequently.

The good news is, WordPress core is typically much more secure today than the plugins which are created mostly by third-parties, and successful attacks on WordPress core are quickly fixed by patches. That’s why there are so many updates to core. WordPress core has gotten more secure (less reported security issues) in every major version.

You should always use the latest version of WordPress because it will include the latest round of security fixes, as well as any new features. The latest version also tends to have some performance improvements.

What To Do About Outdated WordPress Core Files

The answer is simple, and the same as for outdated plugins and themes. Make it a habit to visit your WordPress dashboard at least once per week and check for updates. Before you click that update button, be sure you have fresh backup in place.

For the major updates (like 5.4, 5.5, 5.8) I typically wait about a week. There are always bugs associated with these big updates and it’s better to give it time to have these problems fixed before doing the update on your own website.

Especially if you haven’t updated WordPress in a while, make sure you have a fresh backup first, and check your site for any problems after the update.

Conclusion

In this post, we’ve gone over three very common WordPress vulnerabilities and how you can protect your site and your customers against them. If you’re using WordPress for your website, it’s more important than ever to make sure your site is secure!

And don’t forget that it’s critical to have a regular backup of your site stored safely away from your hosting account. Having that fresh backup can save the day – not having it can cause a catastrophe if something happens to your website.

How We Help You

WP Minder’s daily WordPress vulnerability checks help us stay on top of any plugin, theme or WordPress problems that arise on your site. They are just part of the comprehensive security measures we put in place for our Care Plan clients – and that includes redundant offsite backups made daily so we always have a fresh copy of your site in case disaster strikes. We also fix issues that may arise as a result of an update at no charge.

To see which WordPress Care Plan would be the best fit for your site, take our 5-question quiz.