WordPress With A Future Focused On Security
Tags: development, security, wordpress, checksums
Published: 2018-02-05 19:40:46

---
title: "WordPress With A Future Focused On Security"
published: "true"
cover_image: "https://www.ndigitals.com/wp-content/uploads/2017/10/FqaybX9ZiOU.jpg"
tags: Development,Security,WordPress,checksums
canonical_url: "https://www.ndigitals.com/articles/wordpress-future-focused-security/"
---

As a member of the WordPress community for the past 10+ years I’ve seen the growth of WordPress and seen a steady backlash of concern for the security of the platform. As a technologist I’ve seen the world of security go from an afterthought to being the first question that is asked. However given the recent uncovering, by the&nbsp;[Wordfence](https://www.wordfence.com/)&nbsp;security plugin&nbsp;team, of the dubious activities by a WordPress plugin maintainer over the course of 4.5 years it’s very obvious that more focus on security is required by both the WordPress Core team and the community.

> [9 WordPress Plugins Targeted in Coordinated 4.5-Year Spam Campaign](https://www.wordfence.com/blog/2017/09/coordinated-plugin-spam/)

<iframe sandbox="allow-scripts" security="restricted" src="https://www.wordfence.com/blog/2017/09/coordinated-plugin-spam/embed/#?secret=xVMsNm4BJp" data-secret="xVMsNm4BJp" width="600" height="338" title="“9 WordPress Plugins Targeted in Coordinated 4.5-Year Spam Campaign” — Wordfence" frameborder="0" marginwidth="0" marginheight="0" scrolling="no"></iframe>

Given that I’m currently working on a new plugin, and I just listened to a recent&nbsp;[WP-Tonic](https://www.wp-tonic.com/)&nbsp;podcast discuss the subject, I couldn’t help but start to think about the future of WordPress security.

> [233 WP-Tonic Round Table Show “WordPress Hooks, Actions and Filters”](https://www.wp-tonic.com/podcast/233-wp-tonic-round-table-show-wordpress-hooks-actions-filters/)

<iframe sandbox="allow-scripts" security="restricted" src="https://www.wp-tonic.com/podcast/233-wp-tonic-round-table-show-wordpress-hooks-actions-filters/embed/#?secret=AAv3k2tAgh" data-secret="AAv3k2tAgh" width="600" height="338" title="“233 WP-Tonic Round Table Show “WordPress Hooks, Actions and Filters”” — WP-Tonic: WordPress Support &amp; Small Fixes" frameborder="0" marginwidth="0" marginheight="0" scrolling="no"></iframe>

My thoughts quickly went to the world of DevOps and Continuous Integration & Deployment. One of the major pieces of DevOps is automated testing. I could easily see a future where all plugins and themes wouldn’t be accepted to the repo without a testing suite to accompany it. Running the automated tests, and looking at the code coverage for those tests, could begin to shine a light security issues. I’d like to think that reading through the test suite would help a review team understand the intent of the developer(s). Also, it would seem that malicious attempts might be more easily be caught as well. Using something like code coverage could even help to classify plugins and themes by their “quality”. Sure this may seem to be a larger technical hurdle, writing a test suite, but in today’s development environments I see automated testing as no longer something that is optional.

I also saw&nbsp;[WP Tavern](https://wptavern.com)‘s article that WP-CLI is looking to expand their checksum security measures to plugins and themes.

> [New WP-CLI Project Aims to Extend Checksum Verification to Plugins and Themes](https://wptavern.com/new-wp-cli-project-aims-to-extend-checksum-verification-to-plugins-and-themes)

<iframe sandbox="allow-scripts" security="restricted" src="https://wptavern.com/new-wp-cli-project-aims-to-extend-checksum-verification-to-plugins-and-themes/embed#?secret=3uImDO2wF4" data-secret="3uImDO2wF4" width="600" height="338" title="“New WP-CLI Project Aims to Extend Checksum Verification to Plugins and Themes” — WordPress Tavern" frameborder="0" marginwidth="0" marginheight="0" scrolling="no"></iframe>

While this is something that is wildly used in the Open Source Software world there are many, like&nbsp;[Security Now](https://www.grc.com/securitynow.htm)‘s Steve Gibson, that see this practice as a&nbsp;[false sense of security](https://www.grc.com/sn/sn-630.htm)&nbsp;and one that can easily be falsified.

The post [WordPress With A Future Focused On Security](https://www.ndigitals.com/articles/wordpress-future-focused-security/) appeared first on [Nolte Digital Solutions](https://www.ndigitals.com).