We now tell you when your WordPress needs updating

Last week a customer wrote to say their WordPress site was sending visitors somewhere else. It was. Anyone opening the site from a phone was being bounced to a cooking site in another country, anyone on a laptop to a news site, and search engines were being shown the real pages so nothing looked wrong in Google. The site had been like that for over two weeks.

We found it, cleaned it, worked out how it got in, and then sat with the uncomfortable part: every signal we had said the site was healthy the whole time. The container was up. The database was fine. Our checks passed. The only people who knew were the visitors.

This post is about what we changed because of that. It is also, honestly, about the part we cannot change for you.

How it got in

Nothing clever. The site ran a learning management plugin that had not been updated in about a year, and it allowed anyone to register an account. Someone registered, used a known hole in the old plugin to upload a file they should not have been able to, and from there they had the run of the install. The whole thing, from first request to working backdoor, took six seconds. It was automated.

I am not going to name the plugin or describe the hole, because that helps exactly the wrong people and the fix is the same regardless: the current version does not have it. Keep reading for the part that matters.

What we changed on every WordPress we host

The attack needed three things to work. Each of them is now closed by default on every WordPress site on ZevCloud, existing sites included.

• Uploaded files can no longer run as code. Your uploads folder holds images and documents. It now refuses to execute anything that looks like a script, whatever a plugin let through. Every malicious file in this incident lived there; with this rule they would have been inert.

• The old remote-publishing interface is off. WordPress has an endpoint from the era of desktop blogging clients that almost nothing uses today and that gets hammered with password guesses on every site, all day. It is now blocked by default. If a plugin of yours genuinely needs it, support can switch it back on for your site.

• Editing plugin and theme code from inside WordPress is off. Installing and updating still work exactly as before. What is closed is the in-browser code editor, which is the first thing an intruder reaches for once they have a login. Developers who want it back can have it; most people never knew it was there.

None of this changes how you use your site. If you notice a difference at all, it will be that your login page gets quieter.

We now look at your site the way a visitor does

Every fifteen minutes, we open the homepage of every site we host three times: as a laptop browser, as a phone, and as a search engine crawler. We follow no redirects. If a human visitor is being sent to a different website, or if humans and crawlers are being shown different things, that is the signature of a hijacked install, and it raises an alarm on our side and an email to you within the quarter hour.

That is the check that would have caught this incident sixteen days earlier than it was caught. It now runs on every site, and it is the part of this work I am most relieved to have.

The thing that is yours to do, and how we help you do it

Here is the honest part. We can harden the server, we can watch the front door, we can back you up. We cannot update your plugins for you, because a plugin update can change how your site behaves and that is a decision only you can make. And outdated plugins are, by a wide margin, how WordPress sites get broken into.

So we made it impossible to not know. Once a week we check every plugin and theme on your site against the official directory. If anything has an update waiting, two things happen.

Your dashboard says so, on the site’s own page and in a notice at the top of every page until it is done. Each plugin is named with the version you have and the version that is waiting, next to a button that opens your WordPress admin.

And you get an email. Not every week, which would train you to ignore it, but when the list changes: a new update appears, or you clear them all. Updating takes a few minutes from Dashboard, then Updates, inside WordPress.

Alongside the updates, the same weekly check compares your site’s core files against WordPress’s own published checksums. If a file has been altered, our team sees it before you need to.

Backups, so there is somewhere to go back to

During this incident the question "can we just restore it to last Tuesday" had the wrong answer. Now every WordPress site on a paid plan is backed up every night, files and database together, and our team can put a site back to any night in the last week from the admin. A restore takes a snapshot of the current state first, so even the recovery is reversible.

This is a safety net, kept deliberately small. A fuller backup service, with longer history and your own restore button, is something we plan to offer across every service type later. For now, the net is there.

What we ask of you

• Update when we tell you. It is a few minutes and it closes the door this whole post is about.

• Be careful where plugins and themes come from. Premium themes passed around outside the official directory very often arrive with something extra inside. If you did not buy it from the author, assume it is not safe.

• Use a strong, unique password for every admin account, and turn on two-factor sign-in if your site supports it.

• Close registration if you do not need it. Settings, then General, then "Anyone can register". If your site is not a membership or learning site, that box should be off.

The customer in this story did nothing unusual. They set up a site, it worked, and they got on with their business. That is exactly what hosting is for. Our job is to make the default safe enough that getting on with your business is not a risk, and to tell you clearly, in your dashboard and your inbox, about the one thing we cannot do for you.

If you host WordPress with ZevCloud, all of this is already on. You can see it on your site’s page in the dashboard.