via pluginvulnerabilities.com => original post link
When looking for security advice on WordPress websites, one of the problems you face is the number of affiliate marketers posing as your friend. One recent example we ran across of this involved a YouTuber, WPress Doctor. They released a 30 minute video that starts with the claim that “You can easily prevent your WordPress website from getting hacked.” A 30 minute video doesn’t exactly scream easy. Shortly after that they claim, if you watch the video you can make sure “your website is fully secured and you don’t have to worry again about hackers, ever again.” Easily preventing WordPress websites from getting hacked and being fully secure/never having to worry about hackers is not possible. There are some easy steps that can prevent a lot of hacks, but they won’t prevent all hacks, and even harder to do things won’t prevent all the hacks either.
What stood out more is that they were claiming that you can easily do that using the Solid Security plugin. As we noted in November, that is a plugin mainly focused on a non-existent threat. If you watch through the whole video, as we did, the host never shows the plugin actually stopping any hacks. Just this week, we released the results of our latest test to see if security plugins would protect against a vulnerability in another plugin, a major source of hacks. This time it involved a vulnerability of a type that hackers are known to exploit in of all things a security plugin. Five security plugins stopped the hack. Solid Security didn’t. In fact, it has never stopped an attack in our testing. That isn’t surprising since it doesn’t contain the capability to do that. [Read more]