Security in the age of AI-discovered vulnerabilities

Web security has been in the news this week with coverage of the decade-old PHP vulnerabilities discovered by researchers using advanced AI to detect critical flaws. PHP is one of the most widely used programming languages on the web. Almost 70% of websites are estimated to use PHP, including WordPress, the CMS we use for most of our web builds. 

AI tools are making it much faster to find weaknesses in software. That helps security researchers spot and fix problems sooner, but the same tools are available to attackers. The window between a vulnerability being discovered and someone trying to exploit it is getting shorter, making the speed at which a site gets patched and what protects it in the meantime more important than ever. 

We were well aware of the issue and all of our affected sites were covered by additional security and then patched as soon as the PHP update was released. Security isn’t something we only think about when it’s in the news, it’s ingrained into our infrastructure and processes. Here’s how we protect the sites we build and maintain every day. 

Secure Hosting 

Our sites are hosted with WP Engine, a managed WordPress host that keeps server software and PHP up to date, so security patches are applied without waiting on us. WP Engine is ISO 27001:2022 certified and SOC 2 Type II compliant, both of which involve independent audits of its security controls. They also add protections like a built-in firewall and blocking known-risky plugins to keep your site secure. 

Cloudflare

On top of our hosting, we generally put sites behind Cloudflare. Its Web Application Firewall (WAF) filters out malicious traffic before it ever reaches the server, and it protects against Distributed Denial-of-Service (DDoS) attacks and abusive bots. When a new vulnerability is announced, firewall rules can often block attempts to exploit it while fixes are being rolled out, buying valuable time. During the most recent PHP vulnerability, Cloudflare rules were deployed as protective mitigations until the PHP patch was released. 

How we build and maintain sites

Good hosting is only part of the picture. Most WordPress security problems come from out-of-date plugins and themes, so how a site is built and maintained is vital to ensuring a website remains secure. Here are the ways we keep our sites secure: 

• Updates: We ensure any updates to our sites are applied within 14 days. We have an alert system with our server provider which flags any critical security updates, which are applied within a day. 
• Plugin choices: Where possible we keep plugin numbers low on sites. Any plugins we do use are well maintained and from reputable sources. Our server provider also provides a system scanner which flags and disables any plugins that expose a website to vulnerabilities. 
• Access: We follow the industry guidance on least-privilege user roles, ensure all admin accounts have two-factor authentication, and remove accounts people no longer need. 
• Backups: Daily backups are taken of all our sites. This means in a worst case scenario, we can quickly and easily revert your site to a clean backup. Backups are kept for 30 days, stored offsite and are encrypted in transit and at rest. 

Our own practices

Protecting your site also means protecting the access we hold to it. We store client credentials securely, use two-factor authentication on our own accounts, and limit access to the people who need it. Out of Place is Cyber Essentials certified, a UK government-backed scheme that independently checks our own security measures. 

What clients can do

Security works best as a partnership. A few simple habits on your side make a real difference

• Use a strong, unique password and turn on two-factor authentication for your WordPress login
• Let us know when staff leave so we can remove their access
• Tell us straight away if anything on your site looks unusual

No website can ever be 100% secure, but by layering protection at the hosting, network, build and team level, we make our clients’ sites a much harder target and can respond quickly when new threats appear. If you have questions about your site’s security, get in touch with our development team at digital[at]outofplace.studio.