As of May 7th, WordPress’ content management system (CMS) has a brand-new set of security features which adds a higher level of protection lots of its users say they wanted years ago. These new provisions were added along with the official release of the updated WordPress 5.2, which came out on the same day.
The security provisions include support for the following: updates that are cryptographically-signed, modern cryptography library, a section for the backend of the admin panel for Site Health, as well protection for the dreaded White-Screen-of-Death (WSOD), which will allow website admins admission to the site’s backend if some sort of catastrophic PHP error occurs.
Since WordPress is loaded onto more than 33 percent of Internet websites, the new provisions are expected to ease website owners’ fears regarding cyber-attacks.
Updates that are Cryptographically-Signed
Perhaps the largest and most vital of the new security components is the one for the offline digital signature system on WordPress. Now, WordPress can sign update packages digitally using the new Ed25519 public-key signature system, which makes it possible for local installations to confirm the update is authentic prior to installing it.
This feature is a vital step for preventing cyber-attacks like a supply chain attack onto every WordPress website. Security companies have been warning WordPress users about this kind of threat for over 2 years.
According to Scott Arciszewski, who is the Chief Development Officer for Paragon Initiative Enterprises, prior to this WordPress update, all that was needed to be able to attack all the websites using WordPress was to hack into the WordPress update server. Arciszewski is one of the people who helped develop the security for the WordPress update system, as well as some of the other new security features.
He added that now that the new security update is in place, a cyber attacker would have to find a way to steal WordPress core development team’s signing key. Thus things are much more secure.
WordPress Acquires a More Modern Cryptographic Library
Another part of Arciszewski’s efforts to make WordPress more secure was to replace its old cryptographic library with one that is more modern and up to date. With the new update, WordPress’ CMS supports the Libsodium library for every type of cryptographic operation. Previous it used mcrypt, which is now gone.
Libsodium has been added to WordPress’ CMS source code. Another addition is the sodium_compat library, which acts like a polyfill to support older PHP servers which do not support Libsodium. This addition puts WordPress in the same company as other web development tools that already supported Libsodium natively such as Magento 2.3+, Joomla 3.8+ and PHP 7.2+.
Additionally, with this added to WordPress’ CMS core, now theme and plugin developers may begin to support it too.
For more information on that, WordPress theme and plugin developers can read more on using the new security feature in a blog post Arciszewski has published with info on how they can use Libsodium to replace older mcrypt cryptographic roles.
New Section for Site Health
Likely the first of these new security additions most users will notice is the new section for “Site Health” located in the Tools menu in the admin panel. It involves 2 pages, Site Health Info as well as Site Health Status.
The Site Health Status page runs several straightforward security checks and then delivers a report listing what it found, along with information on how to correct them. There are also other bundled tests and website owners and website developers may also design tests on their own in order to check the security on other parts of their WordPress websites.
The other page, Site Health Info, is exactly what it sounds like. It delivers lots of data on the site, along with server setup. It’s used for debugging or if server details must be shared with IT professionals due to required support services.
Information is given on the WordPress installation, as well as the primary server, any plugins or themes, and data on the file storage usage.
Servehappy Project
One of the other new security additions is the Servehappy project. This was supposed to have been added to WordPress 5.1, but got loaded in two parts instead. One was installed in WordPress 5.1 and the other in WordPress 5.2. The part in WordPress 5.1 gave users the ability to show a warning if a server was using PHP versions that were outdated.
WordPress 5.2 added protection for the dreaded ‘White Screen Of Death’ (WSOD), which is also called “Fatal error protection.” This works as a WordPress website “Safe Mode.”
The new feature can temporarily disable any theme or plugin if a PHP fatal error occurs. This then allows admins to get into their website’s backend so they can fix it.
It too was supposed to have been installed with WordPress 5.1, but got delayed when studies by security experts discovered a few possible scenarios where a hacker could have misused WSOD and actually been able to turn off a WordPress security feature and then attack WordPress websites all over the Internet.
Plans for the Future
These new updates don’t mean work has stopped on figuring out other ways to improve security on WordPress sites. Other plans in the works are things like Project Gossamer, which is planned to be released along with WordPress 5.4.
Project Gossamer is expected to port the exact system of code-signing which is used during main WordPress updates and make it a framework WordPress developers can employ for code-signing WordPress plugin and theme updates.