I’ve been reading a number of rather aggressively toned discussions against various web hosts in forums over the past few months.

I would like to take a bit of your time today to address some of the statements made against shared hosting companies and their responsibilities in resolving WordPress-related malware issues.

My background.
In case you don’t know what I do, I have over 15 years of experience in managing the security of web servers and cleaning hacked websites—I’m not just making this stuff up. I’ve lived this reality in real-time for over two decades.

To start…
Malware scanners are full of errors. One man’s malware may be another’s legitimate code.

Malware scanners are only as good as they are maintained and developed.

I see errors in malware reporting and in automated malware reports nearly every day.

Who’s responsible?
Before you say, “The host is responsible and they’re responsible for hackers hacking my site,” think again.

Callback to this later:
Reducing client support tickets is the highest goal of any successful hosting company

SiteGround (and other shared hosts)
With SiteGround, for example, they have industry-standard malware scanners and firewalls in place. And zero-day exploits are real.

No host or scanner can guard against what they don’t know

 
A few examples of recent plugin and theme exploits being actively exploited in the wild.
Suffice it to say, if the legitimate code within your theme is exploitable, your web host can do very little to prevent exploitation of those publicly accessible theme files/scripts:

Exploitable in early 2021:

• All Legacy Themes, including Rise, Ignition, and others Version < 2.0.0
  Thrive Apprentice Version < 2.3.9.4
  Thrive Architect Version < 2.6.7.4
  Thrive Comments Version < 1.4.15.3
  Thrive Dashboard Version < 2.3.9.3
  Thrive Headline Optimizer Version < 1.3.7.3
  Thrive Leads Version < 2.3.9.4
  Thrive Optimize Version < 1.4.13.3
  Thrive Quiz Builder Version < 2.3.9.4
  Thrive Themes Builder Version < 2.2.4
  Thrive Ultimatum Version < 2.3.9.4
• Elementor Website Builder
• WP Page Builder
• WP Super Cache

WordPress security?
That said, these past few months, there have been many more exploits discovered within a number of very popular plugins and themes.

So before you say, “My host sucks because they can’t stop hackers from hacking my exploitable theme” that’s simply a false assessment. And if you think that a host quarantining your themes files/scripts will solve the problem, then you are misunderstanding the concept of quarantine.

Quarantine that Sh**!
When I (your host) quarantine your hacked theme script/file, I am REMOVING the file from your account—pushing it off to a safe directory.

That means that I (your host) will likely bring your website down in the process by removing a file/script that your theme requires.

“Hosting company, you need to delete hacker scripting in my website files now!”
Another false belief. If you’ve attempted to use a security plugin to clean up a website and found it actually made the situation worst, then you know that one man’s malware may be another’s legitimate code.

And hackers are not always nice about how they insert their code into files—meaning that removing the “bad” code may actually further break the website (which was previously running without error).

The callback…
What is the goal of a successful hosting company?

Reducing client support tickets

And since quarantining every hacked file located on the server may result in unintentionally breaking client’s websites by removing files, what would you do if you were running said hosting company?

1. Remove “all” hacked files knowing it may break websites and dramatically increase support tickets (increasing perceived downtime and lost business as clients move out in anger over you, the host, breaking their website)?

2. Do your best to implement strong firewalls, malware scanning, and customer notification as soon as malware is located?

Paying more for website security (not a commercial—just a statement)?
Yes, there are a few hosts that do implement methods to reduce code injection into WordPress websites along with other security safeguards. If you don’t mind paying a lot more than $20 per month and you’re okay with certain hosting restrictions necessarily to implement those safeguards, then you always have pricier hosting options to choose from as well.

This discussion is about shared hosting, in the $5 to $20ish USD/month range.

Yes, you can always pay more for more security. But do you need to? (an article for the future)

#wordpress #malware #hackrepair #websitesecurity #sharedhosting