Most WordPress pros still lack a breach recovery plan

Melapress, a maker of WordPress security plugins, surveyed 319 WordPress professionals and found that most had dealt with at least one known security incident. The respondents build and run WordPress sites for a living: agency staff, developers, designers, site owners and administrators.

Across the whole group, fewer than three in ten have a breach recovery plan. A recovery plan settles in advance who responds, where the clean backups are, and who needs to be told. Without one, those calls get made in the middle of an incident. Downtime was the most common result of an incident, reported by 68.4% of respondents who had been hit and described the impact.

Someone else often spots the problem

Among respondents who had an incident, the most common way they found out was that someone noticed the site behaving strangely. That someone might be a visitor, a customer, a colleague or an administrator, and by the time any of them notices, the problem may already be disrupting the site. Logging tools were the monitoring control that caught incidents most often, and hosting provider alerts and malware scanners caught incidents for others.

Late discovery tends to show up in the damage. When a search engine warning helped surface an incident, 46% of those incidents involved lost search rankings, compared with 14.5% of incidents found other ways. The warning probably does not cause the harm. Incidents that last long enough or do enough damage to catch a search engine’s eye have likely progressed further by the time they are found.

One ecommerce site owner found out through Google Search Console that traffic had cratered after a hack. “Unfortunately, the rankings never fully recovered,” the owner said.

Where to start

Researchers recommend creating the recovery plan before it is needed and testing it: who isolates the damaged systems, who restores the site, and who tells customers. A backup that has never been restored is an assumption until the day someone tries it.

Melapress also treats training as a core control, since content editors and administrators make choices that affect a site’s security too. The person who owns a site should know who receives security alerts, even when an agency or freelancer handles security.