Security

Avoid These 5 Common WordPress Attacks in 2019

Open source WordPress powers more than 30% of the World Wide Web. Users publish over 41 million new posts on 15.5 billion pages for 409 million viewers every month.

This enormous surface area makes it a prime target for hackers. In 2018, 90% of all breached CMS sites came from WordPress according to a recent report by Sucuri.
hacked-cmss.png
[Source]

In this post, we break down five of the most common WordPress attacks — and offer solutions to mitigate risk. (more…)

Protect Your Google Apps Login From Phishing Attacks

Following a series of Google Apps login phishing attacks (specifically on Google Docs) in 2017, Google made several improvements. At the time, while we welcomed Google taking steps to address the phishing problems, it caused issues for WordPress plugins.

Specifically, the updates made it challenging in cases where customer installation required individuals to create a Google Cloud project with their own OAuth 2.0 Client IDs.

To make things easier and safer for legitimate users who need to create Google applications, we recommended that Google:

  • Allow users to authenticate against an OAuth ID they created using the same account as the one being used to access the app.
  • Allow admins to whitelist specific ID/Secrets on their domain and also allow any regular Gmail account to whitelist for their own use.
  • Provide a simpler verification form, including clear and consistent wording (is a ‘project ID’ the alphanumeric string, or the integer?), plus no long text fields (‘the app needs calendar scopes in order to access the user’s calendar…’). There is no point checking the privacy policy for the app since it can be changed easily in the future and will presumably not be respected by phishers!
  • Provide a clearer error message where unverified apps encounter ‘Invalid Scope.’
  • Deliver documentation explaining the new verification processes they have rolled out.
  • Offer a more robust and selective solution than joining the ‘Risky’ Group (Google already confirmed to us they are aware this cannot be a permanent solution).

Since then, we have even more suggestions for WordPress users using Google Apps login to deter attackers.

(more…)

Set WordPress roles based on Organizational Unit Paths

[Image via Pexels]

A popular feature of Google Apps Login Enterprise version has always been the ability to specify role mapping rules – so that members of different Google Groups can have different WordPress roles assigned to them.

The only problem was that some companies didn’t have relevant Google Groups already set up (e.g., for marketing@mycompany.com to contain their Marketing team) but instead had their G Suite domain arranged around different Organizational Units to control access to various G Suite features.
(more…)

Allowing only some employee Groups to access your WordPress intranet

Cyber security image

[Image via Pexels]

Many customers use our Google Apps Login Enterprise version to restrict access to their WordPress intranet so that not only should it be inaccessible to non-employees, but certain groups of employees should have different WordPress roles, and perhaps some employees should not have access at all.

Why is this so important? In the past, employees worked on-premises, and it was easier to monitor who was working on certain documents and data sets at a given time. For example, if a project was in a draft stage — and not ready for the eyes of senior staff or outside consultants — an employee could hold the file on his or her desk until it was finalized. There were few ways for others to access the file short of stealing the physical copy.

Yet in today’s flexible working environment, employees are constantly logging in to work on projects from different locations and time zones. They might have separate sets of credentials after re-setting their password or for use on multiple devices. It’s much more complicated to confirm who is accessing and editing documents than when employees worked in the same physical space. If you’re trying to keep certain information privileged, tightening access measures can provide an extra security in this opaque environment.

In this post, we’ll break down how we’ve made permissions for users easier for admins to control.

Configuration Steps for Enhanced WordPress Security

 

 

For your sales team’s intranet, maybe you want things to work like this:

Members of the Google Group management@mycompany.com should be Administrators.
Members of the Google Group sales@mycompany.com should be Contributors.
All other members of mycompany.com should be barred (as should non-employees and anyone who is not logged-in).

We’ve recently made this easier by combining improvements to the Enterprise product (version 2.8.2) and also our free All-In-One Intranet plugin.

Here we talk through the key configuration steps required.

Install your Google Apps Login Enterprise version and configure as directed – follow the instructions in Settings -> Google Apps Login, including setting up a Service Account.

You’ll also need to install All-In-One Intranet. Since that is available in the WordPress directory, the easiest thing will be to go to the Plugins page in your WordPress admin panel, click Add New, and then search for ‘All-In-One Intranet.’

There are quite a few steps required to configure Google Apps Login, so below we are just showing the screenshot of the Domain Control tab in Settings -> Google Apps Login from your WordPress admin panel, so you can see how to set up rules for the different Google Groups. You’ll also want to set the Default Role to ‘No Access’ to ensure non-employees, and those members of staff who aren’t in sales or management, won’t have access to the site.

At this stage, staff members should be able to use the Login with Google button on your WordPress login page to access the site. If they should have ‘No Access,’ then they won’t be able to do much in the admin panel, but everyone will still be able to view the front end of your website. That’s because WordPress is set up for your site to be public by default (users only need to be logged in to access the admin area).

This is where All-In-One Intranet comes in. Go to Settings -> All-In-One Intranet, and check the box labeled ‘Force site to be entirely private.’

Now, logged-out users and ‘No Access’ users should be forbidden from viewing any part of the site!

The above assumes you have WordPress in its default mode – if you are running ‘Multisite WordPress,’ you have a lot more flexibility over access to your various subsites — but that is for another post.

Please contact us if you have any questions at all!

Is your WordPress installation secure?

Following the Heartbleed vulnerability affecting all of us on the web, security has been a big topic lately. Some of us even changed our years-old passwords, and maybe enabled 2-factor authentication on our email accounts… (2-factor is the system where you need a code generated by, say, your mobile phone as well as your regular password to login.)

So it seems that most of us survived, but given the wake-up call, we thought it would be a good time to remind you of some simple things you can do to ensure your WordPress installation is secure.
(more…)

Making the most of WordPress’ user system

How important is it to set up a comprehensive user hierarchy on your WordPress sites?

This article will explain the benefits of creating multiple users for your WordPress site and how understanding the different roles users can have will give you the control needed to allow others to create content, without risking control of the site itself. The article will also teach you to check your site configuration to understand if there are any backdoors that unwanted visitors could use to register, view private content, or make undesired changes to your site.

(more…)

Google Apps Login is trusted by thousands of organizations from small businesses to NASDAQ-listed companies and government organizations.

Users click their way through Login via Google (just one click after the first time)

Users click their way through Login via Google (just one click after the first time)


You can try it out by clicking below to auto-create a test account on this site! This will show you the basic Google login process.
Try out Google login

Logging in is only the start – Google Apps Login takes care of all your WordPress user management. Find out more here.

×