I gave this interview during #WCMIA2017 where I share 3 tips to keep your website secure! Enjoy!
El día de hoy, ha sido liberado WordPress 4.7.2 que es una versión que parcha 3 vulnerabilidades de seguridad de la versión anterior.
Descargar WordPress 4.7.2 en formato ZIP
Descargar WordPress 4.7.2 en formato TGZ
Para mayor información puedes leer las notas sobre esta versión:
https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
Y como siempre: ACTUALICEN, ACTUALICEN, ACTUALICEN!!!!
WordPress esta en 1 de cada 4 sitios web en internet. Es el CMS más usado del mundo, tiene miles de integraciones y un sin numero de diferentes temas y plugins, pero, a como todo en esta vida, no es perfecto.
Mi experiencia en Sucuri y compartiendo comentarios con amigos de SiteGround, he creado esta breve lista sobre 5 cosas que no me gustan sobre este CMS.
WordPress Core no trae bitácoras o logs sobre lo que pasa detrás del sitio. No podés saber quien entró al sitio, cuando, que cambios hizo; no podés saber cuantas veces intento entrar o cuantas veces ha pedido la contraseña. Desde mi punto de vista de SysAdmin es como manejar con una venda en los ojos, y no puedo determinar problemas sino tengo datos que analizar. Y confiar en los logs de Apache o NGINX no es suficiente.
WordPress te permite intentar logiarte y equivocarte de usuario y contraseña un sin número de veces. El ataque #1 que vemos en Sucuri son los ataques de fuerza bruta para intentar adivinar la contraseña de un usuario administrador del sitio. Y en mi limitada experiencia es una de las mayores razones de infección & inyección de SEO SPAM a las páginas administradas por WordPress.
La comunidad de WordPress hace un excelente trabajo revisando cada plugin & theme gratuito, debido a que son de código abierto y estos mismos tienen que apegarse a los standards de programación establecidos. Pero los plugins y themes premium no pasan por tal escrutinio y aunque se vean muy bien estéticamente, muchas veces son muy susceptibles a infecciones o inyecciones de código debido al descuido de sus autores.
Hasta Joomla y Magento traen un cache incluído en el core. Pero WordPress no, entonces cada petición, cada pageview son varias llamadas a la base de datos, desperdiciando CPU & Memoria.
Compartan sus comentarios en este artículo o en las redes sociales. Si les gustó por favor compartanlo y denle like en su red social favorita.
Siempre en los grupos de usuarios de WordPress no falta alguien que siempre pregunte:
¿Que hosting me recomiendan para mi sitio WordPress?
Luego siempre saltan los fanboys a recomendar el hosting que ellos usan sin antes tener datos que te permitan responder responsablemente la pregunta. Y muchas veces genera frustración en los usuarios cuando contratan un servicio que no era exactamente lo que estaban buscando.
Por eso me decidí a escribir este artículo, para todas esas personas que necesitan saber como escoger un hosting adecuado a sus necesidades y posibilidades.
Este artículo les va a realizar preguntas que ustedes deben de poder contestar, si alguna de las preguntas no las pueden contestar entonces les recomiendo que tomen tiempo primero para determinar la visión de su sitio web. Cosas que parecen tan tontas como visión, nicho de mercado, localidad del mercado objetivo, nivel de visitantes concurrentes, plan de contingencia y demás se vuelven importantes porque no todos los servicios ofrecen las mismas bondades. Por eso antes de empezar les sugiero que tengan ya bien definido que quieren hacer con su sitio web para poder garantizar el mejor funcionamiento posible.
Como ya deben de saber, WordPress está hecho en PHP y depende de una base de datos MySQL, por lo que el host debe de tener cualquiera de las siguientes configuraciones:
Servidor Web: Apache, NGINX, LiteSpeed o IIS.
Servidor Aplicativo: PHP o PHP-FPM.
Base de Datos: MySQL, MariaDB o Percona DB.
Ahora vamos a ver paso a paso lo que tenemos que saber para poder escoger un hosting.
Algunos me han preguntado en eventos: ¿que tiene que ver con el que tipo de hosting? Y la respuesta es sumamente sencilla. Si estás en Nicaragua o Costa Rica no vas a comprar un hosting que tenga los servidores en Australia o India, porque tendría impacto en la velocidad de carga del sitio web.
En el caso especifico de Nicaragua, que nuestro internet viene de USA, siempre lo mejor es buscar servidores que estén cerca de Miami, para poder así tener una ruta más corta hacia el mismo. Una elección popular es Dallas, luego New York y luego Miami. También vale la pena recalcar que algunos proveedores como Siteground tienen sus servidores en Chicago y Amazon Web Services en Virginia.
En el caso específico de Costa Rica, que cuenta con enlaces tanto a la costa este como a la costa oeste, podría agregar que Los Angeles, San Francisco & Oregon.
Siempre es bueno hacer un traceroute para poder determinar cual hosting es el que queda más cerca de nuestro mercado meta.
Muchos hosting limitan los recursos como CPU, procesos PHP, Memoria, consultas MySQL, etc. Por esto mismo es super importante que tengamos definido cuanta gente queremos que visiten nuestro sitio.
Analicemos Siteground como ejemplo, en su página de WordPress ellos anuncian 3 paquetes y te dicen un aproximado de visitantes que soporta cada plan. Esto es importante saber ya que hosting como HostGator, BlueHost, Site5 (todos pertenecen a EIG) tienen varias limitantes en la letra pequeña y por eso es que los costos so bajos. Los problemas de rendimiento ocurren luego del tercer visitante concurrente al sitio. Y no solo cuentan los visitantes que son personas, sino todos los bots, crawlers y scanners que a diaro visitan nuestros sitios sin que nos demos cuenta.
Si querés tener más de 5 visitantes al mismo tiempo y que tu sitio no pierda velocidad entonces hay que evitar cualquier plan de shared hosting. Una vez que definís que querés tener capacidad de recibir más visitantes entonces hay que usar un servidor dedicado.
En el caso específico de SiteGround, ellos ofrecen dos tipos de servidores dedicados: servidor en la nube o servidor dedicado. El servidor en la nube es sencillamente un contenedor/servidor virtual que convive en el mismo hardware que otros servidores y que puede ser movido a otro hardware con facilidad sin perder ninguna información. El servidor dedicado, por otra parte, significa que es un hardware dedicado a tu cuenta y que no hay otros sitios en el, sino que todos los recursos son unicamente tuyos. Por motivos de escalabilidad y flexibilidad recomiendo los servidores en nube, por que asi se puede escalar hacia arriba cuando vamos a esperar algun pico en el trafico debido a alguna oferta o alguna estrategia de marketing activa. Y te permite luego bajar a un servidor con menos recursos una vez este exceso de trafico haya bajado. Te ayuda principalmente a disminuir costos. El caso del servidor dedicado, para un upgrade toma más tiempo porque hay que migrar tu sitio a un servidor nuevo, que tenga mas capacidad entonces esto lleva mucho mas tiempo que el simple redimensionamiento de un servidor en la nube.
Otro caso similar es WPEngine, quien es un proveedor de sitio que únicamente ofrece el servicio de Alojamiento de WordPress Administrado. Ellos te ofrecen servicios extras dentro del precio mensual: certificados SSL gratuitos y remoción de malware via Sucuri.net incluído dentro del precio mensual. Ellos en cada plan te muestran más o menos cuanto tráfico soporta cada plan, pero tomen nota que esto es un aproximado nada más. Con ellos igual se puede ir subiendo de plan a medida de que aumenta o disminuye el trafico. Este es un servicio más orientado a empresas que necesitan altos niveles tanto de rendimiento como de soporte y por eso el costo es más alto, pero es super recomendado si tienen el presupuesto.
Esta pregunta es una que muy pocas personas se hacen. Servicios como SiteGround & WPEngine son servicios completamente administrados donde el personal de la compañía se encarga de la administración del servidor, actualizaciones, parches de seguridad, logs, backups, etc. El usuario nunca llega a tener acceso administrativo o de super usuario al servidor.
En el caso intermedio podemos ubicar a KnownHost, que es un proveedor que te ofrece un servicio administrado, pero que si te dan acceso a nivel de administrador al servidor bajo ciertos lineamientos. Ellos te ofrecen 3 tipos de planes: Servidores Dedicados, Servidores VPS (cloud) & Servidores VPS con SSD.
Y finalmente en el caso de que quieras administrar tu mismo el servidor: instalar, configurar, actualizaciones, parches, problemas de memoria, etc, entonces te puedo recomendar darte una vuelta por Digital Ocean y probar con un dVPS de USD5 al mes. Usa este link y Digital Ocean te va a regalar USD 10 en saldo para poder probar el VPS gratis por 2 meses. Lo bueno es que es super flexible ya que tu mismo puedes armar el stack que quieras: LEMP, LAMP, etc. Lo malo es que necesitas mucho conocimiento y tiempo para poder configurar las cosas y hacer el troubleshooting cuando algo salga mal.
Vale la pena comentar que Digital Ocean cuenta con un servicio de backup bastante bueno pero que tiene un costo extra. Es muy buena idea usarlo en vez de usar plugins de backup de WordPress ya que le quitamos peso al aplicativo y todo lo hace el proveedor a nivel externo sin impactar CPU o Memoria de tu VPS.
Next week, I set sail to the #BlogsNI, which is Nicaragua’s Blogs Festival. An event oriented to talk about the local nicaraguan blogosphere, a review of the past, present and future. The event will hold different local experts from Social Communication, Marketing and Technology,
I was invited by the organizers to participate on the event on the technology side of things. After all I’m an IT guy that loves teaching about WordPress. I will represent Sucuri (talk to me if you need help with WordPress & Website Security) and I will be giving a talk about WordPress and e-Commerce and I will give a WorkShop about Advanced WordPress. Below is the full agenda and the banner for my workshop.
Join my workshop if you want to learn further about WordPress!
More info on the event:
When:
Where:
Universidad Centro Americana. UCA. Managua, Nicaragua.
Facebook Page: https://www.facebook.com/FestivalBlogsNicaragua
Facebook Event: https://www.facebook.com/events/646689258837645/
Be sure to contact me if you want to setup some time to talk!
Cheers!
First I must admit that I love that as part of my job in Sucuri I get to assist to WordPress events like WordCamps. I had the opportunity to assist the first WP Campus in Sarasota, Florida. This event was for all the Universities and other Higher Education entities that use WordPress on their campus for their websites. It was pretty cool to see all the talks from Developers from 10up, Modern Tribe, Lynda.com, WP Engine, Pantheon and other companies which made the event possible.
This year, I met the organizer of the Costa Rica WordPress group , Roberto Remedios, and I had the opportunity to give a talk remotely to their group, and after that I realized that he was organizing the WordCamp San Jose, Costa Rica 2016 and I offered my assistance as a volunteer and to speak at the event.
As a Nicaraguan, I’m truly excited to have a WordCamp in Central America. We did hold a WordCamp here in Nicaragua in 2014 and also in 2013, and we will he hosting a DrupalCon as well on Nicaragua this year, but I don’t have much details for now, but I will make a post as soon as I get all the inside scoop.
This year we are trying to push for at least a monthly meetup in our Managua WordPress Group, and we have had a good discipline and have held all the following meetups:
And this month we will held another, to keep meeting and sharing good practices and cool new tricks about WordPress, come and join us: http://www.meetup.com/Managua-WordPress-Meetup/events/233562086/
The ultimate goal, for us as a group/community is to hold a WordCamp next year, so we do not compete with Costa Rica for speakers or sponsors. So we are meeting regularly and have started the talk about who would volunteer to help organize such event in Nicaragua, so we can plan ahead, and have a great event as well as a good attendance from other Central American countries like Guatemala, El Salvador and Honduras.
If you would like to help organize, speak or sponsor our event, you can contact me, or go to our MeetUp page and click on contact: http://www.meetup.com/Managua-WordPress-Meetup/
We are going to try to push for WordCamp Nicaragua, WordCamp Costa Rica and then WordCamp El Salvador, and hopefully in 2018, hold our very first WordCamp CentralAmerica, were we can gather as a region instead of separate small countries so we can have a higher traction in assistance and sponsorship!
If you are from Guatemala or Honduras, and need help on setting up your WordPress community or want to be part of the WordCamp CentralAmerica, ping me on twitter or email me. I will be cool to gather as one!
I look forward to your comments!
WARNING: This is a rant. Read at your own discretion!
For the past 5 years my work has been focusing on WordPress, started a web development agency, then worked for mexican integrator, then moved to the web hosting world and now, at I work at a website security company called Sucuri.net.
It’s been a great ride and have managed to see several aspects from WordPress users, I have seen the n00bs, I have helped developers, I’ve crashed my head against the wall while working with Marketers and I have shouted to my computer while working with website owners who don’t want to do anything, but have everything fixed at the point of a click.
I wanted to write a fun article about the frustrations of providing support to WordPress users and below are some of the things I’ve learned:
WordPress is pretty well documented, any bug, issue can easily be resolved by doing a search on any search engine. But no, WordPress users rather call (wait online on hold music), email (expecting a response within 5 seconds after sending it) or chat (expecting the rep to solve everything with a single click).
In any of my previous jobs, I would get the customer email/ticket/chat, and I would try go gather as much information from the issue before start troubleshooting. Then I would check what the problem is, try to replicate myself, then analyze what might be causing it. If I was not very familiar with the issue a quick search online would be enough to find the issue. I would try to apply the patch/change suggested and if it would work would give the article to the customer for them to read and understand what happened. I would also provide a link with my suggestions on how to avoid the issue from happening. But the customer would come back a few days/weeks/months with the exact same problem, claiming the last person he talked to said it was solved but is still happening. Facepalm.
People sometimes don’t read, even when you ask them to because it would save them time and it would avoid them being hacked. But they do not read and do not want to be told to read. It worries me because I am a self taught IT guy, I love learning and trying stuff; I’m the kind of guy who can learn programming from YouTube or reading a book and hacking his way into things. It is so sad that some website owners can read entire books of marketing, Improve your SEO on Google and Pay Per Click Advertising, but they neglect to read a single page that will help them on protecting their brand, reputation and website.
If you are one of those, please, I beg you, read the links that your web advisor, web developer, security analyst, web hosting provider sent. And if you do not understand ask questions. We are here to help you, but we can’t do everything for you. Please help me so I can help you.
You can see that by the amount of websites that get blacklisted on Google each week. People just have websites done, they only care about being flashy, nice and have information there. I have not seen a customer on my web developer experience to ask about having a website secure and protected by hackers. They just don’t. You installed WordPress 4 years ago, and is working but suddenly, you have VIAGRA ads on your website and you see that a new administrator user has been added. You then get a call from a provider saying that they get a warning when they try to access your website. You then panick! You open Chrome and try to visit the website, and you too get the warning. You don’t know what is going on. You try to login to your WordPress using admin and 12345 as password and you see lots of pages and blog posts that you have not added. It is until then when you start thinking about security.
That story happens very often, it even happened to a colleague of mine in Sucuri. And it is until we make the mistake that we realize how easy was to take us down, and how easy would have been to prevent this from happening. You do not have to be a web expert or a security ninja to be able to have security put in place. You can opt for services like Sucuri, that provide a managed security service to protect your website. That way you can focus on your business and we will manage security and let you know of any issue that we see that requires your attention.
Visit Sucuri.net for more info!
Customers pretty much just needs something that works and does the job. They don’t care if its WordPress or Joomla or Drupal. They don’t. They will trust the web agency or web advisor doing the work. Plus they would probably do a search online. They do not know about security, so it is the responsibility of the person or company doing their website to provide the proper guidance. Most of the cases they would choose WordPress over Drupal merely due to cost. They want the most BANG for the buck. And we can all relate to this.
However after the website is done, the customer must be advised that he needs to do maintenance to his website, which is just like a car, that needs some tune up to keep it working well, having all security updates in place to correct any vulnerability and make sure that his SEO and brand reputation is not harmed.
While working at Site5, I faced many customers that were angry because we didn’t stop the hackers from defacing his website. Which is funny to me and the perfect analogy I gave them, is like complaining to your land lord who rented you that house, when burglars break in and steal your stuff. Web hosting providers are responsible for the security of the servers, not for the security of the applications. They protect their servers from being accessed on their core, not on user accounts. I remember when Site5 started blocking IPs of people trying to access several times with the wrong FTP passwords, we had tidal waves of complains and just 1% of people really appreciated the security measure imposed.
In Sucuri, is a different story, people come with actual problems, websites infected with malware, hacked, or blacklisted and we need to help them. I work with customers and the first thing I need to clean a site is access to the website files, but many people do not know what an FTP account is and we provide them an explanation, and offer them to possibility of reading a tutorial on how to get the FTP account, or to simple give over his web hosting account login details so we can figure out the rest. At least 80% of the times, they would give you their web hosting account details, with the same passwords, and they do not change it after we use it. Which is very dangerous.
Once I am in, I have problem because some scripts are really really old, and they have tons of vulnerabilities, but upgrading them it causes hell, because it breaks plugins and themes, leaving most of the times the websites with the dreaded white screen of death. So I have to be careful about removing the infection. Reinstalling the specific WordPress version to make sure that we have clean core files. And finally checking the plugins and themes to advise which really need an update.
From time to time, cleaning malware breaks the functionality of a plugin or a feature of the website that I honestly overlook, and people come back reporting that, as a precaution we always take backups of everything we modify, so we can always roll back. Although there are very very rate times when the site was so infected and corrupted that the only choice is to update everything and we suggest to work with a developer or rebuilding the site and provide several suggestions on how to avoid this from happening again.
I try to do my best always, but sometimes, that is not enough. People whose website I’ve cleaned, do not read the suggestions, and get reinfected, and I am the one to blame for not doing my job right. Its like going to a physician because you had a cold after jogging under the rain, and after getting cured, go jogging under the rain again and then complain and blame the physician. We helped you, we cleaned the site, we told you how to avoid this from happening again. You didn’t listen or didn’t care and now we are to blame. But not worry, we will AGAIN, clean your site and AGAIN provide the suggestions hoping this time you will follow them.
These are a few of the things I’ve learned from working with people who have WordPress website around the world. Some have made me laugh, some have annoyed me at first, but from both I’ve learned and adapted my feedback to them so they can be better protected.
If you want to talk more about this, invite me for a beer and let’s hangout!
On May, I had the opportunity to participate on Desarrolladores WordPress Nicaragua (You can find them facebook & meetup ) monthly meetup.
Both my business partner and co-founder of SenorCoders.com and myself gave talks. While I talked about How Websites get Hacked, Kharron talked about Developing a Mobile App using WordPress as the backend.
My presentation was based out of the work that I do each day as part of the Remediation team in Sucuri. You can find my presentation here:
Special thanks to:
