Every Website Is Valuable to a Hacker: Kathy Zant on WordPress Security for Small Businesses

Robert Abela: Hello, and thanks for joining today’s Melapress Show podcast. A few housekeeping issues before we start. We are working on the new UI for WP Activity Log. It will be very similar in terms of branding to the one we have for WP 2FA. However, considering how big WP Activity Log is, it’s a big change, so we are looking for beta testers. If you want to give it a run, just send us an email at [email protected], and we’ll get in touch and send you a beta copy.

Also, just a few days ago we released the early WordPress Security Survey results. Head to melapress.com to see the results. We gathered these from a number of sources, including people at WordCamp, but also from a few sources online, and there’s a lot of good information there to get a better idea of what people are using to keep their websites secure.

Since we’re talking about security, it’s only fitting to have someone with me to talk about security. She’s a well-known figure in the WordPress security community, has worked with Wordfence and Solid Security, and also spoke at WordCamp US earlier this year, so make sure you check out her talk on WordPress.tv. With me today, I have Kathy. How are you, Kathy?

Kathy Zant: I’m doing really well. Thanks for having me, Robert.

Robert Abela: You’re welcome, nice to have you. As I said, I’ve been working in security for a long time, and you have a very familiar face, but for those who don’t know you, can you give us a brief introduction of who you are and how you started working with WordPress?

Kathy Zant: Yeah, well, I started working with WordPress. I have a version 2.0.1 backup on my hard drive, so I’ve been poking at WordPress for many, many years. But I only really got involved in the community and working in WordPress about nine years ago, and started going to all the WordCamps, really focused on education and empowerment. Because you can have all the security tools, but if you don’t know how to use them… I felt like it was really important to empower people so that they’re not afraid of hackers, and that they have the tools to know how to use them and make good security decisions. So I leaned really strongly into that.

Robert Abela: Good, that’s actually a very good point. In fact, in my talk at WordCamp I also spoke about this, we were talking about session hijacking, and my conclusion was that we have a lot of tools, a lot of things going on, but it all depends on the human. If the user makes a mistake, clicks that link by mistake, whatever, which we’ll all do, by the way.

Kathy Zant: Yeah, this is the problem.

Robert Abela: So I like your approach, that’s what you focus on – education – for that specific reason. Let’s dive right into it. Based on your years of experience working with several security companies, what are, to this day, the most common security issues WordPress users have to deal with?

Kathy Zant: Yeah, it’s kind of all over the place. Historically speaking, we’ve seen tons of plugins with vulnerabilities, much more than core, but it’s about getting things updated, making sure things are updated, paying attention to the security reports, staying on top of maintenance, that’s historically been a problem. But over the past few years, that session hijacking issue you talked about has become, I think, more prevalent. WordPress is uniquely vulnerable to that with the longer session times, you know, I always click “remember me,” I always want that longer session. And when you’re logging in and you click “remember me,” it’s storing a cookie on your browser so you have that longer session. 

Because of that, WordPress has a unique problem. Banks are aware that this is an issue: you log into your bank, go get a cup of coffee, come back, and automatically you’re logged out. WordPress users are more vulnerable because of those longer sessions. So it’s definitely more of a problem now than it was years ago.

But it all comes back to: if you’re a company and you have WordPress, and you’re managing users who use WordPress, you need good rules, good governance, good policies and procedures. Because it’s not WordPress that’s the problem, historically, it’s what you’re doing with WordPress. I used to joke, “WordPress can help anyone publish online.” No, WordPress can help anyone publish online, because it’s that double-edged sword of having power, and that power requires greater responsibility.

Robert Abela: Nice. And you mentioned a few good points, let me start with this. A few weeks ago we were at WordCamp US, we met each other there, and I’ve been to a few other WordCamps before. There’s a variety of users, you have beginners, someone who has their own website, maybe a small shop, but you also have businesses. Most people who run a business website are more aware, but let’s say the average baker has one website. They might tell you, “hackers aren’t interested in my small website.” What’s your answer to that?

Kathy Zant: Every website is valuable to a hacker. Think about the New York Times, a major publication in the United States. They use WordPress, and they also have a security operations team looking at every request coming in. They have better tools to look at everything coming in. But hackers understand economies of scale. If they can get into a hundred WordPress sites that don’t have any security on them, that aren’t protected, that don’t have good rules and tools to secure the site, that can be just as effective. A lot of them build up a cache of a hundred hacked sites, then set up a command-and-control center with code so everything can talk, and then further their attacks.

Every site has resources. It’s on a hosting provider, it’s on a server, and that server has resources. It can send out spam. It can redirect people to malware that installs on their computers. Or it can just be a backdoor used in a command-and-control operation. It doesn’t matter how high-profile your site or your business is, or how much traffic you’re getting; the resources and capabilities of your site are just as valuable to an attacker.

Robert Abela: Very good explanation. Just to add to what you said, attackers aren’t after your brand, most probably. They’re after the resources of your website. What do you think, nowadays, especially with AI connectors? Let’s say someone has an API key with unlimited funds attached.

Kathy Zant: It’s like finding a nugget of gold in the mud. It can be extremely valuable. We’ve seen stories, even before AI connectors came out, of connection keys being exposed in GitHub repositories, and hackers taking those and using the resources of the AI tools to do all sorts of things, running up huge bills for the owner of that key. That key, in WordPress, with the connector, if you’re connecting your WordPress site to your AI tool of choice, that connection key isn’t encrypted in the database. It’s just sitting there. So you need a strong wall to protect that nugget of gold, because it can be compromised. If it’s compromised, it can run up a bill. If you’re connecting something to AI, I was playing with that yesterday and having so much fun with it, it’s extremely powerful, but make sure you’re putting some caps on your spend with your AI tool, and make sure you’re protecting the site, because your site has become more valuable.

Robert Abela: Very good point. You mentioned before, you said it twice, “yes, WordPress allows everyone to publish on the internet,” but also, “oh no, WordPress allows everyone to publish on the internet.” Which I agree with, because setting up a website is easy. However, if you don’t have experience, you don’t know what it takes to keep your website secure for one year, two years, especially as you add more functionality. Is it fair to say that securing a modern website has become too much for the average, less technical user?

Kathy Zant: I don’t think so, because I believe all of us have become digital citizens. You’re a citizen of your home, where you live in a town, and it’s good to keep your doors locked, but you’re also a digital citizen. You’re participating online, whether it’s social media, watching Shorts on YouTube or TikTok, whatever you’re doing, you’re a digital citizen. The same rules for protecting your assets in the real world need to apply everywhere. I don’t think securing a website is too hard, but I do think everyone needs to up-level their education and empowerment, not just for their website but for everything else, too.

I’ve consulted with companies not just on cleaning up WordPress, but with people who’ve had their Amazon accounts taken over, people who’ve lost access to their social media accounts and needed help getting them back. We’re digital citizens, so it’s not just about WordPress, it’s not just about a website, it’s your email, your banking, everything. WordPress is just another thing that fits under that umbrella.

Robert Abela: Very good point. Again, referring to my talk, that’s something I mentioned too, that even if, let’s say, you have an e-commerce website and a hacker manages to hijack a customer account, people think that sounds apocalyptic or exaggerated. But the reality is, as you said, this isn’t just about WordPress; it’s your online banking, your finances, your digital IDs, all of that. People need to have the same mindset for digital security that they have for their physical home.

Kathy Zant: Right, and security always comes after something. One of the reasons I love security is because hackers are so creative, they’re like little kids discovering a new way of doing things, but security always comes after that. I remember when I was coding a lot, starting in the ’90s, SQL injection didn’t exist yet as a known attack. I’m old enough to remember when SQL injection became something we needed to protect against. Before that, nobody was sanitizing their input, because hackers hadn’t yet discovered that way of working around the system.

The way we’re all online now just requires us to secure everything, especially phone security. That’s something that scares people a lot, with SIM-swapping attacks. I went deep on that and did a whole YouTube video on it a few years ago, because I was starting to see high-profile people lose access to their phones. That’s when someone can social-engineer your phone provider, your AT&T, your Verizon, and get your SIM ID reassigned to a different phone. Then they can basically take over everything: all your 2FA codes, all your phone codes, resetting passwords on your email account. They can take over your life. Hackers are just so creative, so it requires us to be aware of what they’re doing, appreciate it, in a way, and not be afraid of it. It’s a cat-and-mouse game, and we have to keep stepping up our game as hackers find new ways in. I’ve been watching a lot of stuff on prompt injection with AI and all the things people are discovering can be done. Because it’s new technology, innovation happens, then hackers show up and find a way to break things, and we have to find a way to secure things. That’s just how security works.

Robert Abela: Indeed, very interesting. I’ve seen some examples of prompt injection myself. Do you mind explaining to the listeners what prompt injection is?

Kathy Zant: Sure. A prompt – you open your AI tool, there’s a little box, and you type in your question or give it an instruction. That’s a prompt. A prompt injection is a way of adding further information into that without your knowledge. Some of the creative ways I’ve seen: images that actually have data embedded in them that instructs the AI tool to do something malicious or expose information. I went down a rabbit hole looking at AI “skills”, there’s a skills repository, much like the WordPress plugin repository, where you can give your AI agent additional skills to do different things. And I’ve seen alt tags on images in GitHub repos linked into that skills repository that are actually prompt injections. So it’s giving further information to your AI tool that you’re not intending, it can be in a document, a link, a skill, a lot of different places. And there’s no real, solid wall against prompt injection. There are some guardrails, some things we can do to protect ourselves when working with AI, but there’s no hardcore solution to it yet.

Robert Abela: Yeah, it’s a very broad problem. SQL injection is comparatively easy to solve, you sanitize the queries and the user input. But with prompt injection, I’ve seen some interesting ones. You don’t even need to go as advanced as images, especially against private AI, like chatbots on websites connected to your own private data source. People ask certain questions and manage to retrieve information about the site’s clients, maybe payment details.

Kathy Zant: Yeah, it’s very interesting. I saw one, in Gmail, there’s an AI tool that can summarize your emails if you enable it. And I’ve seen emails come in using the old trick from Black Hat SEO days, where they’d put white text on a white background packed with SEO keywords. People are doing that with prompt injections now, hiding text like “your Google password has been exposed, please call this number” inside emails, so when the AI summarizes it, that’s what gets surfaced.

Robert Abela: So you send an email to someone, and then Google summarizes that email with AI, and that’s what comes through. It reminds me of something more primitive, back in the early Gmail days, around 2004, they started showing ads based on the content of the email. So if you used certain words, like “firearms,” it wouldn’t show any ads. People would send a normal email, then add a line at the bottom with words like “firearms, violence,” whatever, just to avoid ads. 

It’s the same idea, and it applies to SMS too. By the way, Microsoft and some other vendors are moving away from SMS by 2027, any type of authentication is going toward passkeys and similar methods. SMS is basically being phased out, which makes sense.

Robert Abela: Going back to WordPress. Even technical users, it’s important to point out, make mistakes. What’s the vendor’s responsibility, or the web host’s responsibility, in helping WordPress users, small business owners in general, tackle these issues? You can tell them, “it’s not this plugin,” and so on, but there are a lot of tools they can use. If the human is part of the chain, it’s still going to fail somewhere. So whose responsibility is it, and how do you look at that?

Kathy Zant: Ultimately, it’s everyone’s responsibility. If you have a website, if you have a bank account, it’s your responsibility. There are companies like yours that exist to support users and give them tools, but if people don’t know how to use those tools, if they’re not aware of what the threat landscape looks like and what hackers are doing, and it’s not just spam links or redirects (there are all kinds of vulnerabilities, social engineering, phishing), everybody needs to be responsible. That’s why I think education is the most critical aspect. You can have the best hammer in the world, but if you’re trying to screw something in with a hammer, it’s not going to work. You have to know how to use the tool and its capabilities.

So I think it’s great there are tools like what you’re offering. I especially like firewalls on the server side, before traffic even hits WordPress, and I love that a lot of hosting providers are moving toward that kind of architecture. But you also have to understand your risk tolerance. How big of an asset is your website? Is it being backed up, and can you restore a backup quickly? Do you have customer or personally identifiable information in your WordPress database? All of that ratchets up the risk to your business.

One of the first websites I ever worked on, way back in the ’90s, was for a very large airline, and when the site went down, they told me, “This is $50,000 an hour.” I remember thinking, “How?” I don’t even know what the number would be today, but that’s a huge risk. If you’re losing $50,000 an hour, your risk tolerance is very low, and you need more protections. If it’s your blog, or a test site you can easily restore, it doesn’t matter as much. Every asset needs to be evaluated based on your risk, how it affects your life, your livelihood, and your ability to put food on the table if something happens. If somebody gets into your Facebook account and you’re running ads and selling things, that’s a huge risk and needs more protection. But if it’s just your personal Facebook account where you talk to people from high school, it’s not that big a deal. Every site, every asset, every business objective needs to be evaluated against that business’s actual risk.

Robert Abela: Good point, and that’s why simple, basic security best practices matter. Not reusing the same username and password across different sites and services.

Kathy Zant: Very important to use password managers at this point.

Robert Abela: Whenever we review our support tickets, we develop security plugins, we do this podcast, and so on, it’s clear the biggest problem isn’t a technical limitation of the product. It’s more that users don’t understand why or how to use it. You worked with Wordfence and Solid Security, based on your experience, did you see the same thing, or was it different back then?

Kathy Zant: I just had a flash of memory. One of the first websites I worked on, within the first year, hadn’t been updated in years. I literally thought Depeche Mode was going to start playing in the background, it was such a golden oldie. It just wasn’t being maintained, and they didn’t understand why that was a problem. I think we’re seeing users now who are much more aware of how important it is to update things, because our phones need updates, our computers need updates. People understand software needs updates, and your site runs on software. So there’s been progress on education, but I’ve also seen it all over the place where people have no idea. I sat down at one of the first WordCamps I ever went to, and someone next to me was having an issue and said, “Here’s my password, it’s the one I use for everything.” I started twitching a little.

I think it has to be getting better, because you’re going to learn. Either from someone like you, Robert, or someone like me telling you cautionary tales of what’s happened to other people, or you’re going to learn it the hard way, and then you’re never going to forget. I think people are getting better because they’ve had some kind of experience with malicious actors, whether it’s their phone or something else, and it elevates their awareness. “Oh my gosh, the neighbor’s house got broken into, I should have a security system”, that kind of thing. It gets them thinking about their digital security and digital citizenship differently.

Robert Abela: It is unfortunate. I’ve worked in IT for 25 years now, always for security startups, not all in WordPress, only the last 13 years. And you’re right, in 90% of cases, bigger businesses with policies come and buy the software or implement something because they’re required to. But in 90% of cases overall, people only come after something bad has happened: “our website was broken into,” and so on. Maybe we need to teach more people. If you look at WordPress, we have WordCamps and things like that, but what can we do, as vendors, as a community, to help people look at security products more like insurance, and just do it right away rather than waiting for something to happen first? What do you think we’re missing?

Kathy Zant: I think people learn best through stories, sharing stories and experiences. When WordPress meetups were more of a thing, I’d try to coordinate my travel around them. I was in the LA area once, went to a meetup with 30 or 40 people, lots of pizza, and told a story about a hacked site. It came in as a hacked site, and I looked and it was a cPanel account  an agency with 30 client sites all in one cPanel, and their clients all had admin access with one shared, reused password. Somebody logged into one of the sites and uploaded a backdoor into the 404 theme file, and the whole account got polluted. There were people at that meetup who had all their sites in one cPanel too, and everyone was incredulous that this wasn’t a good idea. I told them, “I’m telling you, this is what I’ve seen, this is what this agency went through.”

I think the more we can share those cautionary tales, the more people can learn without having to go through the pain themselves. People are either going to learn from experience or from stories, and a good story underscores “I don’t want that to happen to me”, like the neighbor’s house thing. If it’s in the next town it feels far away, but hearing that someone else went through it, and you’re doing the same thing they were doing, helps it land.

I do think we need more education, and I’m a little sad there’s less community connection these days, at least in the US, meetups mostly stopped after COVID and there aren’t as many now.

Robert Abela: Really? That’s a shame.

Kathy Zant: Yeah, and I think it’s sad, because there’s something different about being in the same space with people, showing up for that serendipitous connection. You learn things you didn’t know you needed. You go to an event, someone asks a question, and somebody else in the room happens to have solved that exact problem. That doesn’t happen as much over digital media, there’s not as much of that connection, or getting information before you even knew you needed it. I don’t know whose responsibility it is to get us breathing the same air again, but I’m hoping that starts happening more, because AI can give you a lot of answers and do a lot of work for you, but there’s something important about connection among people doing the same things.

Robert Abela: I can vouch for that. We’re a remote business, we talk daily, but we also meet in person a couple of times a year, and we can talk for hours, but when you sit down in person, the conversation is just different. Even just going for a beer or dinner together, the environment makes a big difference in how you communicate.

Considering AI and everything going on, it’s a cat-and-mouse game, as you said, do you think security can become overwhelming, especially for small businesses managing their own website without a technical team?

Kathy Zant: I think there’s something else going on with AI, especially with smaller businesses I know, this rosy-colored-glasses promise of AI. I won’t name names, but I’ve been in numerous meetings with people who think AI is just going to solve all their problems, “I don’t need people to do this, I don’t need that.” They think it’s this magic thing that solves everything, and it can’t, because people still need to be involved. Your prompts are only as good as you are; your knowledge is only as good as what you can give it. I know of one company where someone said, “AI is just going to do payroll,” and I thought, I don’t even want to know how they think that’s going to work.

I think that attitude, “AI is going to fix all the problems, I won’t need people anymore”, is going to get people in trouble. There’s an ethical dimension too, but I don’t think businesses do well with just letting AI handle everything without people using it well: challenging it, overruling it, that back-and-forth. That’s what makes the work better. If it’s just “AI is going to handle it,” things degrade: the connection to customers, understanding their actual problems.

With WordPress, I hear people say “AI is going to replace WordPress.” Maybe for some sites. But why did you choose WordPress in the first place? Because it’s easy to publish? Because you can plug a lot of things into it and make something dynamic, a data-driven experience for your customers? These are the kinds of questions AI won’t necessarily push back on, but someone with 20 years of experience in your business will. 

Don’t let those people go. There’s still tremendous power in what WordPress can do, plus AI, with someone who understands security, understands your customers, understands the basics of what PHP, MySQL, JavaScript, and CSS can do. That resident knowledge is incredibly valuable. The “I’ll just have AI do it” attitude is dangerous, not in that it’ll cause direct harm, but because it degrades the experience. We’re all in business to serve someone, to help them solve a problem, to help them become empowered. If AI just does it, how do you even know when the problem changes, or what a person actually says in conversation?

Robert Abela: It seems like we’re finally hitting the point where people realize AI is a tool, not a silver bullet. There was a lot of hype, but now people seem to be settling into “yes, it’s good, it can help us build a lot, but it’s a tool.” Do you think that earlier misleading hype is what led some users, especially small businesses, into security mistakes?

Kathy Zant: You have to work with AI for a while to understand that nuance, that it can be sycophantic, that it makes mistakes. I think a lot of small-business CEOs are the ones who think, “this is going to fix everything, I won’t have to pay all these people anymore,” and it’s like, have you actually used it? Have you been misled by it yet? Because until that happens, you don’t really understand its limits. I was talking to someone at WordCamp who uses AI a lot, works for a major corporation, has “AI” in his job title, and he runs into this all the time too. So I don’t think it’s just a small-business problem, it’s an everything problem. People who use AI regularly and understand its limitations, who understand how to manage agents and what humans still bring to the table, are a bit further along. But even in large organizations, there’s still this hype that AI is going to fix everything. Maybe it will someday, but it’s not there now, and I don’t see it getting there in the next year. But who knows, I’ve been surprised before.

Robert Abela: No, I find it too. When I hear stories like “someone built a CRM over a weekend and became a millionaire within a year.” We have some AI projects ourselves, and I have a lot of product management experience, getting AI to build an MVP is very easy. Getting it to build something proper, following certain coding standards, takes a lot more than a week. But people who write about this online tend to say, “I built a CRM in a weekend, quit my job, started a company selling it,” which might have happened for a few people, but those are edge cases, not the norm. The norm is that AI still needs a lot of hand-holding. I’ve heard the same from people at various WordCamps who work in tech, we’re seeing a surge of new plugins in the WordPress repository, but how many of them will still be there next year, still working?

Kathy Zant: You’ve probably experienced this yourself: you have really good products, you’ve had them for a while, but you can have the best product in the world and unless customers know about it, and there’s good marketing and good education on how and why to use it… I think technical marketing is more about education than anything else. Add AI-generated “slop” on top of that, without real marketing behind it, and you just get a wasteland of content that doesn’t matter. I worked at one company where they told me, “You’re marketing, go hang out with the marketing people,” and I said, “Can I come to the dev meeting, please? I promise not to talk, I just want to listen”, because in my mind, marketing and product need to be close together. To actually sell a product, you have to educate people, and that takes more than someone saying, “An AI wrote this plugin, there it goes, now I’ll sit back and collect.” There’s user feedback, does this feedback make sense, does it go to the dev team, all these decisions. It’s a business, not just code. It’s community and support, not just a function. Software is so much more than code, and code is poetry.

Robert Abela: I agree completely. A lot of people, especially outside the WordPress industry, look down on WordPress businesses, like “it’s just a plugin, a few lines of PHP.” Maybe the code itself is a few lines, but as you said, there’s the business side: marketing, education, customer support, gathering feedback, improving the product, keeping it up to date, especially with security. When there’s a vulnerability advisory, you need to fix it. I’ve spoken with people from a few different security companies who, whenever there’s an update to a plugin, download the whole repository and run a diff to see exactly what changed, they can tell which plugins were updated within the last few minutes. So it’s much easier now for people to go looking for security issues.For sure. Running a business is not just a few lines of code.

Robert Abela: And support matters a lot. If you’re in a WordPress business, you’re much more in the business of support than the business of software. It’s not that the software is irrelevant, but the primary function of support is to help users get the most out of the product’s capabilities, and to feed requests back to the dev team, “here’s a feature that could help a lot more people,” or “here’s a problem, let’s get this solved.” I think WordPress businesses are much more in the business of support and education than anything else.

Robert Abela: Which goes hand in hand with what we were saying, based on our experience selling security products, the majority of our support tickets aren’t technical issues. A lot of people are just trying to understand why and how something works. I’m sure you’ve seen the same. Going back to WordPress security, what’s the minimum a business that owns a WordPress website can do, security-wise?

Kathy Zant: I think unique passwords for everyone using that WordPress site, and applying the principle of least privilege, if you don’t need to do something on the site, you shouldn’t have access to do it. I can talk to WordPress; one of my clients only needs posts and one other little plugin, and that’s all the access they get. If you don’t need it, you shouldn’t be responsible for it. If someone only needs to update a couple of things, limiting their access limits the potential problems. 

These are security principles that apply across the whole business: unique passwords, everyone using a password manager, the principle of least privilege, two-factor authentication, and making sure someone has responsibility for auditing the site periodically, going and looking at what’s changed, whether there are any random user accounts, whether that contractor who was only supposed to add one thing still has an active account. Basic things everybody should be doing. And I hate to say it, but I know plenty of businesses that don’t even do that.

Robert Abela: I agree completely. You said something important, there is software involved, but mostly it’s about best practices and principles.

Kathy Zant: At the end of the day, if you get a good web host, use strong passwords, use least privilege, custom roles, and keep your plugins up to date, you’re in a pretty good space.

Robert Abela: I heard someone say at WordCamp US, “admin rights are not human rights.” People take this approach of “I’ll just give them admin access, it’ll work.” By the way, this isn’t just a WordPress problem. I remember being a systems engineer for a big company in 2002. We had this issue with Microsoft SQL Server; someone brought in new accounting software, and the consultant kept blaming me for problems because I wouldn’t give them root access to the server. I kept saying, “you just need access to your table, you don’t need root.” But it’s easier for them to just ask for root access to the whole server. It’s unfortunate, but that’s not a WordPress-specific problem, which is why I agree with you, it’s more a question of principles and best practices. You can have the best software in the world, but if people don’t understand these principles… and honestly, most people already do understand them in other contexts, because the majority of people use internet banking or some kind of e-commerce, and they take those things seriously. So you should apply the same thinking here. Your website is also a digital asset you should take care of, and even if you’re just a member of a team on that website, you should follow some best practices for the whole team.

Kathy Zant: Sure, even if you’re just a contributor, your account, combined with the right vulnerability, can be chained into a privilege escalation that can damage the whole business. That’s a worst-case scenario, but it’s not uncommon; these things do happen. One of the things I love about WordPress security is that it’s such an accessible conversation. If you start talking to people about banking security, it’s a whole different kind of conversation. But you can talk to people about WordPress security and what they’re doing there, and they pick up on principles, “Oh, that could happen? Really?” and they go back and eventually connect the dots: “Oh, this kind of thing could happen to my bank too.” WordPress security is in a unique position to up-level people’s experience, so they become more secure in other areas of their life too. That’s one of the reasons I love WordPress security. Even though it’s such a small, niche market, it has a wide-ranging impact on people’s lives, and they’re often not even aware of it. They don’t come into WordPress thinking it’s going to change how they think about their entire digital security, but I love that it does.

Robert Abela: You also mentioned people using chains of exploits, privilege escalation, that’s why it’s important to look at WordPress security holistically. I remember a case a few years ago involving Apache, the foundation behind the Apache web server. They were using an outdated web-based bug-tracking system, and someone posted a ticket saying, essentially, “Hi, I have this problem, please click here to check my logs.” The support team clicked on the link. That eventually escalated from access to a support account (which weren’t admins) all the way up to root access on their servers. In a few hours, the attackers went from gaining access to a support panel to gaining root access to the root servers of the foundation site.

That’s why I think it’s important, if you own a WordPress website, maybe coming full circle to close out the episode, user education matters, even for your customers, not just admins. You don’t need to go to extremes, since admin accounts are different from customer accounts, but I like what banks do, and even Google, sending emails like “We never ask for your password,” or “Someone logged in from a new device, was this you?” Keeping the user in the loop goes a long way, right?

Kathy Zant: Oh, completely. It’s so good, if you own a website, to communicate about security with the people who log into it. Some people think it’ll come across as nagging, or cause alert fatigue, but done the right way, it adds so much to trust. People always say, after a breach, “we take security so seriously”, well, show them. Show them how you take security seriously before something happens.

Robert Abela: I agree, and that’s exactly it. Notification fatigue is a real concern, but clearly we’re not doing enough of this yet, because websites are still getting hacked. Thanks so much, Kathy. Before we wrap up, can you tell everyone where they can find you or get in touch to learn more?

Kathy Zant: Zant.com is my personal website. I write about all sorts of things, because I’m a person, and I decided a while ago I wasn’t going to niche down into just one topic, since I like so many different things. I write about health and intuitive stuff, because I think a lot of security work is intuitive, you’re piecing things together. I also write about security and AI, including AI compliance, the new laws coming out, and what that means for WordPress. If you join my list, you can segment yourself and say “I don’t want the health stuff,” and that’s fine. Or follow me on Twitter/X, I’m Kathy Zant everywhere, under my own name. You can also find me on Facebook and LinkedIn; those are the places I’m most active.

Robert Abela: For everyone watching, I’ll add links to your website and LinkedIn in the show notes. So if you have any security questions for Kathy, you also run businesses and consult, right?

Kathy Zant: Yes, I do, quite a few. I do a lot of audits. I’m kind of like a fractional CISO in some ways, coming in and going, “Oh gosh, who installed this plugin?” I’m very nice about it, but in the background I’m thinking, “What is this doing here?” I help people maintain their security posture, because things do happen. Right now I’m also ramping up compliance work around AI legislation with a few clients, and I’ll make an announcement about that soon.

Robert Abela: Very good. Thanks so much, Kathy. Again, if anyone has questions or needs an audit, reach out to Kathy. You can also find her talk on WordPress.tv, which was about AI.

Thanks, everyone, for following. We’ll see you next time.