Episode 29 – Robert Abela  🔗 **Source:** [Episode 29 – Robert Abela](https://www.youtube.com/watch?v=GywmBUQY6ow) > [!note]+ Document Notes > --- > tags: [community-and-code, wordpress-security, plugin-repository, social-engineering, two-factor-authentication, plugin-ecosystem] > author: Robert Abela > source: Community & Code > reference: https://www.youtube.com/watch?v=GywmBUQY6ow > date created: 2026-09-22 > --- > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > # 🏷️ Title: Episode 29 – Robert Abela > ## 🧭 Table of Contents > - [📝 Summary](#-summary) > - [📖 Main Content](#-main-content) > - [🗒️ Notes](#️-notes) > - [📚 References](#-references) > - [🗣️ Paraphrase](#️-paraphrase) > - [📰 Newsletter](#-newsletter) > - [✅ Action Items](#-action-items) > - [🧪 Hypotheses](#-hypotheses) > - [📊 Methodology](#-methodology) > - [❓ Questions](#-questions) > - [🔮 Future Research](#-future-research) > - [💡 Implications](#-implications) > - [🧠 Learning Styles Assessment](#-learning-styles-assessment) > - [📊 Accessibility Assessment](#-accessibility-assessment) > - [🌍 DEIB Assessment](#-deib-assessment) > - [✅ Logical Validity](#-logical-validity) > - [🛡️ DARVO Analysis](#-darvo-analysis) > - [🎯 Conclusion](#-conclusion) > ### 🔗 References > - [Episode on YouTube](https://www.youtube.com/watch?v=GywmBUQY6ow) > - [Melapress](https://melapress.com/) — guest's company (WP Activity Log, WP 2FA, Melapress Login Security) > - [Have I Been Pwned](https://haveibeenpwned.com/) — Troy Hunt's breach-notification service, discussed at 10:30 > - [Patchstack](https://patchstack.com/) — WordPress vulnerability database cited throughout > ## 📝 Summary > - **What happened:** Host Chris Reynolds interviews Robert Abela, founder and CEO of Melapress (formerly WP White Security, per the guest), in episode 29 of Community & Code (53:24). They cover the company name, Melapress's non-firewall security products, the guest's path from 1990s-era hacking into 14 years at security startups, WordPress's security reputation, how non-technical owners should pick plugins, and whether the WordPress.org plugin directory needs stricter rules. > - **Why it matters:** Abela argues the WordPress attack surface has moved from code to people — phishing, reused passwords, and unpatched plugins — so the fixes are login policy, 2FA, and update discipline, not more firewalls. > - **Key stakeholders:** site owners without technical staff ("the baker"), plugin vendors, the WordPress.org Plugin Review Team, vulnerability-disclosure firms (Patchstack, Sucuri), and outside critics comparing WordPress to newer CMSs. > - **Risks and tradeoffs:** Abela recommends commercial plugins partly because a paying relationship raises the odds of support; he sells commercial plugins, so that advice carries a disclosed-by-context interest. His proposed repo purge (close plugins whose owners don't answer a six-month check) trades noise reduction against breaking existing installs, which he names himself. > - **Bottom line:** WordPress core is secure in the guest's view; the recurring failures are user hygiene and abandoned plugins, and the directory's rules haven't kept pace with a platform the host and guest put at 40–43% of the web. > ## 📖 Main Content > - **Security that complements, not competes.** Melapress's three premium products — WP Activity Log (records what logged-in users do), WP 2FA (enforced two-factor and passkeys), and Melapress Login Security (login policies by role, time windows, new-device alerts) — target the account layer. The product list is confirmed on melapress.com; the rebrand from "WP White Security" is the guest's account. The guest says conference visitors kept asking how they compared to Wordfence and Sucuri, and the answer was that they don't do that kind of security. > - **Users are the soft target.** Citing CloudFest talks, Abela says hacking a site through its users is getting easier while exploiting technical vulnerabilities gets harder, and that AI-written phishing now looks "better than the legitimate emails" (a line he attributes to a CloudFest speaker). Troy Hunt, who runs Have I Been Pwned, fell for a phishing attack, per the guest — "it can happen to the best of us." > - **Vulnerability counts measure scrutiny.** Abela frames each found-and-fixed vulnerability as the software getting more secure; every major plugin (he names Yoast and WooCommerce) has had its share. What worries him is vendor response time and whether users apply the patch. > - **The reputation problem.** Three causes, per the guest: early core vulnerabilities, media and vendor headlines that inflate reach ("200,000 websites vulnerable" for a plugin on 0.01% of sites), and a public that lumps core, commercial plugins, and abandoned hobby plugins into one box. > - **Ease of use cuts both ways.** Low setup cost democratizes publishing but brings owners who never log in or update. Reynolds compares this to Windows 98 running on point-of-sale kiosks long after its prime; nobody says "don't use Windows." > - **Picking plugins.** Abela's heuristic: active installs, support-ticket resolution rate and speed, and ratings; for business sites, prefer a commercial plugin even when you don't need the paid features, because a vendor has a business reason to respond. > - **Directory policy.** Abela would raise the bar: require at least an annual update or tested-up-to bump, and contact owners every six months, closing plugins with no response. He cites a Patchstack-linked hackathon after which plugins were closed because owners never answered — he gives 2,000 at 25:30 and 30,000 at 46:00; the figures conflict and neither is verified here. > - **Competition vs. collaboration.** Reynolds contrasts DrupalCon's merge-your-modules culture with WordPress's commercial competition. Abela prefers WordPress's model: more options mean more innovation, at the cost of a choice problem. > - **Uncertain proper nouns (auto-captions):** "MD dash" (Cloudflare's new CMS, 23:00) is unverified; "Pekk/Pesk/Patch sec" is read here as Patchstack; "Oliver from Pekk" is unverified; "impseed … renamed to seed" is likely Inpsyde → Syde, unverified; the friend at GFI ("Sand") and the guest's personal site URL are unverified. > ### 🗒️ Notes > #### ⏱️ [00:00](https://www.youtube.com/watch?v=GywmBUQY6ow&t=0s) Cold open > - Chris Reynolds introduces the episode: hacking nostalgia (war driving, phone phreaking), the Maltese meaning of "mela" (yes, no, or maybe), and the guest sharing a name with Malta's prime minister. > #### ⏱️ [02:00](https://www.youtube.com/watch?v=GywmBUQY6ow&t=120s) Guest intro and the Melapress name > - Maltese, living in the Netherlands for seven years, married, three children; WordPress started as a hobby. > - Rebranded from "WP White Security" because the name was long and implied firewall/antimalware. Paid two or three naming firms; the name came from a conversation with a Maltese colleague (Joel). > - Reynolds: naming is one of the hardest problems; cites an agency rename whose staff pronounced the new name differently. > #### ⏱️ [07:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=450s) What Melapress builds > - WP Activity Log is the flagship; WP 2FA enforces two-factor and passkeys; Melapress Login Security sets policies by role, time, and device. > - Rationale: attackers go through users now; AI use lowers users' guard, per talks at CloudFest. > #### ⏱️ [09:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=570s) Credential leaks and 2FA > - Reynolds: breach lists are constant; you can only control password uniqueness and 2FA. > - Abela: Have I Been Pwned alerts arrive almost daily; password managers plus 2FA blunt reuse. > - Troy Hunt was phished, per the guest; Reynolds recalls Hunt's rogue Wi-Fi demo at a Pluralsight author summit. > #### ⏱️ [13:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=810s) Career path > - 14 years at security software startups (tester, systems engineer, product management), never a developer; wrote scripts. > - Entered WordPress 13–14 years ago when his employer needed a blog; an early SaaS attempt at web file monitoring "was a bit of a flop." > #### ⏱️ [16:30](https://www.youtube.com/watch?v=GywmBUQY6ow&t=990s) Old-school hacking > - Started at 19: w [music] Hey, welcome back to Community and Code. I'm your host, Chris Reynolds. And have you ever talked to a real life hacker? When I was a teenager, I loved reading articles about the early days of hacking, even when I was just a little bit too late and maybe a little too intimidated to try most the actual techniques myself. Still, the terms war driving and phone freaking ring in my ears with a nostalgia for the wild, weird days of the early internet. My guest this week lived through those days himself and got his start in information security as a result of following in the footsteps of the legendary early pioneers of computer hacking. His current company, Melipress, pays homage to his Maltese heritage. Mela can mean yes, no, and maybe depending on the context. And its founder, Robert Abella, shares a name with the prime minister of Malta, which means he occasionally catches strays from CNN or the BBC on X for things that he distinctly did not do. We talk about MelPress which focuses on security plugins that complement the other solutions that are out there. Things like activity logs, two-factor off, and login policies. And we talk about what security actually looks like for WordPress when it occupies 43% of the web. Who's really responsible when things go wrong? How AI is making fishing attacks more convincing than ever, and whether the WordPress.org plug-in repository has kept pace with the platform that it serves. Without further ado, Robert Abella. >> Welcome to Community and Code, the podcast where we talk to the human beings behind the commits. I'm here today with Robert Abella, the CEO and founder of Mela Press. Robert uh welcome to the show and tell us about yourself. >> Thank you very much for having me uh for the invites. Um yeah, I'm I'm bit about myself as a person. Um I'm not the professional life. I'm Maltese. I'm originally from Malta. I live in the Netherlands. I've been living in the Netherlands for the last seven years. I've lived in a number of countries in Europe. I'm married. I have three children. And basically, WordPress years ago was my hobby. And yeah, now it became my my full-time the last few years. Well, I want to talk about like sort of what you what you do, but before you even get into that, I was looking at the website for Mel Press and I feel like uh I want to give you the opportunity to talk about the name because there's a whole page that's about like the the name Mel Press. Uh what is what is what is the vibe of of Melress just like as a company but also like where does the name come from? >> Very good. Um originally the name was WP white security because we develop a number of security plugins. However um we don't develop the typical you know like firewall antimalware. We develop like logs to FA authentication hard and similar stuff. So whenever we started sponsoring word camps and similar stuff a lot of people were coming up to us especially those who don't know about us like how do you compare yourself to you know word fence sukuri because this so it was yeah it was a bit frustrating because even though we do security we don't do that type of security actually our products complement those services not we don't compete with them also the name was a bit too long WPY security so yeah so we started um the rebrand And it was quite difficult to find the name. I wanted as I said I'm originally from Malta. So I wanted to yeah put something from Malta or at least my my language there. Uh we tried different things because we have a lot of words which are kind of like simple can be easily read um by English people and non-English native speakers because sometimes especially because English and and the way they pronounce some words it was difficult to find the right word. And we even paid a number of companies, I think two or three companies where they suggest names and we just couldn't get about it. And then I was talking back then to a colleague of mine Joel who was who is multis as well. Um and yeah I said something like yeah me because we use mela is a multise word. Um it's very difficult for foreigners to get as in because it depending on the tone especially when your mother uses it. It means either yes, no or maybe. So it's really [laughter] it's it's really it's really >> it's pretty much the the whole spectrum right there. >> Yes. It's like it's like when someone does m you know it's like is it a yes is it a no and it's something very similar. So it depends on the on the pronunciation how you pronounce it and the tones like okay it can mean a lot of things and yeah it fits in really well like press okay and just so we wasted a bit of money paying companies and just it came over discussion. So yeah, that's that's the original of the name want there. So there's a yeah a piece of maltis in in the name. It's often confused because of course we are close to Italy. Mela in Italians mea which is apple. >> So many people think it's it's it's apple but no it's actually it's exact it's a multi word. And in terms of >> Apple press isn't that bad either. >> True. Is there a company? >> No press. [laughter] >> Yeah. If you're Italian, it means your Apple presents. >> Yeah. No. Uh, one of the hardest things uh in in software engineering, right, is naming things. Um, and and and finding uh finding the the a name that is easy for English speakers to pronounce. Uh I it just reminds me of what was it last year when the the agency impedimed or impseed uh renamed to just seed uh which is spelled s yde which still I think is problematic because I think half the half the world is going to read that as side. Um, but like that was the same thing. And they had a they had a really funny video um as they were as they were rebranding where they I think they were actually even asking all of their employees how they pronounce it and everybody had a different pronunciation. So like even internally in the company uh they they couldn't pronounce it. So yes, settling on something uh that is easy to pronounce is probably a key thing in in developing any sort of product. Yes, it's it's very difficult because even once you start reading about you know like brand names and stuff there are so many um hints like try to for example come up with a name that starts with a so when there's a whenever there's a listing of companies you're always you know all these type of optimization but yeah you can only go so far and there there are so many companies out there and and and trying to find something that sounds like a okay word okay to pronounce um and yeah and that fits and that works with everyone is quite difficult you know it's about pronunciation it's about the length a lot of stuff so and there are so many companies out there so you have to find something unique which is it's very difficult it can take a took us a few months actually >> yeah yeah we'll talk about what what Melipress actually does uh especially since you you noted that it doesn't do security for WordPress in the way that most people consider uh WordPress security sort of plugins or platforms or whatever so like what is it that that that what What solution are you providing? [snorts] >> Um yes, typically when people talk about security they think of either hardening uh like harding the the website some sort of protection firewalls or some type of scanning or antimalware cleaning etc. We do none of that. We do our flagship product is WP activity log which basically keeps a log of what logged in users are doing on your website. You know someone installed a plugin, someone changed some content etc. We also have WP2FA which is a a plugin that allows you to enforce it is a sort of hiding but you know not the typical firewall um allows you to enforce the factor authentication even pass keys and and and similar stuff. So it's login hardening and we have Malapress login security which allows you to configure a number of login security policies. It's not just about the fade login but also a number of things. For example, you can control or configure policies to limit when users can login, range of time or which dates by user role. >> Um, use specific number of machines. So when they try to use a new machine, they are alerted. You know, a lot of these kind of like um helping users and the reason why we went that way because um first of all we started with activity log uh years ago, but also it's the more the more time passes the more I'm realizing like last week I was at Cloudfest. >> Mhm. Um, and most of the screen presentations, that's what they were talking about. Unfortunately, I mean, like it's becoming way easier if you want to hack someone, it's becoming way easier going through their users. It's much it's becoming more difficult to exploit technical vulnerabilities, trying to bypass a firewall and stuff like that. And because we're using more and more AI, uh, it seems like the cognitive abilities of users are are lowered nowadays. So, it's much easier to launch a fishing at and all these stuff. So hopefully with you know using 2FA maybe a bit more login policies and stuff like that you and training the users and helping the users uh get alerted when a new machine is used or the user was used somewhere else. Yeah that hopefully hardens that that part of of of security as well. >> Yeah. Well, and and multiffactor authentication is is crucial, right? Especially like since there are so many uh databases out there now like like you know it used to be like every other week or or at least once a month there'd be some new uh vulnerability disclosure that like there's a database of like 50,000 2 million different username and passwords that were scraped from some you know Google or like some ridiculously large company and all the and and because people reuse passwords Then like if you're on a list somewhere like you I mean I I it's impossible to follow it, right? It's like I I can't even I can't even worry about my my email address being on a list like that because there's so like obviously it's out there. I can only worry about like making sure that like my passwords are secure that I'm using two-factor authentication so that when somebody does inevitably find my email address on a list, the password they get isn't matching with the password that I'm using on an actually important site. >> [snorts] >> Exactly. Yeah. I mean, if if I don't know if you've ever heard of the website Have I Been Pawn. >> Oh, yeah. If you subscribe to that one, you receive quite a few alerts because yeah, there are um I think you find data leakages almost on a daily there are data leakages almost on a daily basis. So, it's it's quite um frustrating. Then, of course, um ideally you shouldn't use the same passwords for different websites. That's why there are password managers. But yeah, of course, 2FA eases that process. So yeah, even if you use the same password at least, yeah, the the the attackers if they guess your password, they cannot log in because they need one time code either from your uh email address or from your mobile device etc. So yeah, in terms of credentials, yeah, as you said like you'll find your email address almost nowadays in a lot of lists. It's funny talking about heav pawn because and because we were talking about fishing etc. Uh that website is maintained by Troy Hunt. He's a very popular infosc researcher. It's funny talking about attacks and stuff because last year he has a blog post about it. In fact, he was a victim of a fishing attack and um his mail place was stolen. So it's a bit um a security speaker at cloudfest had this really funny comment because he said with AI especially uh fishing attacks are becoming so good they actually look better than the legitimate emails. Yeah. [laughter] >> So it's it's it's becoming it can happen to the best of us. You can be >> Troy Hunt. It could still happen to you, you know. >> Yeah. >> So yes. >> Yeah. No, I met Troy many many many years ago. Um uh back in the day I was doing uh online developer training courses for Pluralsight. Uh and Troy was also doing uh courses for Pluralsight. Um and all of his stuff was on security. And so there were Pluralsight held these sort of author summits. So they get all the the Pluralsight authors uh to hang out and talk to each other and compare notes and stuff. And so I I've met him and and one of the things I I remember um he did a he did a presentation and um he he put uh like a Wi-Fi um like router in the room and basically like the idea was to see how much data he could get by people just jumping onto a freely available Wi-Fi node um and like and then showed it in the demo like just like and this is all the information that I got from your computer because you just happened to jump on this free sci-fi uh that that is like that I put here for this purpose that looks legitimate but is actually not. Um yeah and then that was about the time when he when he had uh actually even launched have I been a pon. So yeah well very very big fan of of Troy's work uh over the years. Uh but what uh so so have you always been interested in sort of the security side of of web development or what sort of brought you to uh the point at which you decided that that this product this set of plugins whatever that you're building with meress is is the thing that you want to be doing. Uh it I've always been into security. Um before working with uh WordPress which was I started 13 years ago uh in my previous career uh I worked 14 years for a number of different startups and they were all security startups >> u software security software startups. Uh I had a different number of roles. I started as a software tester systems engineer systems engineer product management. Uh I was never a developer. I mean I can write a a bit a bit of code. Uh I used to write of course when I was systems engineer a lot of b scripts and automate try to automate all these stuff. So I have an idea a good concept of these things. Um but yeah since I worked always with um [snorts] security software companies and startups. Yeah it's what I heard for 14 years about you know like security what can happen etc. So it's it's a field I know very well basically and most of my friends some of my friends which I still have from back on in those days they also have security uh for example a friend of mine has a penetration testing company so yeah I'm I'm always surrounded with with security so it's it's something I've done from day one basically um so yeah that's that's that's where the security is coming from in fact we jumped I jumped into WordPress because the last full-time job I had we needed a blog um it was This was um 13 14 years ago. We needed a blog. We started looking. I've learned about WordPress and back then WordPress. Yeah, there were security was still very weak. No, it's it's not the it's always the same, you know, like like um the reputation it had etc. And but there weren't a lot of security solutions either. In fact, I remember Sukuri starting, you know, back then it was they just used to do free scans like an NM map scan and stuff like that. And yeah and we tried to because it was a security company already. We used to develop a web vulnerability scanner. We tried to develop a SAS for web back then a security um file monitoring etc. It was a bit of a flop. [snorts] Nothing with with the technologies just the way we managed it etc. And anyway then it was time I was working for 14 years for four different software companies but always the same uh founder and CEO. I I I I I worked with him etc through my career and it was time to move on and anyway just after 14 years I to start my own thing because we had just started working a lot with WordPress even through my previous full-time job I met a few friends from WordPress um and yeah it just became it's something I liked you know I I really like so so yeah security is coming since day one I started working in IT just because mostly I've worked with security software companies >> what brought you into security to sort of begin with like where did that sort of interest uh develop? >> Uh it's this started when I was 19 years old. Uh back then it was different of course hacking even to this is still cool. Back then was a bit in my opinion it was cooler. nowadays. I was just at the cloud fest um capture the flag uh the winning team I think within they they uh capture the flag in nine challeng challenges within 18 minutes because all they did spend 10 minutes set up the AI framework and then the rest just was just automated. So it's nice from technology point of view but it's not fun. Back then I remember in my early days I used to go with my friend you know like war driving capturing Wi-Fi packets and stuff. It it wasn't much different. You know, we used to we had this hack with um there used to be in multi public phones where you had internet access if you use the tele card, but we a friend of mine found a a bypass without the card you know just like really re you know like scanning for open ports you try to uh use netcat and all these stuff. So back then it was much more different. So yes um when I was at GFI when I became a systems engineer as I said it was a security software company. So we always was this learning a lot about security. But then I was I was sharing an office with Sand this friend of mine and who was the security engineer for GFI back then. So 9 10 hours a day just talking about security um who was helping me back then you know like configuring the firewalls the routters and all this stuff and learning you know about back then DMZ and all this stuff. So yeah of course then that's the potato. It's it's it's something that's very interesting. uh it's much more interesting than just systems engineering and yeah it's just also what the companies I worked for were doing in security so it's just I literally like always been in this since I was 19 I've always worked in this industry in security >> yeah I remember being a nerd in the 90s and early uh early 2000s and I never I never did all of the cool uh old school analog hacking things that I read about but I do remember reading about the things where like uh like the whatever device that you get that you can that like simulates the sound that a coin makes in a pay phone so that you can steal the and then like uh like >> being able to like rig up like like off of a off of that like connect it to like a modem and then use the use that to like dial up and like like there's no kids these days will never understand the amount of ingenuity that goes into like all of the really old school like analog like hacking which is actually like literal like not hacking on the computer but like with hardware devices that you had to like physically hold in your hand and go to actual like places in the world not just from behind a laptop screen. >> Yeah, that telephone thing you're mentioning was mistaken. It used to be um a whistle with some serial America Captain Crunch I think. And if you blow this whistle on a public telephone uh it used to it used to have the specific tone that is um and the the um center whatever it's called the the switch switchboard switch center used to hear this stone and detected as something so yeah used to root you somewhere I forgot how it is exactly but yeah it was much different back then in fact uh I just found because I was just cleaning bit of spring cleaning I found the book I have the um a book behind the wires from Kev Mitnik uh signed it's and I remember reading those stories like when you read Kev if most probably the young people some might know who Kevin Mitnik is if you don't know who he is find his book goes behind the wires amazing story so basically Kevin Mitnik is the first popular uh mainstream hacker basically um and yeah he spent uh after was hacking he spent a number of years I don't know how much exactly I forgot five six or four years I don't know um with the FBI following him and he was following he was tracing the FBI so he was always a step ahead of them and this story is is amazing. Ghost in the wires is definitely a must readad and as you said it will at least will give hackers of today a bit of an understanding how different it was back then because nowadays it's just yeah automation I mean there's still some development and skills in it but back then it was much more much more fun much more interesting at least in my opinion. Yeah. Well, I feel like right now like you get more mileage out of social engineering. Like you get more mileage out of like deep fakes or like convincing someone to willingly hand over information rather than like actually like using any sort of like brute force methods to to infiltrate a system anymore. Like it's that's Yeah. >> Yes. Uh people are not aware of these things until this day. It's not the first time I tried just for fun. For example, I don't know. I'll walk into a supermarket, you see some employees walking into some office, you know, there's there's design stuff only and you walk behind them like oh sorry can I watch and no one asks no one questions like why are you coming in it's just they're so used you know like because you're being nice oh yes come in you know like people are not aware about these things so it's it's very h it's very easy it's still very easy to I don't know if it's coming from because of politeness and but also as someone said at cloudfest also because of the we are especially people working in IT we are relying so much on AI that our cognitive abilities are being lowered because um >> so yeah people need training about yeah what's what social engineering what type of issues there can be I remember again back in my early 20s we used to in Malta there's this ferry between Malt and Goo Islands and yeah it was and most probably even nowadays it was so easy to go down to the engine room no one ask you anything especially if you if you Just buy a high visibility vest, just put it on uh hang any type of ID and just walk in. No one no one will even ask you anything. I there are some YouTube videos actually about this. There are some people which just get by vest, a helmet and and a letter and they just walk into offices and see what they can do. And >> there are some cases where they are stopped but the majority they just walk in and no one questions them. It's it's amazing. Yeah. >> Yeah. Yeah. For sure. Um, well, from from the perspective of an an old school hacker and from the perspective of somebody who's been working in in security for a long time, uh, I know that like the thing that everybody from the outside of the WordPress community always sees or hears when they think about WordPress or they hear stories about WordPress and even even in Cloudflare's announcement of their new CMS, MD dash, they mentioned they talk about like, oh, the security is a problem or or specifically like security of of WordPress plugins are a fundamental problem in the security of WordPress as as a whole. So I'm interested to hear what your sort of take on or perspective is on WordPress security since like you've kind of you've been outside of that system and now you're working within WordPress and and making security things for WordPress. >> Yes, unfortunately there are a number of factors which give WordPress this um this really bad reputation. First of all, even till this day, whenever I speak to people outside the WordPress community, disagree people, they do look down on WordPress like, oh, it's it's just a script giddy, just some hobbyist application. A few months ago, I was talking to a recruiter like because we're looking for people and he asked me like, "Oh, is like are there like full-time businesses working with WordPress?" Like, yeah, duh, of course there are. Anyway, so yeah, but I think the reputation is coming. Yes, back in the early days, WordPress had a number of uh core vulnerabilities. By the way, it's not unique to WordPress. Every other software, especially in the early years, they have this this vulnerabilities, which is nice because of course you can look at it differently. You can look at it like say, oh, that software had a lot of vulnerabilities, so it's insecure. Or you can look at it every vulnerability that's found and report it and fix that software is becoming more and more secure. So every software has to go to that phase where they found the number find a number of and then becomes more secure. Even our plugins, even all the top plugins, look at all the top plugins, yo, woocommerce, they all had their fair share, which is normal. So I think the reputation is coming from there. Uh secondly, the media doesn't help. Uh Matt Unang mentioned it. He wrote something about MDH. Uh and yes, like unfortunately when there's a vulnerability in a plug-in that is installed on 0.01% 01% of the websites we start seeing the media emails even some vendors like 200,000 websites vulnerable to so so that doesn't help so people of course have this impression last but not least um yes um everyone can develop plugins now the problem which I like people put all the plugins WordPress core in one box but they're not I mean you have a you have a number of plugins a small percentage of plugins which are maintained by commercial companies it's not always perfect but they will always issues but yeah there's there's someone behind them they are being maintained of course they will have vulnerabilities but they are being fixed but there of course you have a number of plugins that are from hobbyist or maybe someone who's still learning and they have security issues and unfortunately they are never maintained I think patch sec not not last year the year before uh or last year they had a hackathon and uh I don't know how many environment they found but because of these issues 2000 plugins were closed on the repository because when the repos try to find the authors, they never got back to them. So you have to close them. Um so and then of course these stories are used for marketing but they are sens sensationalized sometimes and people don't read how many good plugins there are. People read oh 2000 plugins were closed. Oh, uh, especially nowadays with VIP coding, uh, I think Oliver from Pekk just posted in in fe in March, they received, uh, 2,000 vulnerabilities, uh, reports about 2,000 vulnerabilities. They still have to check them, etc., and verify them. But yeah, like unfortunately the bad news are still are used, right? So sometimes for marketing but sometimes are sensationalized and these um they don't help the WordPress uh even like as I said like whenever there's a vulnerability you received all these newsletters like 300,000 websites vulnerability in regards to comparison to AMD dash because AMD mentioned that they're going to the plugins will be sent box etc. Matt mentioned looked at it differently. Um he said uh the fact that I'm going to butcher it roughly but but um the fact that plugins can uh change every feature of of every functionality of WordPress that's actually a feature because you have you give them so much. I think it really depends on things. I mean if you know what you're doing and use reliable plugins yeah it's not an issue. Of course by design if especially if you try to compare WordPress to an operating system like Linet yes you can you have permissions and sandbox but we're talking about a CMS to run a website not an operating system so personally are there things that can improve can be improved some things but in general it's a core at this stage is very very secure um many plugins nowadays are are are developed by seasoned developers there are seasoned uh companies there's been around for a few years, they have the experience. So, if you use the right plugins and uh do the right research, use the right plugins and keep your software up to date, in general, you're pretty much safe. However, as I said, people are uh there are 6,000 plugins um guaranteed some of them are are insecure or have some security issues and whenever one of these have an issue, yeah, the media senses in that. So, of course, we are getting that impression. By the way, it's very important to point out this is not just an issue with WordPress. Every software guaranteed has vulnerabilities. It's it's not a question of which doesn't have, it's a question of when they will be found. So, so but the media unfortunately gives that impression and those outside WordPress look at WordPress as like, oh, it's a it's a hobbyist uh script, someone a few scripts and running them, so it's not that secure. >> Yeah. Yeah, I mean the thing that that occurs to me um about about that whole thing really is like I mean I I've been I've been interested and involved in open source for I don't know 20-ish years, right? So like and like before WordPress it was other things and I was like you know looking at like and using Linux and and you know the size the the more people that use a particular piece of software particularly particular the more eyes there are on it which means when you have more eyes on a thing then it's more likely to actually get fixed than if you have you know not as many. And you know the other thing that that occurs to me is like no one no one says don't use Microsoft Windows >> because you need to run macaffy on it or something you know like like Windows had lots of viruses and bugs and like you know exploits and and and that was the operating system of every business industry like every everyone was using Windows 95 or Windows 98 like long past when they should have been using those operating systems and like there I mean it's it's I I remember how like I I used to work in um I used to do tech support for uh for a grocery chain and um we had uh we had it was when we were rolling out like the selfch checkckouts and things and and like photo kiosks and stuff and they all ran like Windows 98 even though like the the I think the version that was modern then it was like probably Vista or whatever, maybe Windows 7 or something. Um, but like it was just because it was easy to write Windows 95 or Windows 98 software and that was just like what they had licenses for or whatever. But like and and like arguably it's probably a problem that a point of sales system is running an outdated operating system because it wouldn't be that hard to like they're they're connected to the internet, they're connected to wireless, they're connected to the network in the in the store. like you could get into it like you know like these are things that actually run things where you know there's a cash payment system like attached to the actual physical device right um and those are far more uh impactful than than uh someone's website um yeah >> it's it's still an issue over there it's by the way um just just you you can find a lot of articles where they explain like how especially main big frameworks especially the banking system because of some of some old software. They still use some old versions of of of Windows or Linux et and they cannot update. And it's funny um I remember this meme quite a few years ago uh like like someone laughing from behind the curtains and it's like like the devil laughing from behind the curtain. The idea is like cuz banks are all the time imposing all these compliance regulations and stuff and then when when you look at this their networks because of some old software that they cannot upgrade. So their networks is their networks are much more insecure than other software out there. So yeah, it it it is still a common issue and I agree with you. No one says don't use Windows and Windows has and still has a fair share of issues quite frankly. >> But yeah, it's it's just I I think I don't know. I think maybe WordPress is picked on because uh as I said like the news in general doesn't help really sensationalize it. Yes. Can there be improvements in in the way like plugins interface with the core? Can you maybe um segregate that in a way? Yes, there can be ways, but it also depends um yeah on how you use it. I think one of the biggest I've always said that one of the biggest issues with WordPress is um is the fact that it's easy to use as in it's a bit of a okay let's as in like the fact that it it's easy to use is what made it popular which is great and so it it really democratizes uh publishing. Um however also when it's easy to use you have a lot of people who start their own website and yeah they have no idea maybe I don't know you're a baker and you have your own small business and you want to set up a website so it's very easy to nowadays by hosting install some plugins etc. However these people uh yeah their focus is business it's not like technical uh stuff so they have no idea what it takes to maintain a website. So yeah they install a few plugins they they never log into the website they never update their plugins. of course they're going to get hacked. It's not it's not WordPress issue because they had some old plugins or maybe they use some plugin which uh I don't know maybe it's not that reliable etc. They never update it. So yeah of course we're going to see how these websites act and that one is is a bit of a double-edged sword because it's very easy to use so it democratizes the web but just because it's easy to use also you get all these unexperienced users using it so then it gets this bad reputation. So it's a bit of a Yeah. Well, and I I think a trend that I that I've noticed uh looking at some of like patch tax reports and and and their uh state of security in WordPress sort of things um that you know once upon a time especially you know when I was like freelancing very early on in my WordPress career like the the the mechanism by which a site would get hacked was very frequently related to uh file system permissions and also like the security of the host. posts such that like if you got access you could find it you could sort of like CD into like the right directory and then inject an actual file because the file the file permissions on your folder were not secure enough so another user could drop a file there and then that would like write some other file or you know you'd get some something where it would execute and then you have this like B 64 encoded and and like that was so is really like fundamentally like oh you did your permissions wrong and now somebody was able to physically write write to your file system. Uh which is obviously bad. Um but that sort of attack isn't so uh isn't as common I don't think as now it's more like privilege escalation like it's more about like oh if you can get access in the first place which again as we've said there are weak points your your your website your your computer is only as secure as the weakest password. Um, so like if you can get access to the system then once you once you're in you can do all sorts of different things and then it's like and that becomes that's both like oh well if you have access to my website then I'm sort of tanked anyway but on the other hand like I that's that's where a lot of the risks are and it and it you really need to think about like the how you're enforcing uh good secure hygiene for just managing a system like that like it's not even WordPress specific. It's like any any system, a network or web like a computer, like anything needs is is only as secure as as the weakest password in the link. >> Yes. I mean, first of all, WordPress powers here 40% plus of the website. So that's a a big chunk of the internet. So of course, yeah, I mean it will be the most targeted um platform. Secondly, as you're saying, yeah, mostly are user issues. Um if you look at state of security from from pesk and the one of last year was in the early beginning of the year was a joint report between sukuri and pesc the two biggest issues are user issues >> mhm >> passwords still the same same old story and outdated software and that's why people are able to find ex uh exploitable vulnerabilities in plugins and because not because because even a plug-in has vulnerabilities that doesn't worries me what worries me is how how quickly does the vendor um respond? Do they release a patch? That's all good. But even then, like most people don't update their plugins. Uh and that is um a use that's a user problem. And that is patch sex main business. I like >> uh they they they have specific firewall rules for specific for the specific number of plugins you have on your website. Don't get me wrong, it's a very good business model. It's a very good solution. But yeah, the premise is like if everyone really keeps their plugin up to date and keep their software up to date, best would run out of business in theory. But but yeah, so so so if you look at them um the user issues because even if there's a privilege escalation issue, most probably if let's say you have an e-commerce store and someone hacks a customer account, hijacks a customer account, some people tell you like, "Hey, it's a low privilege account." Yeah, fine. It's true. But first of all, once once you have access to a website through an account, regardless of privileges, h you have one foot in the door, it's easier to launch uh social engineering attacks. However, even if um if you try to exploit something uh in uh privilege escalation, you can do it most most probably because most you can do it only if there's a plug-in or there's a software that is vulnerable and allows you to do it. Because if you hack a customer account and all your software is up to date, you cannot uh escalate your privileges so easily. No. So again, it it always revolves around user issues. If you keep your plugin up to date and have some basic user security hygiene, then all these problems will be solved. But there are again many websites which are abandoned, they are never locked in and and yeah again we get the oh is the problem. No, actually it's not WordPress is the problem. The users maintaining the websites are the problem. you mentioned earlier about um how if you if you get the right plugins, if you find if you find trusted plugins and you do your research and and things like that. Um but with 60,000 or however many plugins there are in the WordPress repository, it's it's and like you do a search for any given string, you know, for I want this type of plugin, you're going to get dozens of of results. So do you have thoughts around like I know how I evaluate plugins when I'm for myself but I'm been doing this for 20 years and I go to the conferences and I talk to all the people and I know who I trust right so how do how does a person who is a baker or whatever like who's doing this thing who's trying to do their best to to to get like trusted software packages on their website how do they evaluate what uh like what what things would you suggest to help them evaluate like what the best way of of finding a trusted uh plug-in author when they're looking for a particular uh solution for their site. >> Yes. Yeah. Very quick question. First of all, the fact that there are 60,000 plugins, it's already a bit of a problem because you have this this choice dilemma. Um I I remember by the way when when we're when I got married, we were doing our our house. Uh my wife wanted to go to like four or five different vendors to choose the kitchen. I was like it would be nice if there was only one vendor and just go for one kitchen. I don't it makes life easier. The same with plugins. But yeah, there are a few rules. Uh the repository there are a number of statistics that help you. I mean you have the number of active installations. If you just look at the number of active installations, if you look at the support tickets, how many support tickets were resolved etc. Uh and how quick they are resolved. And if you look at the ratings, those are already like three good things. You have the number of uh active installations, uh the the support and the reviews. Of course, if you look at those, it will be difficult for new new starter plugins to reach the but that's that's how it works. You know, like a plugin which has 200,000 active installations first of all or 400 or more. It means it's reliable. It means a lot of people use it and most probably it's been around for a few years and yes it's well maintained. Another another one I would say it really depends but usually I prefer especially if I'm using it if I'm using my website for business I mean if it's a hobby it's one thing but if it's for business I would opt to go for a commercial plugin and the simple reason is this even if I don't need the commercial features I typically go for commercial plug-in because when you have a commercial entity behind the plug-in um well every business can go bankrupt granted but the chances of you being supported getting support when there are issues being reported it that vendor is going to respond and fix it are much higher. When you have a plug-in which is completely free, there's nothing wrong with it. Um but if it's especially someone's hobby, um even if there are issues or not or if there's support, yeah, maybe this person only Yeah, it's a hobby. So he can only give give two three hours a week for example. So he only replies on support issues on Saturday evening. So if you are using it for business and something happens like are you willing to wait for a week to for a fix. So by using commercial plugins you are supporting vendors and you are encouraging higher quality of plugins. Um but you're also yeah you're guaranteed you're never guaranteed but there's a higher chance of that plug-in being maintained. So yeah, I would say number of active installations, look at the reviews, look at the support tickets, and optionally, but nice to have if if there's an option to buy a commercial plug-in, it helps because there's a certain level uh level of service, basically. >> Yeah. Yeah, for sure. It's in it's in the the business's best interest for you to be to leave as a good customer, for you to have a good experience. It's it's literally their livelihood. So, like they're financially motivated to to support you. >> Exactly. >> Yeah. If it's if it's my plugin that I just threw up on on WordPress.org 5 years ago and and don't look at, >> I'm less inclined to to respond to support tickets. Um, >> one of the things that that Yeah, you mentioned uh having so many options is is a problem. A thing that like I observed when I first uh went to my first Drupal con um that was distinct about the Drupal community versus the WordPress community was that because because we have this sort of like commercial marketplace this sort of e this word this e-commerce like infrastructure around WordPress as a as a platform. Um, we have there's this there's this thing that happens in WordPress that doesn't happen in Drupal, which is if I have an idea for a security plugin and you have a certain idea for a security plugin, we're essentially competitors. So, we're less likely to share notes, we're less likely to work together. Uh, we're less we're because I want to hold on to my IP and you want to hold on to your IP. Whereas in Drupal, if you have if you have two separate uh sort of plugins that both are modules that kind of do the same sort of thing, there's more of a culture of like, well, let's let's put our ideas together and and collaborate and make this uh a single solution that is better for everyone. Um, and so as a result, there are fewer options, but also as a result there are there's fewer potent there's less potential in sort of the Drupal Drupal ecosystem as a whole to go out and sell that thing because everyone's like trying to collectively build like the best thing, the single best thing, but also I can't take that idea and then sell it, you know, because >> like yeah, it's it's it's and so that's that they've like they've struggled to sort of like productize the pieces of Drupal that the WordPress ecosystem has sort of naturally and there there's like pros and cons there like there's there's a trade-off in terms of like collaboration versus competition and and all sorts of and then also just having so many options. >> Yes, I think there there are pros and cons to both models. Uh personally, I prefer the WordPress. One one thing I would if I had if I could change one thing in the WordPress ecosystem, I would maybe um for example, if you look at the WordPress uh repository, uh maybe set the bar a bit higher. For example, um yeah, if a plug-in I mean I understand some plugins don't need to be updated so often because they're just like a few lines of code. they do a very specific function but still I would have force at least yeah the plug-in to be updated once a year at least for example or even if you just update supported version uh nowadays of course the repository has notifications like when a plugin hasn't been updated for the last three major versions you get a notification but it's still there it's still there people can still download it can still lead to issues you know so I think by um yeah having some kind of like stricter regulations when comes to the repository maybe we'll have a bit less plugins and the quality might go a bit uh not necessarily improve the quality but we'll have less noise let's put this less like of these small plugins etc uh merging of of plugins and functionality it's I think it really depends on on yeah on what the people are doing the fact that you have that WordPress [snorts] has all these many options is also a good sign it means uh there are a lot of of both business and opportunities and it also usually leads the more free the market is, the more open the market is, it leads to more innovation typically because once you're going to merge things, then yeah, they're working towards certain direction, another competitor is not uh if someone has another idea, they're not even it feels like you're not encouraged because now you have two people working together or two groups working together. So starting something new is going to be difficult, more difficult, etc. So yeah, >> you get the kitchen sink problem, right? You get like everything piled into one thing that you don't necessarily >> Yeah. So, so I don't think there's one better than the other. Both has But yeah, I think if we're if theorg repository uh has uh some sort of stricter rules, it makes life easier. Like even when patches sec the hackathon two years ago and they closed 30,000 plugins. The reason why they closed them is it's not because they had security issues. It's because there were much more plugins which had security issues. But when the repositories tried to contact the owners of that plug-in, the owners never got back to them. a simple test uh which is quite fascinating. Last time I was speaking to someone, I forgot who at Cloudfest who used to work uh help with the plug-in reviews team. And it's always surprising how many plugins there are that they try to contact the owner and the owner never responds. For example, that could be a simple test. Every six months, send make sure there's a contact. If there's no contact, you're getting off of off the repository, you know. Now, of course, there's the question of backwards compatibility because if there are people who has the plug-in installed, what's going to happen with them? how I don't knowification proposal replacement but yes but by allow by opening this door of course you allow more innovation but you're also creating problems so I there's no better good or wrong but yeah it's a bit of a to find the right balance >> it's an interesting point because like I feel like some of this has to do with like where WordPress was when it started in contrast to where it is now because what you're talking about is something is is a more mature way of identifying trustworthy packages for a robust product that powers 40% of the internet. But when the WordPress repository existed, it was just like, hey, I've got some cool I've got a cool idea. Like I had a weird hacky thing that that seems funny and I'm going to, you know, put up this kind of jokey plugin. Like I had a friend that that wrote a plugin called uh login roulette which uh just on a random sequence it'll just log you out on like on any given page load of the admin just like you know like just dumb stuff right that was just silly and like jokey and whatever. I have a plugin that I wrote called um oh what's it called? Oh uh updates uh I can't remember what I called it but it basically like it basically annoyed you. Uh it it gave you like a like uh there was a gif that would be like a really disapproving gif if you had pages on your on your site that hadn't been updated in a period of time and it would get progressively more annoying the longer those pages were uh were left unupdated. Um and um and like like that's that's like that's you know be back then there wasn't even I don't I don't think GitHub really existed then. So like there wasn't even an outlet for sharing these sorts of things uh in for to other people to use even as a joke. But now we've got this this this framework the WordPress.org repository. It still has all that stuff but now we're also needing it to power 40% of the internet uh and and the infrastructure around that. So like there's it's almost like we've moved so far. We've come so close to the sun and like there's still like these fundamental issues that were part of like the openness and the freedom and and like the weirdness of the internet when it when it when WordPress was young but now now it's now we need something more mature. >> Yes. I mean as you're saying when WordPress started when theorg repository started as well it was for a different time and different uh CMS the WordPress was much smaller powered much less but now yeah it's much more popular uh it's much more stable it does much more different things it's used for so much more so much more many things and other solutions uh but the repository of course there have been changes and but it seems it didn't move as fast and it's not where it is. I mean, as I said, I think um as you said, like you had this this plugin like it just shows you the annoying GIF. It it's nice. It's it's it's a nice thing to have even as a hobby, but yeah, just because the number as you said there are 60,000 and many people um like I wouldn't say look down, but yeah, like just because when they see that number like oh there are too many plugins they can they might get overwhelmed, there are too many choices and they don't even try, you know. So yeah, by having some sort of of some sort of stricter regulations, stricter um policies when it comes to to to to what can be submitted, what not or at least everything can be submitted but if after I don't know a year or two are there a lot of plugins we still have 10 50 installations like uh so are they really useful or maybe we should find a solution. Maybe they are useful for those 50 websites, don't get me wrong, but maybe at that stage we need to look on a case by case basis what these are and and try to help those websites. Again, I know it's all the repository is all running on a voluntary basis. So, it's not as easy easier said than done. But yeah, we definitely can I'm sure we can uh the repository can be cleaned a bit even as I said even just sending an email every six months to the plug-in owners like are you still there? I'm pretty sure we'll be closing quite a lot of of plugins if we do that. >> Yeah, for sure. Well, thank you, Robert, for coming on. Uh, thank you uh for talking about cool security things. Where can people find you on the internet if they are looking for you? >> Yes. Um, I'm on LinkedIn. Um, if you search for Robert Abella on Google, search Robert Abella WordPress because Robert Abella is also the prime minister of Malta and >> he he ranks better than me unfortunately. >> [laughter] >> It's funny because on Twitter quite often um I get tags or sent messages from BBC, CNN, you know, like other stuff. So like I'm not I'm not that Roberta another one. >> Yeah, because I I have the my Twitter handle is Robert Abella, but the prime minister is Robert Abella PM or something like that. I was I was on Twitter X, sorry, before him. So um so yeah. Um yeah, um I'm on LinkedIn, Robert Abella X as well. And if we have the website malapress.com I also by the way a few months ago launched my own website rober aa.mme me uh the simple reason honestly is um like everyone else there's this huge AI hype um and I [snorts] needed an excuse to to to play with AI I mean I can develop my own team and stuff but might as well let's try a bit of web coding you know play around with sub aent skills and just play around with it so yeah my website robertme linkedin LinkedIn or malapress.com are the best way to find more about me. >> Awesome. Well, again, thank you for coming on. Thank everyone uh for watching or listening this in the f listening to this in the future. Uh and we'll see you on the internet. >> Thank you very much, Chris. [music] Thanks for having me. [music], Episode 29 – Robert Abela, Robert Abela, 01m34hp73yes4dtt0sm2yt19fg.