415 – Feeling Insecure? with Tim Nash. Episode 3 – The state of WordPress security and the transition to bcrypt
Mar 27, 2025
auto_awesome
Tim Nash, a cybersecurity expert with a background in physical penetration testing, dives into the critical state of WordPress security. He discusses the alarming rise in vulnerabilities, emphasizing the importance of the Patchstack report. Listeners learn about the transition to bcrypt for password hashing in WordPress 6.8, which greatly enhances security. Nash highlights the need for regular updates and monitoring plugins, while stressing that more vulnerabilities discovered can ultimately lead to better security practices.
The increasing number of vulnerabilities in WordPress indicates progress in identifying security flaws, but necessitates timely patches to ensure user safety.
The transition to bcrypt for password hashing signifies a vital advancement in WordPress security, aimed at countering modern computational threats effectively.
Growing awareness among website owners about security compliance and regular audits is pushing the industry towards adopting best practices in cybersecurity.
Deep dives
The State of WordPress Security in 2025
The podcast discusses the findings from the Patchstack State of WordPress Security report for 2025, highlighting a significant rise in vulnerabilities discovered within the WordPress ecosystem. In 2024, nearly 8,000 new vulnerabilities were identified, predominantly within plugins rather than themes. The report suggests that while the quantity of vulnerabilities is alarming, it can also indicate progress in identifying and rectifying weaknesses, illustrating an active effort to enhance security. This discussion emphasizes the importance of not only discovering vulnerabilities but also ensuring that timely patches are implemented to maintain a secure environment.
Vulnerabilities and Their Implications
The podcast highlights that the rise in vulnerabilities does not necessarily correlate with a decrease in security. The conversation reveals that 33% of identified vulnerabilities in 2024 were not fixed prior to public disclosure, posing potential risks to users. This statistic stresses the necessity of proactive management and diligence in plugin development and updates, particularly as many vulnerabilities stem from outdated or abandoned plugins. The hosts express concern that a lack of timely patches could ultimately leave users exposed to significant threats in the evolving digital landscape.
The Role of Bcrypt in Password Security
As WordPress transitions to using bcrypt for password hashing, the podcast elaborates on the enhanced security this algorithm offers compared to previous methods. Bcrypt is designed to prevent unauthorized access by making it time-consuming for potential attackers to decrypt passwords, thus reinforcing website security. The hosts discuss how this shift is essential amidst increasing computational capabilities that threaten older security measures, emphasizing the need for continual improvements in hashing techniques. This transition underscores WordPress's commitment to maintaining robust user security by adopting industry-standard practices.
The Impact of Security Awareness and Compliance
The podcast underscores the growing awareness among website owners regarding security compliance and the necessity of regular audits. It discusses initiatives such as the EU Cyber Resilience Act, which aims to enforce security standards and ensure that companies remain accountable for their online security posture. As users become increasingly aware of potential vulnerabilities, there is a corresponding demand for hosting companies and developers to adopt best practices in cybersecurity. This awareness is driving changes in the industry, as companies seek to meet compliance standards to protect their users and maintain trust.
The Landscape of Vulnerabilities in 2024
In addition to the rise in vulnerabilities, the podcast notes the prevalence of various types of attacks, including SEO spam and unwanted redirects. While these attacks often appear less malicious, they can nonetheless disrupt site functionality and user experience. The discussion reveals that many ordinary users may not even notice the occurrence of spam or other issues, underscoring the importance of consistent website monitoring and maintenance. This highlights the ongoing challenges that website owners face in securing their sites against both common and sophisticated threats.
In this episode of WP Builds entitled "Feeling Insecure? Episode #3," Nathan Wrigley and Tim Nash explore various aspects of WordPress security. Tim shares insights into his background in cybersecurity, including his past experience with physical penetration testing. We discuss the Patchstack report on WordPress security, noting an increase in vulnerabilities but reassuring listeners that more vulnerabilities being found isn't necessarily alarming. We get into the complexity of vulnerabilities, security measures like hashing and encryption, and changes coming in WordPress 6.8. The episode highlights the importance of updates and ends with a positive outlook on security advancements. It's a tin foil hat episode, and I hope that you enjoy it!
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode