On May 20, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a Privilege Escalation vulnerability in WPDeveloper’s ReviewX plugin, which is actively installed on more than 10,000 WordPress websites. This vulnerability makes it possible for an authenticated attacker to grant themselves administrative privileges via a user meta update.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on May 22, 2023. Sites still using the free version of Wordfence will receive the same protection on June 21, 2023.
We contacted WPDeveloper on May 20, 2023, and received a response the next day. After providing full disclosure details, the developer released a patch on May 22, 2023. We would like to commend the WPDeveloper development team for their prompt response and timely patch, which was released in just one day.
We urge users to update their sites with the latest patched version of ReviewX, which is version 1.6.14 at the time of this writing, as soon as possible.
The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the ‘rx_set_screen_options’ function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role via the ‘wp_screen_options[option]’ and ‘wp_screen_options[value]’ parameters during a screen option update.
Technical Analysis
ReviewX is a plugin that primarily enables customers to add ratings and reviews to WooCommerce stores, but it is also possible to use it with custom post types.
The reviews are listed on the WordPress admin page, which includes a screen option for how many reviews should be displayed per page for the admin user. Unfortunately, this feature was implemented insecurely, allowing all authenticated users to modify their capabilities, including granting themselves administrator capabilities.
Upon closer examination of the code, we see that the ‘rx_set_screen_options’ function, which updates a user’s per-page screen option, is hooked to the ‘admin_init’ action.
This hook is triggered on every admin page without any post type or page restrictions. This means that the ‘rx_set_screen_options’ hooked function is invoked on all admin pages, allowing users who otherwise do not have access to the plugin to also access the function, as the function itself does not contain any restrictions.
This makes it possible for any authenticated user with an account, such as a subscriber, to invoke the ‘rx_set_screen_options’ function.
The function includes a nonce check, but it uses a general nonce that is available on every admin page where there is a screen option.
The most significant problem and vulnerability is caused by the fact that there are no restrictions on the option, so the user’s metadata can be updated arbitrarily, and there is no sanitization on the option value, so any value can be set, including an array value, which is necessary for the capability meta option.
This made it possible for authenticated users, such as subscribers, to supply the ‘wp_capabilities’ array parameter with any desired capabilities, such as administrator, during a screen option update.
As with any Privilege Escalation vulnerability, this can be used for complete site compromise. Once an attacker has gained administrative user access to a WordPress site they can then manipulate anything on the targeted site as a normal administrator would. This includes the ability to upload plugin and theme files, which can be malicious zip files containing backdoors, and modifying posts and pages which can be leveraged to redirect site users to other malicious sites.
Disclosure Timeline
May 20, 2023 – Discovery of the Privilege Escalation vulnerability in ReviewX. May 20, 2023 – We initiate contact with the plugin vendor asking that they confirm the inbox for handling the discussion. May 21, 2023 – The vendor confirms the inbox for handling the discussion. May 21, 2023 – We send over the full disclosure details. The vendor acknowledges the report and begins working on a fix. May 22, 2023 – Wordfence Premium, Care, and Response users receive a firewall rule to provide protection against any exploits that may target this vulnerability. May 23, 2023 – A fully patched version of the plugin, 1.6.14, is released. June 21, 2023 – Wordfence Free users receive the same protection.
Conclusion
In this blog post, we detailed a Privilege Escalation vulnerability within the ReviewX plugin affecting versions 1.6.13 and earlier. This vulnerability allows authenticated threat actors with subscriber-level permissions or higher to elevate their privileges to that of a site administrator which could ultimately lead to complete site compromise. The vulnerability has been fully addressed in version 1.6.14 of the plugin.
We encourage WordPress users to verify that their sites are updated to the latest patched version of ReviewX.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on May 22, 2023. Sites still using the free version of Wordfence will receive the same protection on June 21, 2023.
If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.
WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product.
This integration guide describes how to configure a BOVPN virtual interface tunnel between a WatchGuard Firebox and a Dell SonicWALL® TZ400.
Integration Summary
The hardware and software used in this guide include:
WatchGuard Firebox M400
Fireware v12.8.2.B668649
Dell SonicWALL TZ400
SonicOS Enhanced Version 6.5.4.11-97n
Topology
This diagram shows the topology for a BOVPN virtual interface connection between a Firebox and a Dell SonicWall TZ400.
Configure the Firebox
To configure a BOVPN virtual interface connection on the Firebox:
In the Interface Name text box, type a name to identify this BOVPN virtual interface.
From the Remote Endpoint Type drop-down list, select Cloud VPN or Third-Party Gateway.
From the Gateway Address Family drop-down list, select IPv4 Addresses.
In the Credential Method section, select Use Pre-Shared Key.
In the adjacent text box, type the pre-shared key.
From the drop-down list, select String-Based .
In the Gateway Endpoint section, click Add. The Gateway Endpoint Settings dialog box opens.
From the Physical drop-down list, select External.
From the Interface IP Address drop-down list, select Primary Interface IPv4 Address. The Primary Interface IP Address is the primary IP address you configured on the selected external interface.
Select By IP Address.
In the adjacent text box, type the primary IP address of the External Firebox interface.
Select the Remote Gateway tab.
Select Static IP Address.
In the adjacent text box, type the IP address of your SonicWALL WAN connection.
Select By IP Address.
In the adjacent text box, type the IP address of your SonicWALL WAN connection.
Click OK.
In the Gateway Endpoint section, select Start Phase 1 tunnel when it is inactive.
Select Add this tunnel to the BOVPN-Allow policies.
Select the VPN Routes tab.
Click Add.
From the Choose Type drop-down list, select Network IPv4.
In the Route To text box, type the Network IP address of a route that will use this virtual interface.
Click OK.
Select the Phase 1 Settings tab.
From the Version drop-down list, select IKEv2.
Keep all other Phase 1 settings as the default values.
Keep Phase 2 Settings as the default values.
Click Save.
For more information about BOVPN virtual interface configuration on the Firebox, see BOVPN Virtual Interfaces
Configure the Dell SonicWALL TZ400
Zone and Interface Settings
Log in to the Dell SonicWALL TZ400 Web UI at https://<IP address of TZ400>. The default IP address is 192.168.168.168.
Configure interfaces and zones. For information about how to configure interfaces and zones, see the Dell SonicWALL TZ400 documentation.
WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product.
This integration guide describes how to configure a Branch Office VPN (BOVPN) tunnel between a WatchGuard Firebox and a Dell SonicWALL® TZ400.
Integration Summary
The hardware and software used in this guide include:
WatchGuard Firebox M400
Fireware v12.8.2.B668649
Dell SonicWALL TZ400
SonicOS Enhanced Version 6.5.4.11-97n
Topology
This diagram shows the topology for a BOVPN connection between a Firebox and a SonicWALL TZ400.
Configure the Firebox
To configure a Branch Office VPN (BOVPN) connection on the Firebox:
In the Gateway Name text box, type a name to identify this BOVPN gateway.
From the Address Family drop-down list, select IPv4 Addresses.
In the Credential Method section, select Use Pre-Shared Key.
In the adjacent text box, type the pre-shared key.
From the drop-down list, select String-Based .
In the Gateway Endpoint section, click Add. The Gateway Endpoint Settings dialog box opens.
From the External Interface drop-down list, select External.
From the Interface IP Address drop-down list, select Primary Interface IPv4 Address. The Primary Interface IP Address is the primary IP address you configured on the selected external interface.
Select By IP Address.
In the adjacent text box, type the primary IP address of the External Firebox interface.
Select the Remote Gateway tab.
Select Static IP Address.
In the adjacent text box, type the IP address of your SonicWALL WAN connection.
Select By IP Address.
In the adjacent text box, type the IP address of your SonicWALL WAN connection.
Keep the default settings for all other options.
Click OK.
In the Gateway Endpoint section, select the Start Phase 1 tunnel when Firebox starts check box.
Select the Phase 1 Settings tab.
From the Version drop-down list, select IKEv2.
Keep all other Phase 1 settings as the default values.
Click Save.
In the Tunnels section, click Add.
From the Gateway drop-down list, select the gateway that you configured.
In the Addresses section, click Add.
In the Local IP section, from the Choose Type drop-down list, select Network IPv4.
In the Network IP text box, type the local IP segment. This the local network protected by the Firebox.
In the Remote IP section, from the Choose Type drop-down list, select Network IPv4.
In the Network IP text box, type the remote IP segment. This the local network protected by the Dell SonicWALL device.
Click OK.
Keep the default Phase 2 Settings.
Click Save.
Configure the Dell SonicWALL TZ400
Zone and Interface Settings
Log in to the Dell SonicWALL TZ400 Web UI at https://<IP address of TZ400>. The default IP address is 192.168.168.168.
Configure interfaces and zones. For information about how to configure interfaces and zones, see the Dell SonicWALL TZ400 documentation.
The biggest release since 1.0, CrowdSec Engine 1.5 brings you new features, major enhancements, and more control of your security management. Discover all that is new in 1.5 and how to get started in this article.
We launched a private preview of the CrowdSec Engine 1.5 to our community members in March to allow them to test it out and give us feedback. After a few months of testing, it was clear that the CrowdSec Engine 1.5 was ready for its debut by the end of May. So here it is, new features, major enhancements and more ways to manage your security. Check out all the updates and what’s new below. You can also read about the increased performance and faster response times when processing high volumes of logs that our community members experienced with the CrowdSec Engine 1.5.
“We are delighted to announce the launch of CrowdSec Engine 1.5 today. Following our last release in February 2022, we have been busy listening to our users to deliver a new version with significant enhancements, including the ability to receive “orders” from the console. We have also developed several new features, including compliance and post-exploitation scenarios to the engine. We are also hugely grateful to the CrowdSec community that has been busy testing the release over the last few months to ensure a smooth and successful roll-out for all our users. ” – Thibault Koechlin, Chief Technology Officer, CrowdSec
Polling API Integration
With the polling API, the Console can now send orders to the CrowdSec instances. Allowing users to manage their decisions (banned IPs at a given time). Let’s dive into what that means.
Real-time decisions management
The new Polling API gives you the ability to complete real-time decision management within the console. For users with many instances, you can now ban IPs on all of your instances at once, all from the comfort of a single page, rather than running an automation script to update all instances. A great timesaver for SecOps teams.
Teaser: Secure and custom configure the fleet of instances from the Console
In the future, the polling API feature will allow users to set up parsers and scenarios directly from the CrowdSec Console.
New Blocklist API and Premium Blocklists
We recently announced the external IP blocklists which allow all of our users to subscribe to at least 2 (new) additional blocklists created by the CrowdSec team, in addition to our community fuelled blocklist to better protect your instances.
Viktoria Rei Bauer (@ToeiRei on Discord, Twitch, and Twitter), CrowdSec Ambassador, saw a 190% increase in blocked IP addresses after implementing CrowdSec’s new Blocklist API and subscribing to 2 new blocklists.
“My average number of IP blocks was 2,000 per day. The day isn’t even over and I’ve already blocked 6,000 IPs.”
The chart below shows the impact the blocklist subscription made to Rei’s CrowdSec pfSense deployment. The red line shows the implementation of the blocklists that resulted in a 183% increase of malicious IPs blocked, peaking at a 400% increase.
Kubernetes audit acquisition
The feature we presented at Kubehuddle UK 2022 is finally here:
Kubernetes Cluster Monitoring now gives our users the ability to monitor and protect their whole K8s cluster, and not just the services running on it.
S3 audit acquisition
CrowdSec now supports reading logs stored in S3 bucket, allowing you to process logs generated by AWS services (such as ALB access logs or Cloudfront logs).
Auditd support
Allows for the detection of “Post Exploitation Behaviors”, including:
base64 + interpreter (perl/bash/python)
curl/wget and exec
pkill execve bursts
rm execve bursts
exec from suspicious locations
CrowdSec CTI API helpers
You can now query CrowdSec’s Cyber Threat Intelligence (CTI) from your parsers and behavior scenario thanks to our new CTI API, allowing you to react to each threat differently according to each IPs reputation and classification.
This new CTI API allows CrowdSec and the CTI to be more interactive with each other, allowing users to query more information around a specific IP. For example, you can now query the machine’s usage, as well as the type of attack it relates to. CrowdSec is now able to query all this data in real-time, helping users to detect false positives, and also reducing alert fatigue.
AWS Cloudtrail Scenarios
Thanks to 1.5’s new behavior detection capabilities, we were able to create an advanced AWS Cloudtrail scenario helping you to detect and better understand what’s happening on your cloud. Below you can see a list of activities you are now able to detect.
Detect AWS CloudTrail configuration change
Detect AWS Config configuration change
Detect AWS console authentication failure
Detect AWS IAM policy change
Detect AWS KMS key deletion
Detect login without MFA to the AWS console
Detect AWS NACL change
Detect AWS Network Gateway change
Detect AWS root account usage
Detect AWS route table change
Detect AWS S3 bucket policy change
Detect AWS Security Group change
Detect AWS API unauthorized calls
Detect AWS VPC change
Feature flag support
This new feature allows us to have some features within the Security Engine that are disabled by default but can be activated manually by the user.
This will facilitate the inclusion of beta features safely and give more chances to the community to preview what’s coming and help us test the features in a range of use cases.
Detection Engine improvements
Conditional buckets: an improvement of our behavior detection system allows for more complex expression for the alert triggering mechanism
Event data stash: allows parsers to capture data for future enrichment. Adding the capability to detect advanced malicious behaviors
CAPI Whitelist
While the community blocklist is highly curated, and designed to avoid false positives, sometimes a shared IP used by both innocent and malicious actors will end up in it, so we’ve added the capability to create whitelists that can also be applied to the community-powered blocklist.
Conclusion
We would like to thank our community of users who have helped us reach this major milestone! Thanks to your feedback we have been able to create a release that truly caters to your needs and enhances your use of CrowdSec.
Interested in using CrowdSec Engine 1.5? If you haven’t already, install the CrowdSec Security Engine and then, sign-up for the CrowdSec Console. We will also be hosting a live webinar to go over all the new features and enhancements!
I’ve been using ChatGPT ever since OpenAI launched it in 2022. It’s helped me write meta descriptions for blog posts, create simple code snippets, and generate outlines. Heck, I’ve even used it to plan a trip to Portugal.
But I’ve been keen to try out Microsoft’s new Bing AI chatbot to see if it lives up to the hype. With Bing Chat, you’re able to chat, compose content, generate images, and get summarized answers to complex questions—all in one interface. It’s supposed to be a far more advanced version of ChatGPT, so I was excited to see how their features stack up.
Here are the main differences I discovered while comparing ChatGPT vs. Bing Chat.
If you want free access to GPT-4 (OpenAI’s most advanced and more powerful language model), Bing Chat is currently the way to go. You can access GPT-4 via ChatGPT Plus, which is a paid subscription, but Bing Chat gives you free access via Microsoft Edge. Beyond that, here’s the main difference:
Bing Chat is built into Microsoft Edge, so it’s a more integrated, tailored way of searching for answers. That makes it a powerful research assistant.
ChatGPT—though a more isolated experience—can be accessed on any browser and has more powerful integrations and plugins. It’s better suited as a personal assistant than a research assistant.
I’ll walk through some of the core differences between ChatGPT and Bing Chat in depth in the coming sections, but here’s a quick breakdown of how they compare.
Bing Chat
ChatGPT
Language model
OpenAI’s GPT-4
OpenAI’s GPT-3.5 (ChatGPT Plus: GPT-4)
Platform
Integrated with Microsoft’s search engine
Standalone website or API
Internet access
Can perform web searches and offer links and recommendations
Browsing feature for ChatGPT Plus users
Image generation
Can generate creative content, including images using DALL·E
Can only generate text
Best used as
A research assistant
A personal assistant
Usage limits
Users get to ask 20 chats per session and 200 total chats per day
Unlimited conversations per day; ChatGPT Plus users get 25 GPT-4 messages every 3 hours
Pricing
Free
Free; ChatGPT Plus available for $20/month
Bing Chat is part of search, while ChatGPT is an isolated interface
Both ChatGPT and Bing Chat use OpenAI’s language models, which means that, for the most part, they generate very similar results.
The biggest difference between them is that Bing Chat is also powered by Microsoft’s Prometheus, a model that integrates Bing Search with the AI tool.
Marketed as a “co-pilot” for the web, Bing Chat distills the latest information from across the web and summarizes it when answering your prompts. It even cites its sources and generates a list of relevant links (as well as pulling in visuals). This is what it looks like within the Bing Chat web interface.
ChatGPT, on the other hand, doesn’t pull in current results from the internet as it’s only been trained on information up until 2021. There’s a simple workaround, though: you can access OpenAI’s native web browser plugin, available on ChatGPT Plus.
The web browser can look through web results and share them with you like Bing can, but I’ve found that it doesn’t integrate visuals like Bing does. The result is a more text-heavy experience, but no less effective.
The downside is that when it comes to researching facts, news stories, or historical events, ChatGPT doesn’t always cite its sources. It doesn’t seem to have a problem citing weather reports, but for other information, it can be a bit hit or miss—unless you specifically instruct it to provide sources. (Which, by the way, I’d recommend, given its tendency to hallucinate.)
In addition to being more reliable with its citations, Bing offers recommendations on what to search for next.
And, if you scroll down on the chat page, Microsoft will return you to its regular search page, with a link to the most recent question you asked the chat.
ChatGPT, on the other hand, feels more mechanical: it doesn’t offer follow-up recommendations, and the web browser you’re using ChatGPT with will have no memory of what you’ve been asking it.
As a whole, Bing AI feels a lot more like a search tool that’ll summarize complex answers for you—giving you the sources if you want to dig deeper into any topic. All without having to search through multiple pages yourself.
You get that same ease with ChatGPT, but it’s a much more isolated experience—it definitely feels like a chatbot, not a search tool.
Bing is integrated into a web browser, which allows for more tailored outputs based on what you’re doing
Bing is integrated into a sidebar, called Discover, on the Microsoft Edge browser, and it includes a few features, called Chat, Composition, and Insights.
Chat
You can chat with Bing Chat directly from the sidebar, without having to go to the Bing Chat webpage. The best part is that when you’re on a website full of information, it answers questions from that page contextually.
Reading a complex article and want the key takeaways? Done. Need to understand a complex concept in simpler terms? Done.
This can be pretty helpful when you need an AI assistant while going through information-dense internet research.
You can still do this with ChatGPT Plus—just feed it a link and ask it to summarize the information—but it’s not seamlessly integrated into the same page you’re on.
The difference just depends on how you like to search for information. But if you don’t mind doing your research in Microsoft Edge, Bing AI is hard to beat for a tailored AI experience.
Insights
Bing has an Insights tab that’ll give you even more information about the page you’re on. It surfaces things like a Q&A, key points, page topics, and related articles.
Scroll all the way down, and you can also get a quick overview of analytics about the website you’re visiting (like domain name, hosting service, and even traffic rank). This is something that ChatGPT doesn’t have, as it’s primarily focused on text generation.
Composition
With ChatGPT, you have to be extremely specific in your prompts; otherwise, the output will be pretty vague and most likely won’t tick all your boxes.
Bing’s Composition feature steers you more toward getting the specific output you want, by giving you ready-made options. Inside the text box, you can write out your prompt, set the tone you’re after, select the format (blog post, email, etc.), and set the length. It feels more like an AI writing generator in that way.
This is pretty handy if you’re not sure how to create prompts that will get you what you’re after, but you can just tell ChatGPT these same things in your prompt, and it’ll do a decent job.
ChatGPT has more powerful integrations and plugins, transforming it into a highly efficient assistant
While Bing Chat is a powerful search tool and a more sophisticated web browser, ChatGPT offers a whole suite of plugins that let you combine AI with other apps to unlock more varied use cases.
For example, with the Expedia plugin, I just tell ChatGPT about a trip I’m thinking of booking, and it’ll immediately surface the cheapest flights it can find via the travel site, along with the link, airport details, duration of flight, and most importantly, the pricing.
It’s so much easier than going through travel sites yourself, adjusting filters, and comparing sites side-by-side. (The hassle.)
Not only that, but the AI will also offer lodgings or other area-specific activities for you to explore. It’s a completely different ballgame compared to its web browser plugin, which refuses to offer any follow-up recommendations.
The best part is you can install a number of ChatGPT plugins to work in tandem. For example, you can ask the AI for a recipe recommendation, get an accurate count of calories (using the Wolfram plugin), and then ask it to create a shopping list (with the Instacart plugin).
It’s practically like having a personal assistant—ideal for those who hate planning ahead for anything. (Ahem.)
Travel and food aside, you can also install the Zapier plugin to automate workflows directly inside the ChatGPT interface. Need the AI to write an email, then save it as a draft? It’ll do it within a matter of seconds.
ChatGPT also integrates with Zapier outside of the plugin, so you can connect it to thousands of other apps and access ChatGPT from the apps you use most. Here are some examples of tasks you can automate.
Create Notion tasks using ChatGPT conversations generated from new Slack reactions
Zapier is the leader in no-code automation—integrating with 5,000+ apps from partners like Google, Salesforce, and Microsoft. Build secure, automated systems for your business-critical workflows across your organization’s technology stack. Learn more.
Bing AI can generate images using DALL·E, but ChatGPT is better at generating long-form content
One of the best—and most surprising—things about Bing is that it can generate images for you inside the chat function. That’s without you having to go through another AI image generator, so you can literally do everything—search, create copy, get images—all in the same interface.
Powered by OpenAI’s DALL·E, you can just ask it to create a pic, and it takes a matter of seconds to deliver.
Imagine you’re a travel writer. This could be a workflow you follow: You ask Bing about popular spots in New York using the chat feature. Then you ask the composition feature to create a blog post about New York. After that, you can ask Bing to create a blog hero image. That’s not a super nuanced example, but you get the gist.
In that regard, ChatGPT can’t really compare, as it’s purely text-based.
But while we’re talking about strengths, ChatGPT is a lot better at providing longer-form content like articles or case studies. No matter how I tweaked the prompt, whenever I asked Bing to create a 1,000-word blog post, it repeatedly ignored those instructions and created a piece under 500 words.
ChatGPT doesn’t have that problem. It’s a good listener.
Bing Chat vs. ChatGPT: Which should you use?
Both ChatGPT and Bing can be handy writing tools and informative chatbots—but the better one depends on your actual use case.
If you want a powerful research tool that’s integrated with a web browser (and which shines in terms of in-depth page insights, image generation, and citing reputable sources), Bing Chat is your best bet.
If, however, you want to have an AI-powered personal assistant that can perform actions for you in different apps, there’s no contest: ChatGPT wins because of its suite of plugins.
The best way to know what works for you? Try them both out.
On April 25, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting (XSS) vulnerability in W3 Eden’s Download Manager plugin, which is actively installed on more than 100,000 WordPress websites, making it one of the most popular download management plugins. The vulnerability enables threat actors with contributor-level permissions or higher to inject malicious web scripts into pages using the plugin’s shortcode.
All Wordfence Premium, Wordfence Care, and Wordfence Response customers, as well as those still using the free version of our plugin, are protected against any exploits targeting this vulnerability by the Wordfence firewall’s built-in Cross-Site Scripting protection.
We contacted W3 Eden on April 25, 2023, and promptly received a response. After providing full disclosure details, the developer released a patch on May 1, 2023. We would like to commend the W3 Eden development team for their prompt response and timely patch.
We urge users to update their sites with the latest patched version of Download Manager, version 3.2.71 at the time of this writing, as soon as possible.
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpdm_members’, ‘wpdm_login_form’, ‘wpdm_reg_form’ shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Technical Analysis
Download Manager is a plugin designed to allow WordPress users to manage, track and control file downloads. It provides a shortcode ([wpdm_members]) that lists the authors and the number of files they have added when added to a WordPress page. However, insecure implementation of the plugin’s shortcode functionality allows for the injection of arbitrary web scripts into these pages. Examining the code reveals that the members method in the User class did not adequately sanitize the user-supplied ‘sid’ input, and then loads the members.php view file, where it also did not adequately escape ‘sid’ output. This makes it possible to inject attribute-based Cross-Site Scripting payloads via the ‘sid’ attribute.
There are two other shortcodes, a login form shortcode ([wpdm_login_form]) and a registration form shortcode ([wpdm_reg_form]), that add forms to a WordPress site. However, the insecure implementation of these two shortcode functions, similar to the previous example, also allows arbitrary web scripts to be inserted into these pages. Examining the code reveals that the functions of both forms do not adequately sanitize the user-supplied ‘logo’ input, and in the view files these ‘logo’ outputs are not adequately escaped.
These make it possible for threat actors to carry out stored XSS attacks. Once a script is injected into a page or post, it will execute each time a user accesses the affected page. While this vulnerability does require that a trusted contributor account is compromised, or a user be able to register as a contributor, successful threat actors could steal sensitive information, manipulate site content, inject administrative users, edit files, or redirect users to malicious websites which are all severe consequences.
Disclosure Timeline
April 25, 2023 – Wordfence Threat Intelligence team discovers the stored XSS vulnerability in Download Manager and initiates responsible disclosure. April 27, 2023 – We get in touch with the development team at W3 Eden and send full disclosure details. May 1, 2023 – The fully patched version, 3.2.71, is released. May 3, 2023 – The vendor notified Wordfence that they released the patch. May 3, 2023 – Wordfence confirms the fix addresses the vulnerability.
Conclusion
In this blog post, we have detailed a stored XSS vulnerability within the Download Manager plugin affecting versions 3.2.70 and earlier. This vulnerability allows authenticated threat actors with contributor-level permissions or higher to inject malicious web scripts into pages that execute when a user accesses an affected page. The vulnerability has been fully addressed in version 3.2.71 of the plugin.
We encourage WordPress users to verify that their sites are updated to the latest patched version of Download Manager.
All Wordfence users, including those running Wordfence Premium, Wordfence Care, and Wordfence Response, as well as sites still running the free version of Wordfence, are fully protected against this vulnerability.
If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.
As cyber threats continue to evolve, security professionals require reliable tools to defend against security vulnerabilities, protect sensitive data, and maintain network security. Open source cyber security tools provide a cost-effective solution for individuals and organizations to combat these threats on-premises and with cloud security and mobile devices. Let’s consider the top 25 open-source cyber security monitoring tools in 2023 that help ensure continuous network and system performance monitoring.
As cyber threats continue to evolve and become more sophisticated, organizations must stay informed and prepared to defend against a wide range of security risks.
Here are the top cybersecurity threats that businesses and individuals should be aware of today:
1. Phishing Attacks: Phishing attacks are a prevalent form of social engineering where cybercriminals use deceptive emails or websites to trick users into revealing sensitive information or installing malware. These attacks often target login credentials, financial information, and other personal data.
2. Ransomware: Ransomware is a type of malicious software that encrypts a victim’s files or locks their systems, demanding a ransom payment to restore access. Ransomware attacks can cause significant financial losses and operational disruptions for organizations.
3. Insider Threats: Insider threats refer to security risks posed by employees, contractors, or other individuals with authorized access to an organization’s systems and data. These threats can result from malicious intent or negligence, leading to data breaches or system compromises.
4. Supply Chain Attacks: Also known as third-party attacks or vendor risk, supply chain attacks target an organization’s suppliers, vendors, or partners to gain access to their systems and data. These attacks often exploit security vulnerabilities in the supply chain to compromise multiple organizations.
5. Distributed Denial of Service (DDoS) Attacks: DDoS attacks involve overwhelming a target’s network or system with a flood of traffic, rendering it inaccessible to legitimate users. DDoS attacks can cause severe downtime and service disruptions.
6. Advanced Persistent Threats (APTs): APTs are sophisticated, coordinated cyberattacks by well-funded threat actors or nation-state groups that target specific organizations for espionage, data theft, or sabotage. APTs often use advanced techniques and tactics to evade detection and maintain a long-term presence within a target’s network.
7. Zero-Day Exploits: Zero-day exploits are attacks that take advantage of previously unknown security vulnerabilities in software or systems. These vulnerabilities, also known as zero-day flaws, have no existing patches or fixes, making them particularly dangerous and challenging to defend against.
8. Internet of Things (IoT) Security: The increasing adoption of IoT devices and connected technologies has expanded the attack surface for cybercriminals. IoT devices are often vulnerable to cyber threats due to weak security measures, creating new risks for organizations and consumers.
9. Data Breaches: Data breaches occur when unauthorized individuals gain access to an organization’s sensitive data, such as customer information, financial records, or intellectual property. Data breaches can result in significant financial and reputational damage for organizations.
10. Cloud Security Threats: As more organizations migrate to cloud-based services, cloud security has become a critical concern. Threats in the cloud can arise from misconfigurations, weak authentication mechanisms, and vulnerabilities in cloud applications or infrastructure.
Benefits of Open-Source CyberSecurity tools
Open source cyber security monitoring tools offer numerous advantages over proprietary solutions, making them an attractive option for businesses, organizations, and individuals looking to enhance their security posture and perform effective security testing.
Here are some key benefits of using open-source tools for cyber security monitoring for monitoring services that pose security threats, even if you have another network monitoring system. Proper cybersecurity monitoring and access management are key to maintaining a secure environment.
Cost-Effectiveness
One of the most significant benefits of open-source cyber security tools is their cost-effectiveness. With no licensing fees or subscription costs, these free tools enable security teams to access powerful network monitoring solutions without breaking the bank.
This particularly benefits small businesses and startups with limited budgets, allowing them to allocate resources to other critical areas.
Customizability and Flexibility
Open-source network monitoring tools offer high customizability and flexibility, allowing security professionals to tailor the tools to their specific needs. This adaptability enables organizations to address unique security threats and vulnerabilities, ensuring a more robust security posture.
Additionally, the ability to integrate these tools with existing security infrastructure adds an extra layer of protection to network security.
Rapid Development and Updates
The open-source community is known for its rapid development and frequent updates. As new security threats and vulnerabilities emerge, open-source cyber security tools are often among the first to receive patches and updates.
This continuous monitoring and proactive response help organizations stay ahead of potential security risks and maintain a strong security posture.
Extensive Support and Collaboration
Open-source cyber security tools benefit from an extensive support network, comprising developers, users, and experts from around the world.
This collaborative environment fosters knowledge sharing, allowing security professionals to learn from one another and develop more effective security strategies.
Additionally, the availability of comprehensive documentation and online forums makes it easier for users to troubleshoot issues and enhance their understanding of network monitoring and security.
Improved Security and Transparency
With their source code openly available for inspection, open-source cyber security tools offer greater transparency than proprietary alternatives. This transparency allows security professionals and researchers to scrutinize the code for potential security vulnerabilities and ensure its integrity.
Moreover, the collaborative nature of the open-source community means that any identified issues are addressed quickly, further enhancing the overall security of these tools.
Platform Independence and Interoperability
Open-source network monitoring software often supports a wide range of operating systems, including Windows, macOS, and Linux, allowing organizations to deploy these tools across diverse environments.
This platform independence and interoperability help organizations ensure comprehensive network monitoring, regardless of the underlying infrastructure.
Top 25 Open Source Cyber Security Monitoring Tools in 2023
Note the following free cyber security monitoring tools in 2023 and the open-source list of solutions you can take advantage of and no free trial needed.
1. Wireshark: Network Protocol Analyzer
Wireshark is a widely-used network protocol analyzer that enables security teams to troubleshoot, analyze, and monitor network traffic in real-time to detect security issues. It is a defacto standard network monitoring tool.
command line interface data packets open source platform data breaches packet capture web apps network packets computer security experts solarwinds security event manager security scanning
By dissecting network protocols, Wireshark provides valuable insights into potential security risks and network vulnerabilities, allowing professionals to identify and resolve issues efficiently with the Wireshark network monitoring solution.
You can monitor a wide range of protocols, including TCP/IP, simple network management protocol, FTP, and many others. If you are looking for a network monitor this is it.
2. Snort: Network Intrusion Detection and Prevention System
Snort is a powerful open-source intrusion detection and prevention system (IDPS) that monitors network traffic and detects potential security threats.
It provides real-time traffic analysis, packet logging, and alerting capabilities, making it an essential tool for security auditing and network monitoring.
3. OSSEC: Host-Based Intrusion Detection System
OSSEC is a comprehensive host-based intrusion detection system (HIDS) that offers log analysis, file integrity checking, rootkit detection, and more.
It supports various operating systems, including Linux, Windows, and macOS, and helps security professionals monitor and analyze network protocols for potential security vulnerabilities.
4. Security Onion: Intrusion Detection and Network Security Monitoring Distribution
Security Onion is a Linux distribution specifically designed for intrusion detection, network security monitoring, and log management.
With a suite of powerful open-source tools, including Snort, Suricata, and Zeek, Security Onion provides a robust solution for security teams to monitor networks and detect security breaches.
5. Nmap: Network Scanning and Discovery Tool
Nmap is a versatile network scanning and discovery tool that helps security professionals identify network devices, open ports, and running services.
It is an essential network monitoring software for vulnerability management, penetration testing, and network inventory management.
6. Kismet: Wireless Network Detector, Sniffer, and Intrusion Detection System
Kismet is a wi fi security tool that detects, sniffs, and analyzes wireless networks. By monitoring wireless network traffic, Kismet identifies potential security risks, network vulnerabilities, and unauthorized users, making it an invaluable tool for wireless network security.
7. Suricata: High-Performance Network Intrusion Detection and Prevention Engine
Suricata is an open-source, high-performance network intrusion detection and prevention engine that provides real-time network traffic analysis, threat detection, and alerting.
Suricata enables security professionals to maintain network integrity and security by employing advanced threat defense and anomaly detection techniques.
8. Zeek (formerly Bro): Network Analysis Framework for Security Monitoring
Zeek, previously known as Bro, is a powerful network analysis framework that offers real-time insight into network traffic.
With its flexible scripting language and extensible plugin architecture, Zeek provides comprehensive visibility into network activity, enabling security teams to detect and prevent security threats.
9. OpenVAS: Vulnerability Scanning and Management Solution
OpenVAS is a comprehensive vulnerability scanning and management solution that helps security professionals identify, assess, and remediate security vulnerabilities.
With its extensive plugin library, OpenVAS ensures continuous monitoring and up-to-date vulnerability information, making it a critical tool for vulnerability management.
10. ClamAV: Open-Source Antivirus Engine
ClamAV is an open-source antivirus engine that detects trojans, viruses, and other malicious software.
It offers a command-line scanner, a graphical user interface (GUI) for Windows operating system, and integration with mail servers, ensuring that your systems are protected from security threats.
11. Fail2Ban: Log-Parsing Application to Protect Against Brute-Force Attacks
Fail2Ban is a log-parsing application that monitors log files for malicious activity, such as repeated failed login attempts. Fail2Ban bans the offending IP address when a potential attack is detected, effectively protecting your network from brute-force attacks and unauthorized access.
12. AlienVault OSSIM: Open-Source Security Information and Event Management Platform
AlienVault OSSIM is an open-source security information and event management (SIEM) platform that provides real-time event correlation, log analysis, and threat intelligence.
By integrating multiple security tools, OSSIM helps security teams maintain a unified user interface and enhance their overall security posture.
13. Cuckoo Sandbox: Automated Malware Analysis System
Cuckoo Sandbox is an open-source automated malware analysis system that enables security professionals to analyze suspicious files and URLs in a safe, isolated environment.
It provides detailed reports on malware behavior, including network traffic analysis, file system changes, and API traces, helping security teams identify and mitigate security risks.
14. Logstash: Log Processing and Management Tool
Logstash is part of the Elastic Stack (ELK Stack) and offers log processing and management capabilities.
It collects, parses, and stores log data from various sources, making it an essential tool for security professionals to monitor and analyze network activity, detect security breaches, and maintain system performance.
15. pfSense: Open-Source Firewall and Router Distribution
pfSense is an open-source firewall and router distribution based on FreeBSD. It offers a powerful and flexible network security, traffic shaping, and VPN connectivity solution.
With its extensive features and customization options, pfSense is ideal for securing web servers and internal networks.
16. ModSecurity: Open-Source Web Application Firewall
ModSecurity is an open-source web application firewall (WAF) providing real-time security monitoring and access control. It detects and prevents web attacks, protects sensitive data, and helps security professionals maintain compliance with industry standards and regulations.
AIDE is a file and directory integrity checker that monitors system files for unauthorized changes. It detects modifications, deletions, and additions, allowing security teams to maintain system integrity and prevent security breaches.
18. Graylog: Open-Source Log Management Platform
Graylog is an open-source log management platform that centralizes and analyzes log data from various sources.
Graylog helps security professionals detect security threats, identify network vulnerabilities, and maintain network security by providing comprehensive visibility into network activity.
19. Wazuh: Security Monitoring and Compliance Solution
Wazuh is a free, open-source security monitoring and compliance solution that integrates host-based and network-based intrusion detection systems, file integrity monitoring and security policy enforcement.
Wazuh’s centralized management and powerful analytics capabilities make it an essential tool for security teams to detect and respond to security threats.
20. T-Pot: Honeypot Platform
T-Pot is a platform combining multiple honeypots into a single, easy-to-deploy solution for cyber security monitoring. By simulating vulnerable systems and services, T-Pot attracts attackers and collects threat data, providing valuable insights into current attack trends and techniques.
Honorable mentions
Samhain: Host-Based Intrusion Detection System
Samhain is a host-based intrusion detection system (HIDS) that provides file integrity checking and log file monitoring. It detects unauthorized modifications, deletions, and additions, helping security professionals maintain system integrity and prevent security breaches.
SELKS: Network Security Management ISO with Suricata
SELKS is a live and installable network security management ISO based on Debian, focusing on a complete and ready-to-use Suricata IDS/IPS ecosystem. It offers a user-friendly interface and powerful analytics tools, making it an ideal choice for security teams to monitor networks and detect potential security threats.
Squid: Open-Source Web Proxy Cache and Forward Proxy
Squid is an open-source web proxy cache and forward proxy that improves web performance and security. By caching frequently-requested web content and filtering web traffic, Squid helps reduce bandwidth usage, enhance user privacy, and protect against web-based security threats.
YARA: Pattern-Matching Tool for Malware Researchers
YARA is a pattern-matching tool designed for malware researchers to identify and classify malware samples. By creating custom rules and signatures, YARA enables security professionals to detect and analyze malicious software, enhancing their understanding of current malware trends and techniques.
Arkime (formerly Moloch): Large-Scale, Open-Source, Indexed Packet Capture and Search System
Arkime is a large-scale, open-source, indexed packet capture and search system that provides comprehensive visibility into network traffic. It enables security professionals to analyze network protocols, detect security vulnerabilities, and identify potential security threats, making it an essential tool for network monitoring and security auditing.
Tips to Improve Your Cybersecurity Posture
Improving your cybersecurity posture is essential for safeguarding your organization from various cyber threats. Here are some practical tips to help enhance your cybersecurity defenses:
Implement Regular Security Audits: Conducting routine security audits can help identify potential weaknesses in your organization’s cybersecurity infrastructure.
This includes checking for outdated software, misconfigured settings, and other vulnerabilities that may expose your systems to attacks.
Keep Software and Systems Updated: Regularly update your software, operating systems, and firmware to protect against known vulnerabilities and exploits.
This includes applying security patches and updates as soon as they become available.
Use Strong Authentication Mechanisms: Implement multi-factor authentication (MFA) for all critical systems and applications.
MFA adds an extra layer of security by requiring users to provide additional verification, such as a one-time code or biometric authentication, in addition to their password.
Encrypt Sensitive Data: Encrypt sensitive data both in transit and at rest to prevent unauthorized access. This includes using secure communication protocols, such as HTTPS and TLS, and implementing encryption solutions for data storage.
Establish a Strong Password Policy: Enforce a robust password policy that requires users to create complex, unique passwords and update them regularly. Additionally, consider using a password manager to help users manage and store their passwords securely.
Educate Employees on Cybersecurity Best Practices: Provide ongoing security awareness training to educate employees about common cyber threats, safe online practices, and how to recognize and report potential security incidents.
Implement Network Segmentation: Divide your network into smaller segments, isolating critical systems and data from less secure areas. This can help prevent the spread of malware and limit the damage in case of a security breach.
Regularly Backup Important Data: Regularly back up essential data and store copies offsite or in the cloud. This ensures that you can quickly recover from data loss or ransomware attacks.
Utilize Endpoint Security Solutions: Deploy comprehensive endpoint security solutions to protect devices connected to your network.
This includes antivirus software, firewalls, intrusion detection and prevention systems, and device management tools.
Monitor and Analyze Network Traffic: Use network monitoring tools to analyze network traffic, detect anomalies, and identify potential security threats. Regular monitoring can help detect and respond to security incidents more effectively.
Develop a Cybersecurity Incident Response Plan: Create a detailed incident response plan outlining the steps to take in a security breach. Regularly review and update the plan, and ensure that all employees are familiar with the procedures.
Collaborate with Security Professionals: Engage with cybersecurity experts or managed service providers to help develop and maintain a strong security posture.
This can provide access to specialized knowledge and resources to stay up-to-date with the latest threats and best practices.
Frequently Asked Questions (FAQs)
1. What are the best open-source cyber security monitoring tools available in 2023?
This blog post covers the top 25 open-source cyber security monitoring tools in 2023, including Wireshark, Snort, OSSEC, Security Onion, Nmap, Kismet, Suricata, Zeek, OpenVAS, ClamAV, and more.
These tools provide comprehensive network monitoring, threat detection, and vulnerability management capabilities to help organizations maintain a robust security posture.
Open-source cyber security monitoring tools offer several advantages: cost-effectiveness, customizability, rapid development and updates, extensive support, improved security, and platform independence.
These benefits make open-source tools attractive for organizations looking to enhance their network security and protect sensitive data.
3. How can I improve my organization’s cybersecurity hygiene?
In addition to utilizing open-source cyber security monitoring tools, organizations can improve their cybersecurity hygiene by implementing security awareness training, regularly updating software and systems, employing strong password policies, using multi-factor authentication, monitoring network traffic, and conducting regular security audits and penetration testing.
4. What is the importance of continuous monitoring in cybersecurity?
Continuous monitoring plays a crucial role in identifying and addressing security threats and vulnerabilities in real-time.
By regularly analyzing network traffic, security professionals can detect potential issues, respond to incidents promptly, and ensure the safety and integrity of their digital assets.
5. How can I protect my web applications from security threats?
Web application security can be improved by using tools such as ModSecurity, an open-source web application firewall (WAF) that provides real-time application security monitoring and access control.
Regularly updating web applications, conducting vulnerability assessments, and implementing secure coding practices can also help mitigate security risks.
6. What role do threat intelligence and threat data play in cybersecurity?
Threat intelligence and threat data help security professionals understand the latest trends, tactics, and techniques cybercriminals use.
Organizations can proactively address potential issues and maintain a strong security posture by staying informed about emerging threats and vulnerabilities.
7. Are open-source cyber security monitoring tools suitable for small businesses and startups?
Yes, open-source cyber security monitoring tools are ideal for small businesses and startups, as they offer cost-effective and powerful network monitoring solutions.
These tools enable organizations with limited budgets to access advanced security features without incurring high licensing fees or subscription costs.
Wrapping up
The ever-evolving landscape of cyber threats demands reliable and effective tools for security professionals to protect networks, systems, and sensitive data.
These Top 20 open-source cyber security monitoring tools in 2023 provide a comprehensive network monitoring, threat detection, and vulnerability management solution.
By incorporating these tools into your security strategy, you can enhance your overall security posture and ensure the safety and integrity of your digital assets.
Gets the password policy from the logged in domain
Get-ADDefaultDomainPasswordPolicy
Backup Active Directory System State Remotely
This will back up the domain controllers system state data. Change DC-Name to your server name and change the Backup-Path. The backup path can be a local disk or a UNC path
invoke-command -ComputerName DC-Name -scriptblock {wbadmin start systemstateback up -backupTarget:"Backup-Path" -quiet}
Start-ADSyncSyncCycle -PolicyType Delta Force a full sync Start-ADSyncSyncCycle -PolicyType Initial
Get A List of All Office 365 Users
Get-MsolUser | Select DisplayName, City, Department, ObjectID
Get Full mailbox details
Get-Mailbox email-address | fl
Get Calendar Permissions
Get-MailboxFolderPermission username:calendar
Enable Remote Mailbox (Hybrid Environment)
Use this command if you have an existing on-premise user that needs an office 365 mailbox. There are other ways to do this but this creates all the attributes in the AD account.
Use this command to copy an entire folder to another folder. This will copy the folder and all the sub folder/files. The -verbose command will display the results to the console.
This will display all commands that are available based on the modules that are loaded.
get-command
Find New Modules
Replace *ntfs* with the keyword you want to search for. This searches modules at https://www.powershellgallery.com/
Find-Module *ntfs*
Install a New Module
Installs modules from https://www.powershellgallery.com/
I found a module called NTFSSecurity, to install it I run this command
install-module NTFSSecurity
Recommended Tool: SolarWinds Hybrid Systems Monitor
Monitor your physical and virtual servers with ease and troubleshoot more easily when downtime or other application performance issues occur.
What I like best about this tool is it’s easy-to-use dashboard and built-in alerting. See key metrics to help identify issues before users complain.
Monitor Active Directory, DNS, DHCP, and other critical IT systems, both locally and cloud hosted. Get automated email alerts and know which applications are having issues in your environment.
Are you aware of the WordPress email deliverability best practices?
If you send any emails from a WordPress site, this is a really important topic. Email deliverability is affected by a variety of factors so this may seem tricky at first.
But the good news is, many of these factors are controllable. Following a few best practices can go a long way in helping you maintain high deliverability rates at all times.
We’ll be covering the top tips for improving WordPress email deliverability in this article. Let’s dive in!
How Do I Stop My Emails From Going to Spam in WordPress?
In WordPress, emails are usually delivered using the default PHP mailer. The problem is the PHP mailer function lacks authenticating elements in an email, which frequently leads to your emails being marked spam or blocked altogether.
The best way to stop your emails from ending up in spam is to use a Simple Mail Transfer Protocol (SMTP) plugin like WP Mail SMTP.
SMTP plugins help provide crucial authentication details for domains linked to a WordPress site and are an excellent way to bypass most email deliverability challenges.
In the next section, we’ll dive deeper to discover how SMTP helps and what some of the top email deliverability tactics are.
WP Mail SMTP is the best tool for fixing WordPress email deliverability challenges.
Authentication is the biggest issue with WordPress emails. As we’ve mentioned, the default WordPress PHPMailer just isn’t effective at this.
What this means is that when you send emails from a domain on a WordPress site, mailbox providers have no way of telling if the emails are really coming from your domain. This is a problem because spammers and hackers have developed ways to impersonate legitimate domains.
But with WP Mail SMTP, you can connect your WordPress site to popular SMTP mailer services like Postmark, Sendinblue, SendLayer, and more. These mailer services add proper authentication details to your emails, so that the recipient’s email server can easily verify your legitimacy as the sender.
SMTP mailers also use DNS records like DMARC, SPF, and DKIM to further increase your legitimacy and offer protection from email spoofers.
In addition to being an excellent solution for improving your email deliverability, WP SMTP also offers useful tools such as email tracking and email logs that allow you to monitor your emails right from your WordPress dashboard.
Sender reputation is a crucial metric that mailers use in determining the trustworthiness of a domain. A bad sender reputation will typically mean your emails will get blocked or go to spam.
The good news is that you can track the sender reputation for your domain and take the necessary steps to protect it. Here’s how to check:
Grab your IP address and head over to the Talos Intelligence Reputation Lookup site. On the homepage, pop in your email domain’s IP address. If you’re not sure what this is, you may ask your hosting service.
The tool will then generate a sender reputation report with a few different metrics, including your email reputation.
If your score is too low, you’ll know that you’ll likely have some email deliverability issues due to the poor sender reputation of your domain.
One thing you can do to fix this right away is to use a different domain for sending your emails.
But if your email reputation is good, then you’re unlikely to face any deliverability problems.
3. Ensure Your IP Address Isn’t on a Blocklist
Your IP address can end up on a blocklist for a number of reasons. One of them is simply using shared hosting.
You can check if your IP address is on a blocklist and then reach out to the service that has blocklisted your IP address and ask to have it removed. MxToolbox is an excellent tool for checking if you’ve been blocklisted and by whom.
Once they’re sure that your website doesn’t pose any security threats, your IP address may be removed from the list.
4. Track Email Statistics
Tracking your email statistics is super important because it allows you to measure how well your emails are being received by your users.
If your emails are bouncing or aren’t getting opened at all, these could be pointers to an underlying problem that you’ll want to fix immediately.
Remember, things like low engagement rates, bounced emails, and users unsubscribing from your email lists can lead to a poor sender reputation.
Fortunately, it’s easy to track your email stats using WP Mail SMTP, which you should already be using to provide authentication for your domain. WP Mail SMTP provides tracking data on emails you’ve sent right within the WordPress dashboard.
The data you’ll garner this way will help you modify your email campaigns to improve engagement, which is a key factor influencing domain reputation.
5. Consider Using Subdomains for Different Types of Emails
In general, you’ll either be sending out transactional emails—things like receipts or thank you emails, or marketing emails.
It’s a good practice to create separate subdomains for these purposes. That’s because mailing servers treat subdomains as entirely separate domains, so the reputation of one doesn’t affect that of the other.
Using a subdomain prevents unsubscribes and spam reports from your marketing campaigns from affecting the deliverability of transactional emails sent from your too domain, which often contain crucial information.
Most mailers allow you to create subdomains. However, SendLayer stands out because it automatically creates a subdomain when you sign up, in order to help protect your root domain. So you won’t have to perform any extra steps to get a subdomain with SendLayer.
If you’re a beginner and would like a little more info, here’s a comprehensive guide to get started with email subdomains.
6. Only Send Emails to Users Who’ve Opted In
This point is really important. Sending emails to users who haven’t opted-in to receive those emails is a violation of the law in certain regions.
And more importantly, when it comes to email deliverability, unsolicited emails tend to have a really high unsubscribe rate, which can get your domain blocklisted rapidly. Fortunately, this is straightforward when you use these WordPress Newsletter plugins.
Make sure that your emails are sending successfully when a user is registering on your site. See our guide on how to fix user registration emails for more info.
7. Practice Email Segmentation
We’ve just talked about only sending marketing emails to users who’ve specifically opted in to receive them.
Another thing you can do to keep the highest levels of user engagement is to send users marketing emails only about topics they’ve indicated an interest in. This is email segmentation.
By sending users emails that are more focused on their needs, you’ll likely have much better engagement and much lower unsubscribes.
8. Don’t Use a Shared Server
Shared hosting plans—where you share a server with other users are quite common, but they aren’t always a good idea. One reason for this is the fact that shared hosting plans are frequently used for spam.
When too much spam comes from one source, that IP address usually gets blocked. To prevent this, most hosting services actually block SMTP on your email server.
If you can afford it, using a virtual server is a much better setup for email deliverability and will help to cut out most email deliverability issues straightaway.
The quickest way to ruin your sending reputation is to send out loads of emails that then result in lots of people unsubscribing or reporting your emails as spam.
A better approach is a tactic called IP warming. Essentially, IP warming is where you gradually scale up the number and frequency of emails you send from a particular domain over an initial period.
This could be anywhere from a couple of weeks to a couple of months. IP warming is a particularly good idea for newer domains.
And there you have it! Use these WordPress email deliverability best practices and your emails will never end up in spam again.
10. Get Users to Whitelist Your Domain’s IP Address
In addition to getting your subscribers to opt into your email lists explicitly, one additional step you can take is asking them to whitelist the IP address of your sending domain.
Whitelisting is basically setting up your mailboxes’ spam filters to allow emails from specific domains. This is a straightforward process that can usually be done within a user’s mailbox settings.
11. Don’t Send Emails From a Fake Address
One common email delivery mistake is sending emails from a fake address, different from your real email domain.
You can typically set your emails up to display any from address you want, but if this is different from your real root email domain, you’re very quickly going to find the root domain blocklisted. The best practice is to use your legitimate email domain or any subdomains related to it.
And that is it for our guide to the top email deliverability best practices! Now you can get out there and apply these tips to watch your email deliverability soar!
Next, Check Out The Best WordPress Email Plugins
We’ve just shared our list of the top email deliverability tactics for WordPress sites. Next, you might be interested in learning what some of the top tools for WordPress email are.
Ready to fix your emails? Get started today with the best WordPress SMTP plugin. WP Mail SMTP Elite includes a full White Glove Setup and offers a 14-day money-back guarantee.
If this article helped you out, please follow us on Facebook and Twitter for more WordPress tips and tutorials.
Are you looking for the best Google Workspace plugins for your WordPress website?
Google Workspace (formerly G-Suite) offers various useful tools that most businesses use daily. If you have a WordPress website, you’ll be glad to learn that you can easily integrate most Google Workspace apps with WordPress using some handy plugins.
There aren’t many plugins dedicated to G-Suite, but we’ve tested a few to put together our list of the best Google Workspace WordPress plugins to use. Dive right in!
How Do I Use G-Suite in WordPress?
G-Suite or Google Workspace is way too large and complex to be integrated directly into a WordPress site. Instead, you’ll need to install specific plugins that allow you to use individual G-Suite apps on your WordPress site.
WP Mail SMTP is the best WordPress Simple Mail Transfer Protocol (SMTP) plugin that helps you fix delivery problems in WordPress and allows you to integrate with Google Workspace apps.
WP Mail SMTP connects with various popular SMTP mailers, including Gmail, for sending your WordPress emails.
Apart from sending your WordPress emails via Gmail as your mailer, you can also integrate Google Sheets with WP Mail SMTP.
Using this integration, you can create useful automation between Google Sheets and WP Mail SMTP using another plugin called Uncanny Automator.
For instance, WP Mail SMTP is a great tool for tracking and monitoring the performance of your WordPress emails. But you can also track email clicks and opens in a spreadsheet by integrating WP Mail SMTP with Google Sheets, allowing you to view your email data outside of your WordPress environment.
Other than these Google Workspace integrations, WP Mail SMTP also offers useful features such as detailed email logs, email reports, email failure notifications, and so on.
For WordPress beginners, or if you just don’t have the time to dedicate to working on your site, you can use WP Mail SMTPs’ white glove setup to get your emails up and running in no time.
WP Mail SMTP Pricing: WP Mail SMTP starts at $49 per year.
WPForms is the best WordPress form builder, and is the easiest way to connect your forms with G-Suite.
To start with, you’ll love the flexibility and ease of use that WPForms offers when it comes to form building. But that’s not all, the plugin provides a number of helpful integrations to improve your workflow efficiency and productivity.
These include a native Google Sheets integration that makes it super easy to send entries from a form to one of your Google Sheets spreadsheets. There’s so much you can do with this integration!
For example, if you’re looking to create surveys to collect feedback from clients, staff, and so on, you’ll easily be able to do this using the WPForms surveys addon. This addon allows you to create a survey form with automated Google Sheets tracking.
And what about nonprofits? Want to track donations for better transparency? With the WPForms prebuilt donation form template, you can easily collect donations using a PayPal Commerce field or one of the other payment fields offered by WPForms.
With over 500 prebuilt WPForms templates for you to choose from, there are so many more ways you can combine WPForms and Google Sheets to create powerful, convenient workflows.
The best part is you won’t even need an extra plugin like Uncanny Automator since WPForms natively supports integration with Google Sheets. To enjoy these awesome features, you’ll need a WPForms Pro or Elite license.
WPForms Pricing: To access the Google Sheets addon, you’ll need a WPForms Pro license or higher, starting at $199.50 annually.
AffiliateWP is the most powerful affiliate program builder and management tool for WordPress sites. If you’re building an affiliate program, you’ll be delighted to learn that you can easily integrate AffiliateWP with G-Suite for easy data management.
You’ll simply need to install Uncanny Automator, and then you can set up an Uncanny Automator recipe to save data in Google Sheets.
We’ve tried this integration out, and we found that it’s incredibly easy to set it all up. What’s more, we were able to set up a connection that allowed us both to trigger events in Google Sheets as well as a connection that allowed actions in Google Sheets to trigger events in AffiliateWP.
So, for example, you’ll be able to keep track of affiliates, new referrals, and so on in a Google Sheets spreadsheet.
You’ll also be able to do the reverse by creating new affiliates and referrals simply by updating a row in the spreadsheet. Pretty neat, right? For more details, check out this guide to integrating AffiliateWP with Google Sheets.
AffiliateWP Pricing: AffiliateWP starts at $149.50 per year.
Like WPForms, Formidable Forms offers a native Google Sheets integration that allows you to easily update your spreadsheets with data from your forms.
Considering how similar this is to the WPForms Google Sheets integration, it’s understandable if you’re unsure which of the two form builders is the right one for you.
If you’re a small business looking for powerful, yet easy to use forms to grow your business, we’d strongly recommend using WPForms. With over 5 million active installations, and 11k+ 5-star reviews on WordPress.org, it’s easy to see why: WPForms offers an unbeatable collection of features at extremely competitive pricing.
Formidable Forms, on the other hand, is much better suited for advanced users, with niche use cases. For example, one of Formidable Forms’ stand out features is its complex in-form calculation field.
Formidable Forms Pricing: To use the Google Sheets integration, you’ll need the Formidable Forms Business license which starts at $199.50 per year.
MemberPress is an excellent choice for building a WordPress membership site that integrates with G-Suite.
For this one, you’ll need to use Zapier to create a connection between MemberPress and Google Drive, which is an arrangement for data storage and management.
One thing we loved when we tried this connection out was the fact that it allows for two-way automations. This means that actions in either MemberPress or Google Drive can trigger events in the other.
This would allow you to automate things like creating a new row to record a new MemberPress sign-up or cancellation.
Aside from this powerful G-Suite integration, you’ll love the flexibility that MemberPress gives you in creating fully-featured online membership sites such as an online course website.
MemberPress Pricing: MemberPress starts at $179.50 for its Basic plan.
Uncanny Automator is by far the best WordPress plugin for creating automations and integrations between plugins, external apps, and even multiple websites.
As you’ll have noticed, we’ve talked quite a bit about Uncanny Automator. This is because it is such a powerful plugin that offers tons of ways to connect WordPress sites to G-Suite apps.
With Uncanny Automator installed on your site, you’ll be able to create rules called recipes, that allow for the automation of the functions of several plugins, apps, or websites.
Some of the major apps you can connect your site to using Uncanny Automator include Google Sheets, Gmail, Google Drive, and more. Now here’s some really good news: you can download Uncanny Automator for free from the WordPress plugin directory, with 1,000 connections to get you started.
Uncanny Automator Pricing: Paid Uncanny Automator licenses start at $149 per year.
Sugar Calendar is the top WordPress event management plugin. Looking to add booking functionality to your site, sell tickets for events, and so on?
This is the plugin to use. Sugar Calendar integrates quite nicely with Google Calendar and other Calendar apps using Sugar Calendar’s Calendar Feeds addon. With this integration setup, your users will be able to create events and sync data for these events with Google Calendar.
This integration is the perfect way for users to schedule events, such as appointments on your site while allowing everyone on your team to easily collaborate to view and manage these bookings on Google Calendar.
When we tried this plugin out, we loved how easy it was to do useful things like create recurring events, specify time zones for specific events, use custom formatting and translation, and so on. Sugar Calendar is also translation ready, which is a huge plus.
Sugar Calendar Pricing: You’ll need the Calendar Feeds addon, which is available for free with the Professional license that starts at $199 per year.
OptinMonster is the number 1 WordPress lead generation plugin and the easiest way to create opt-in forms in WordPress.
What’s more, you can easily connect OptinMonster and Google Sheets using Uncanny Automator. This connection will allow you to automatically send entries to a Google spreadsheet when users submit an opt-in form.
In addition to being able to integrate OptinMonster with Google sheets, you’ll love lots of the features on offer, including things like the easy-to-use drag-and-drop form builder, geo-location targeting, exit-intent technology, and so much more.
OptinMonster Pricing: OptinMonster starts at 9$ per month (billed annually) for its Basic plan.
Fortunately, plugins like UpdraftPlus make it easy to automate this process. Once you’ve chosen the backup frequency you prefer, all you have to do is keep up with backup reports, which will be delivered to our email.
And if you’re looking for a way to integrate UpdraftPlus with G-Suite, the answer is yes! UpdraftPlus will allow you to select from a number of destinations for your backup files, which include several useful G-Suite apps like Gmail and Google Drive.
UpdraftPlus Pricing: UpdraftPlus premium starts at $70 per year.
And that’s it for our list of the top 9 WordPress G-Suite plugins! Whatever your needs, one of these plugins is bound to serve you well!
Next, Try These Top Zapier Alternatives
Zapier is one of the top tools for optimizing digital workflows. But it’s not the best tool for every situation. Some other tools, like Uncanny Automator, offer better solutions for WordPress sites, and there are other options to consider too.
Ready to fix your emails? Get started today with the best WordPress SMTP plugin. WP Mail SMTP Elite includes a full White Glove Setup and offers a 14-day money-back guarantee.
If this article helped you out, please follow us on Facebook and Twitter for more WordPress tips and tutorials.
