Imagine for a minute that you're a web agency. You've got anywhere from 20 to 50 sites
that you're managing and that your maintaining. Most of these sites were built on
WordPress—about 95 percent of them.
But out these WordPress sites, all of them were built
with themes from ThemeForest or Template Monster.
And you chose these themes because they got you
85 to 90 percent of the way to your goal.
And the last 10 or 15 percent of the web development you did
in-house. You modified everything. But here's what you didn't know.
In September 2014, it was announced
that Revolution Slider and ShowBiz Pro had security
vulnerabilities that would allow attackers to take
over a site. It allowed them direct access to the database files
and the WP config file. The problem is this was patched
in February 2014, silently—
underneath the radar. This plugin was not updated
for anyone who bought a theme that had this plugin
already bundled into it. Normally, when you log in the wp-admin section,
you see the list of plugins and themes that need to be updated.
These plugins—and there's many more—it's not just this one company—there's many other
other plugins
that are bundled into themes—you'll never see if these need to be updated,
ever. So the web developers at these shops—at these web design firms
have to go through and upload the plugin files
to each of these sites manually. Fast-forward to
December 2014. The same
vulnerability is now being exploited by a malware injector called SoakSoak.
It injects malware into a site. It redirects
people to a Russian site called SoakSoak.ru,
and it can potentially infect other people's computers
of people who are visiting those sites. Over a hundred thousand sites were affected
by this [in December 2014].
This was a hundred thousand people who either didn't have their plugin updated,
didn't take the update seriously, were doing it by themselves [building a site],
or their web agency
was no longer involved. This is a big problem. Now, do-it-yourself-ers only
account for about 2 percent of all web sites that are built successfully.
The other 98 percent of all sites successfully built in the US and Canada
are built with the help of a developer or
a web agency. This means out of those 100,000 sites that
98,000 of those sites that are still infected
were built with a developers help. Ask yourself
this series of questions: If you are a web agency—
if you're any type of independent developer, web firm—whatever it is—
if you're buying themes that have plugins already
bundled into them, how do you know when those plugins need updates?
Do you have somebody checking each and every site? Do you have a list of every
plugin that's bundled in every theme?
On every client site that you manage? And are you checking that list?
So when you find out about updates
like this—that have to be done manually— do you charge the client
for maintenance? Do you charge them for developmental hours?
What if they don't want to pay for maintenance hours? Do you skip it?
Or do you do it? What happens if
a client's site that you manage—that doesn't have a monthly maintenance
agreement gets infected by one of these attacks—
one of these exploits, one of these security vulnerabilities—
because you chose a theme with plugins bundled
and you did not update the plugins or didn't know
to update the plugins because it didn't become public knowledge?
And if you have 20 sites,
how long does this take you each month? [to maintain] If you have 50 sites,
how long does this take you to do each month? If you have
a hundred sites that you're managing,
how long does this take you to do each month? I'm not asking
these questions to ruffle any feathers or piss anyone off.
I'm asking these questions because they are valid. There are things that you and I
need to think about
as web professionals—as web consultants—as web developers.
Maybe,
just maybe—short-cutting to
Theme Forest, or Template Monster,
or any of these other marketplaces is a step we should very carefully consider
as part the overall design process. Yes—
it's convenient to have sliders and plugins
already bundled into themes. We don't need to go hunt them down.
But we need to think about what repercussions
those decisions early in the process have on our client sites—
for the lifetime of their site. If you like what you've seen here today then
do me a favor and hit the Subscribe button. This will ensure that you never miss
another one at these videos ever again. My name is John Locke.
My website is LockedownDesign.com.
And I will be here, building a business
one person at a time, and building a
community one relationship at a time. Thank you
so much for watching and
Peace. John Locke is a web developer and consultant based in Sacramento California.
You can find him online at Lockedown Design dot com.