Online Services

eWorldLinx

Category: Security

  • Ransomware Targeting WordPress – An Emerging Threat

    Recently, the Wordfence team has seen ransomware being used in attacks targeting WordPress. We are currently tracking a ransomware variant we are calling “EV ransomware.” The following post describes what this ransomware does and how to protect yourself from being hit by this attack.

    A Quick Introduction to Ransomware

    Ransomware is malicious software that an attacker installs on your computer or on your server. They use an exploit to gain access to your system, and then the ransomware executes, usually automatically.

    Ransomware encrypts all your files using strong unbreakable encryption. The attackers then ask you to pay them to decrypt your files. Usually payment is via bitcoin. Bitcoin gives the attackers a way to create an anonymous wallet into which the ransom can be paid.

    Ransomware has been around for a long time. It originally dates back to 1989 with the “PC Cyborg trojan horse virus” that would extort its victims into sending $189 to a PO Box in Panama to get their files decrypted. The encryption on that virus was easily crackable.

    Ransomware today is growing fast. In 2017, 100 new ransomware variants were released into the wild, and there was a 36% year-over-year increase in ransomware attacks worldwide. The average ransomware demand increased 266% to an average of $1077 per victim. [Source: Symantec Threat Report 2017]

    This year we have seen ransomware attacks on a scale that would have been hard to imagine several years ago. In May of this year, the WannaCry ransomware attack affected hundreds of thousands of people in over 150 countries. The UK National Health System was affected and had to divert ambulances away from affected hospitals.

    In June we saw the Petya (eventually dubbed NotPetya or Netya) ransomware rapidly spreading, starting in Ukraine. A large number of high-profile organizations were affected, including Ukraine’s state power company, the Chernobyl nuclear reactor, Antonov aircraft, shipping company Maersk and food giant Modelez.

    Today a large number of affected people and organizations actually pay attackers when they are hit by ransomware, and sometimes their files are successfully decrypted. Security organizations, including the FBI, generally advise customers to not pay attackers because this encourages the spread of this kind of attack. However, many organizations simply do not have the option of not recovering their data – and so they pay, which perpetuates this criminal business model.

    Ransomware Now Targets WordPress

    Most ransomware targets Windows workstations. However, the Wordfence team is currently tracking an emerging kind of ransomware that targets WordPress websites.

    During our analyses of malicious traffic targeting WordPress sites, we captured several attempts to upload ransomware that provides an attacker with the ability to encrypt a WordPress website’s files and then extort money from the site owner.

    The ransomware is uploaded by an attacker once they have compromised a WordPress website. It provides the attacker with an initial interface that looks like this:

    This interface provides both the encryption and decryption functionality to an attacker. The attacker then chooses a complex key, enters it into the “KEY ENC/DEC” field and hits submit.

    The site is then encrypted. The result looks like this:

    The ransomware will not encrypt files that have the following patterns:

    • *.php*
    • *.png*
    • *404.php*
    • *.htaccess*
    • *.lndex.php*
    • *DyzW4re.php*
    • *index.php*
    • *.htaDyzW4re*
    • *.lol.php*

    For each directory that the ransomware processes, it will send an email to “htaccess12@gmail.com” that informs the recipient about the host name and the key used to perform the encryption.

    All files affected are deleted and another file takes their place with the same name, but with the “.EV” extension. This new file is encrypted.

    For our technical audience: The encryption process uses mcrypt’s functionality, and the encryption algorithm used is Rijndael 128. The key used is a SHA-256 hash of the attacker-provided encryption key. Once the data is encrypted, the IV used to encrypt the file is prepended to the ciphertext, and the data is base64-encoded before it is written to the encrypted .EV file.

    Decryption Is Incomplete

    When the encryption process starts, the ransomware creates two files in its installation directory. The first is named “EV.php,” a file containing an interface that is supposed to allow the user to decrypt their files if they have a key. This file contains a form, but it does not work because it does not include decryption logic.

    The second file is a .htaccess file that redirects requests to the EV.php file. Once your site has been encrypted, it will look like this:

    This ransomware provides an attacker with the ability to encrypt your files, but it does not actually provide a working decryption mechanism. It does, however, give attackers what they need to trick affected site owners into paying a ransom. Their only goal is to encrypt your files. They don’t actually have to prove they can decrypt your files to get you to pay a ransom.

    If you are affected by this ransomware, do not pay the ransom, as it is unlikely the attacker will actually decrypt your files for you. If they provide you with a key, you will need an experienced PHP developer to help you fix their broken code in order to use the key and reverse the encryption.

    How to Protect Yourself

    This ransomware was first seen by Wordfence being used in a single attack attempt on July 7th. We released a malware signature to our Premium Wordfence customers on July 12th that was specifically designed to detect this ransomware and any variants.

    That means our Premium customers’ firewalls have been blocking any attempts to upload this ransomware since then. The Wordfence scan also has detected the presence of this ransomware for Premium customers since July 12th.

    30 days later on August 11th, this rule became available for our free community customers. If you are running Wordfence Premium or Wordfence free on your websites, you are currently protected against this attack.

    Wordfence will protect you from being hit by this in the first place. We also recommend that you have reliable backups. It is important that you don’t store your backups on your web server. If, for example, they’re stored in a ZIP archive on your server, then if your site is taken over by this ransomware, the backups will also be encrypted and will be useless. Your backups should be stored offline, either with your hosting provider or using a cloud storage service like Dropbox.

    Who Is Responsible

    The earliest variant of this ransomware appeared in May of last year on Github. Version 2 of the ransomware is what attackers are currently using.

    The first time we observed this ransomware being used in the wild to target WordPress websites was last month.

    The authors of the ransomware on Github are bug7sec, an Indonesian group with a Facebook page who have listed themselves as a “business consultant.”

    The source code uses Indonesian words like “kecuali,” which means “except” in English. You can see this in the source code samples below:

    The function above determines whether it should exclude a file from encryption, so the word ‘except’ makes sense in this context as an Indonesian function name.

    When you load the ransomware, it loads a YouTube video which is invisible, but you can hear the audio playing in the background when you view the ransomware user interface. The video plays an Indonesian rap tune and the lyrics appear to mention hacking.

    The title of the video is “ApriliGhost – Defacer Kampungan.” If you look up @aprilighost on Twitter, you find this account, which links to this Indonesian Facebook account. ApriliGhost may not be the attacker, but the video is Indonesian in origin – a further Indonesian connection.

    Another clue is that the ransomware seems to be connected with the website errorviolence.com. When you view the ransomware in a web browser, after a certain amount of time it will redirect you to that site, which is an Indonesian hacking forum and website with resources for hackers.

    Our attack data has logged related attacks from IPs with the location of Jakarta, the capital of Indonesia. We have seen related attacks originating from several other non-Jakarta IPs, but these do not resolve to any specific location, but rather to organizations that may be used to proxy attacks. So far, Jakarta is the only location with a clear link to these attacks.

    Conclusion: This ransomware was created in Indonesia, probably by bug7sec, and used by at least one Indonesian-based hacking group, from Indonesia, to target WordPress websites.

    We Expect This to Evolve Into Fully Functional and Widespread Ransomware

    The EV ransomware that we have documented above is incomplete, in that the decryption function does not work correctly. It does work well enough to extort money from unsuspecting website owners, although we have not yet received any reports of extortion taking place. So far we are only seeing attempts to drop this ransomeware on WordPress websites.

    We expect this to evolve over the next few months into fully functional ransomware that targets both your files and database in WordPress. We also expect to start seeing incidents of extortion. For websites that do not have a firewall like Wordfence and regular backups, this may turn into a profitable business for attackers who can ransom a few thousand websites.

    So far, attackers targeting WordPress have earned money only indirectly from compromised WordPress sites through techniques like email and SEO spam.

    Major vulnerabilities in the WordPress ecosystem emerge from time to time – for example, the defacement campaign that the WordPress community experienced earlier this year. The next major vulnerability may see attackers switching from older business models to using ransomware to directly monetize compromised WordPress websites.

    Stay Safe

    As I mentioned above, Wordfence has been blocking this ransomware for our Premium customers since we first saw it used in an attack in early July. I strongly recommend that you install Wordfence Premium to protect yourself against these kinds of threats.

    In September of last year, Wordfence integrated our malware scan into our firewall. This allows Wordfence to use malware signatures that we create to recognize files like this ransomware variant in our firewall. By using this technique, Wordfence will block an attempt to upload ransomware, even if the attacker used an unknown exploit.

    To get the most benefit from Wordfence, I encourage you to upgrade to Premium. Not only do you get your firewall rules in real time, but you also get our malware signatures in real time from our team. In this case, you would have been protected from this new ransomware detection for over a month already by now.

    An additional layer of protection against a ransomware attack is to ensure that you have good offline backups. Make sure your backups don’t live on your web server. They need to be backed up to a separate server or a cloud storage service like Dropbox or Google Drive. Keep in mind, though, that your backups are your last line of defense. It is better to avoid getting hacked in the first place.

    I hope you have enjoyed this detailed post on ransomware and how it is beginning to target WordPress. If you have any questions or comments, post below and I will be around to reply.

    Regards,

    Mark Maunder – Wordfence Founder/CEO

    Thank you to Pan Vagenas for his research which contributed to this post. Also thanks to Andie La-Rosa and Dan Moen for their assistance editing this post. 

    The post Ransomware Targeting WordPress – An Emerging Threat appeared first on Wordfence.

  • The July 2017 WordPress Attack Report

    This post is a continuation of the WordPress Attack Report series we’ve been publishing since December 2016. Reports from previous months can be found here:

    This report contains the top 25 attacking IPs for the month of July and their details. It also includes charts of brute force and complex attack activity for the same period. We also include the top themes and plugins that were attacked and which countries generated the most attacks for this period.

    The Top 25 Attacking IPs

    The next section is our standard explanation of how the table below works. If you are familiar with our attack reports, you can skip down to the table below this section, which contains the data for July along with some commentary.

    Brief Introduction (If You Are New to Viewing These Reports)

    In the table below, we’ve listed the most active attack IPs for July 2017. Note that the “Attacks” column is in millions, and is the total of all attacks that originated from each IP. Farther right in the table (you may have to scroll right) we break down the attacks into “brute force” attacks and “complex” attacks.

    Brute force attacks are login-guessing attacks. (You can learn more about how brute force attacks work in our Learning Center article about them.)  What we refer to as “complex attacks” are attacks that were blocked by a rule in the Wordfence firewall.

    We have also included the netblock owner, which is the organization (usually a company) that owns the block of IP addresses that the attack IP belongs to. You can Google the name of each owner for more information. A Google search for any of these IP addresses frequently shows reports of attacks.

    The hostname included is the PTR record (reverse DNS record) that the IP address owner created for the IP, so this is not reliable data, but we still include it for interest. For example, we have seen PTR records that claim an IP is a Tor exit node, when, based on traffic, it is clearly not.

    We also include the city and country, if available. To the far right of the report, we show the date in July when we started logging attacks and the date the attacks stopped.

    The Top Attacking IPs

    The total attacks from the top 25 attacking IPs decreased slightly from 133 million in June to 124 million in July.

    Brute force attacks made up an amazing 87% of total attacks for July, up from 67% in June. Complex attacks accounted for 13% of the volume.

    As usual, the list is dominated by Ukraine and Turkey followed by the United States.

    Brute Force Attacks on WordPress in July 2017

    In the chart below, we show the number of daily brute force attacks on the sites we monitor for the month of July.

    The average number of daily brute force attacks increased 21% from last month, which was up substantially from May. Daily attack volumes were incredibly stable throughout the month, with no big peaks or valleys. It’s almost like the attackers went on vacation and left their malicious bots running on autopilot.

    Complex Attacks on WordPress in July 2017

    In the graph below, we show the daily complex attacks (attacks that attempt to exploit a security vulnerability) for July.

    Average daily attack volume for July was up 6% from June for the sites that Wordfence protects at 7.2 million. As with brute force attacks, daily volume was incredibly stable.

    Attacks on Themes in July 2017

    The table below shows the total number of attacks on WordPress themes. We identify each theme using its slug, which is the directory where it is installed in WordPress.

    We saw a lot of movement in the top 25 this month when compared to June. The biggest mover on the list was the ‘clockstone’ theme, coming out of nowhere to take the #3 spot in the rankings. Digging into the details the attacks are all malicious file upload attempts, attempting to exploit a vulnerability that has been public knowledge since August of 2014. Furthermore, the theme appears to no longer be supported by the author. The attacks targeting this plugin originated from 1336 unique IPs during the month, suggesting that the attacker (or attackers) are using a botnet to launch the attack. The top 10 IPs were responsible for just over two thirds of the attacks.

    Another big mover on the list is the ‘sealight’ theme, moving up 32 places to number 12 on the list. Looking at the detailed attacks they are all attempting to exploit a very well known vulnerability in TimThumb, which was discovered in 2011. The vulnerability impacted many WordPress themes, apparently including the ‘sealight’ theme. The attacks on this theme originated from 130 IP address, with the top 10 account for 75% of attacks.

    The last big mover on the list that we looked into was the ‘typebased’ theme, which moved up 26 places to number 17. This is another theme that appears to no longer be supported or available for download. Looking at the the attacks they are all trying to exploit the same TimThumb vulnerability that the attacks on the ‘sealight’ theme are targeting. Attacks came from 136 unique IP addresses during the month, with the top 10 accounting for over 68% of the total.

    Attacks on Plugins in July 2017

    The table below shows the total number of attacks on WordPress plugins. As with themes, we identify each plugin by its unique slug, which is the unique installation directory where the plugin is installed.

    The top 25 list for plugins also changed a lot toward the bottom, with six plugins month weren’t on the list in June. We looked into the details of the biggest mover on the list, ‘wp-pagenavi’, which moved up 38 spots to number 11. The surge in attacks are attempting to exploit the TimThumb vulnerability we discussed in the theme section. We couldn’t find reference to the plugin including TimThumb, but given that the TimThumb vulnerability in question is over 5 years old now it would be difficult to say for sure.

    The next biggest mover on the list was ‘wp-rocket’, a caching plugin that is running on over 260k sites according to their website. The surge in attacks are attempts to exploit a Local File Inclusion vulnerability that was fixed and publicly announced in June when version 2.10.4 was released.  Attacks originated from over 89k unique IP addresses, with the top 10 accounting for just under 50% of the total.

    Attacks by Country for July 2017

    The table below shows the top 25 countries from which attacks originated in the month of July on WordPress sites that we monitor.

    The top 3 countries remained the same, with very little movement throughout the list.

    Conclusion

    That concludes our July 2017 WordPress attack report. We were disappointed to see attack volume up yet again in July and hope to see that trend reverse itself again in August.

    The post The July 2017 WordPress Attack Report appeared first on Wordfence.

  • TrafficTrade Infection Spreading – How to Protect Yourself and Detect TrafficTrade

    We have seen a significant increase in the number of websites affected by malware we refer to as ‘TrafficTrade’. This malware is a piece of javascript that an attacker drops into your website content once they have compromised it. Your visitors are then redirected to websites that install malicious browser plugins or serve up spam advertising.

    How TrafficTrade infects your website

    So far the Wordfence Security Services Team has seen two infection vectors (methods of infection). The first is websites that are infected because they left the searchreplacedb2.php script lying around. This is a relatively uncommon infection vector. We wrote about this risk a few weeks ago.

    The second vector is by far the most common. The attackers are exploiting a vulnerability in the WordPress ‘Newspaper’ theme. This vulnerability allows them to inject malicious code into the WordPress ‘wp_options’ table which then redirects your traffic to malicious websites or ad campaigns. Our Security Services Team has seen several other themes that are based on the Newspaper WordPress theme that suffer from the same vulnerability.

    Wordfence released a Premium firewall rule about 40 days ago which prevents these attackers from exploiting the Newspaper theme. Even if you had a vulnerable theme, you would have been protected. About 10 days ago, that rule became available to our free customers too.

    The chart below shows how attacks on the Newspaper theme have completely dominated the distribution. Attacks on searchreplacedb2.php have only been 4% of total attacks over the past few weeks.

    How The TrafficTrade.life Attack Campaign has Ramped Up

    The traffictrade.life domain was registered on July 3rd, a little over 1 month ago. It is protected by WhoisGuard, a Panamanian company that provides domain registration anonymity services.

    We started seeing attacks that were attempting to drop malware with a malicious redirect hosted at traffictrade.life starting on July 10th. The total number of attacks per day have ranged from just 1 per day up to as many as 630. Then things really took off in the past week as you can see from the chart below. We started seeing up to 15,000 attacks per day attempting to drop the traffictrade.life malicious redirect.

    Even Google Trends is showing an increase in search volume for the phrase ‘traffictrade’ towards the end of July as attacks ramped up and affected webmasters started searching Google for help:

    What to Do To Protect Yourself

    As always we recommend running Wordfence Premium. In this case, our Premium customers have been protected for over 40 days from TrafficTrade by a Premium firewall rule that was deployed by our team in real-time.

    The firewall rule became available to our free community users about 10 days ago. Both Wordfence free and Premium are now protecting your sites from these attacks.

    Because this infection is so wide-spread, we have released additional detection in the Wordfence malware scan to detect a newer variant of TrafficTrade. We are seeing attackers modify your wp_options table to inject the malicious code into that table. A Wordfence scan will now detect this.

    This new feature is immediately available for free and Premium Wordfence customers with Wordfence version 6.3.16 which was released this morning. Simply install Wordfence or update to 6.3.16 and run a scan.

    What TrafficTrade Malware Does On Your Site

    Once you have been infected with TrafficTrade, it injects Javascript onto your site that loads from the TrafficTrade.life domain. The actual script is very simple. If you load the URL manually, it looks like this:

    It redirects your visitors to a ‘trafficreceiver’ domain which then does further redirects to whichever campaign they are running. In the case of my test, you are redirected to a site that wants you to install a Chrome plugin – most likely malicious.

    Where The Attacks Are Coming From

    The majority of attacks that we have intercepted and that are dropping the TrafficTrade malicious redirect code come from four IPs:

    • 79.110.128.128 – 13,698 attacks
    • 79.110.128.17 – 11,071 attacks
    • 79.110.128.63 – 4,798 attacks
    • 79.110.128.252 – 607 attacks

    We are seeing attacks originating from several hundred other IPs, but the numbers are very low – ranging from single to double digits. The above IPs are by far the top offenders.

    The above IPs belong to UnderNet LLC, based in Kiev in Ukraine. They are part of a block of 2048 IP addresses in the range 79.110.128.0 – 79.110.135.255.

    UnderNet LLC’s website is at under.net.ua. This is a snapshot of their home page:

    A Change In Hosting and Tactics on July 31st

    The threat actors behind the TrafficTrade campaign were using a well known “bulletproof” hosting company to host traffictrade.life until July 31st. They were based at HostSailor with servers in the Netherlands, which Brian Krebs has written about in depth in August 2016. According to Krebs, HostSailor has a long history of hosting malicious content and services, as does their owner.

    On July 31st, the campaign switched their primary domain IP address as they also switched tactics. The IP address that the traffictrade.life domain pointed to, changed from 185.183.96.33 hosted at HostSailor in the Netherlands to 200.7.105.43 which is hosted by “HZ Hosting Ltd”, also known as HostZealot.

    Source: RiskIQ

     

    The HostZealot website is at www.hostzealot.com and the company is based in Plovdiv in Bulgaria.

    On July 31st we also saw a change in tactics. The attackers switched from trying to exploit searchreplacdb2.php to exploiting the Newspaper Theme in WordPress. The number of attacks we saw also ramped up significantly on July 31st when that domain IP change occurred. We saw 15,000 attacks on a single day.

    When the attackers switched to HostZealot, they immediately ramped up attacks to 15,000 per day as the graph below shows.


    The threat actors behind TrafficTrade may have switched away from HostSailor because it is blacklisted by many security companies and firewalls online, including Wordfence. Switching to a lesser known bulletproof host may have allowed them to bypass some blacklists with their attack campaign.

    Spread The Word

    The Wordfence team has seen a wide impact from this malware. Many of our site cleaning customers have been hit by this. We have also seen a significant rise in the number of infection attempts during the past few days.

    We are not isolated in observing this infection. Dan Fennel wrote about this on July 24th. This is showing up on StackOverflow (July 17th). And we initially covered this on July 25th when we wrote about the risks of searchreplacedb2.php – although at the time we didn’t realize the attack would become so prolific starting July 31st.

    To help protect the WordPress and online community, please share this with your friends and colleagues.

    Thanks to Brad Haas and Dan Moen for their assistance and contributions to post. 

    Mark Maunder – Wordfence Founder/CEO.

    The post TrafficTrade Infection Spreading – How to Protect Yourself and Detect TrafficTrade appeared first on Wordfence.

  • Why Choose An Endpoint Firewall Like Wordfence

    When choosing a firewall for your WordPress website to protect it against attacks, you have a handful of choices. Wordfence is one of the only effective “endpoint” firewalls available. The alternative is a “cloud” firewall from vendors like Sucuri (now owned by GoDaddy) and Cloudflare.

    I’d like to explain the difference between a cloud firewall vs an endpoint firewall like Wordfence. I would also like to explain the risks of choosing cloud versus the peace of mind and simplicity of an endpoint firewall like Wordfence. I will also explain why endpoint firewalls are far more effective at protecting your WordPress website.

    The Difference Between Cloud and Endpoint Firewalls

    A “cloud” firewall is a server that is located in a remote data center belonging to another company. Your website traffic goes from your visitors to that remote data center and then back out over the internet to your website.

    When vendors use the word “cloud” they really mean “our data center”. When you store photos in the Apple’s “cloud”, you are storing photos in Apple’s data center. When you host your website in the “cloud” you are hosting it in some company’s data center.

    “Cloud” firewalls are the same. The actual firewall is just located in another company’s data center. The important thing to note is that your traffic passes across the internet from your visitor, to that company’s data center, then back out over the Internet to your website.

    Configuring a cloud firewall is a bit more complex because you need to point your domain name away from your own server and at the cloud firewall vendor’s servers. That way your traffic can be routed through their data center.

    When we talk about “cloud” firewalls we refer to your website as the “origin server”. Because your origin server is also on the internet, it can still be reached by anyone on the internet provided they have your server IP address. That includes attackers. Here is a diagram to illustrate:

    An endpoint firewall like Wordfence is different in that it runs on the actual server it is protecting. That means there is no way to bypass it over the internet. Your traffic is also routed directly from your site visitor to your server. You have total control over your firewall and it is not shared by any other website. You don’t have to point your domain at someone else’s servers or data center.

    The diagram below illustrates how an endpoint firewall like Wordfence runs on your server and cannot be bypassed. It also shows how we integrate with WordPress and have “local knowledge” of user access levels via the WordPress API.

    The Risks Associated With Cloud Firewalls

    The Cloud Firewall Bypass Problem

    When you run a cloud firewall, the firewall server lives out on the open internet. That server can be bypassed by an attacker and they can still access your website directly. It is not possible to bypass an endpoint firewall.

    We have discussed the Cloud Firewall bypass problem in detail in the past. This problem is a fundamental flaw in cloud firewall design. Unless you move the firewall to the endpoint, as Wordfence does, you can’t get around this issue.

    The Cloud Firewall Data Leak Problem

    Cloud firewalls use a single server on the internet to provide firewall functionality to hundreds, perhaps thousands of different websites. If I told you 2 years ago that a major cloud provider would accidentally start sending data for one site visitor to other visitors, you would probably say I’m crazy.

    That is what happened in February of this year. Cloudflare experienced a data leak over a 5 month period that mixed sensitive data between websites and visitors. A visitor to one website using Cloudflare may have seen data from another website using Cloudflare that was being sent to a completely different site visitor.

    If you use a cloud firewall, you are sharing your firewall with many other websites. You trust your vendor to keep your data and configuration information segregated and secure. Vendors are not perfect. They experience bugs and breaches too. By adding a shared firewall to your configuration, you are introducing an additional point of risk and failure.

    The Cloud Firewall User Identity Problem

    Cloud firewalls run on servers that are on the internet. They are completely separate from your WordPress server. They don’t know who a user is or what access level they have. Cloud firewalls don’t even know if a user is logged in or not. 

    What this means is that they don’t have identification, authentication and authorization data for any visitor to your website. They can’t use that data in their rules. Cloud firewall vendors may make bold claims, but when their firewall makes decisions about who to grant access to and who to block, those decisions do not take into account who a visitor is, what access level they have and whether they are logged in or not.

    In contrast, Wordfence is an endpoint firewall that integrates deeply with the WordPress API. Wordence knows who a user is, what access level they have and whether they are signed in or not. Wordfence uses this data to make effective decisions on who to allow and who to block.

    Cloud Firewalls are Generic and Not Designed for WordPress

    In the past we have seen cloud firewalls that have let through some of the best known WordPress attacks. Cloud firewalls run on remote servers and are not designed to integrate with WordPress or to work specifically with WordPress. They usually have a generic rule-set that is not tailored for WordPress specifically.

    Wordfence is designed specifically for WordPress. It integrates deeply with the platform and is designed to block well known and emerging attacks that specifically target WordPress.

    Cloud Firewalls Break End-to-End Encryption

    In order to inspect your web traffic to determine if it is malicious, cloud firewalls have to decrypt your website traffic. That decryption happens on another company’s servers away from your servers and outside of your data center.

    Wordfence is a strong supporter of end-to-end encryption on the web. We don’t think that encryption should be intercepted and decrypted in transit. We think that website visitors have a reasonable expectation of privacy and their data should remain secure from their web browsers all the way to the destination server they are communicating with.

    Endpoint firewalls like Wordfence do not break end-to-end encryption. Your data stays encrypted and secure from your site visitor all the way to your website.

    Secure Your Site At The Endpoint

    Securing your website using an endpoint security product like Wordfence has many advantages over a cloud product. Wordfence provides a robust endpoint firewall that is continuously updated. Wordfence Premium customers receive firewall rules in real-time and free users receive new rules 30 days later.

    Wordfence includes a malware scanner. Cloud firewalls only provide firewall functionality – they do not have the ability to scan your website for malware. Wordfence Premium customers receive malware rules that are updated in real-time as new threats emerge.

    Wordfence also provides a range of other features like two factor authentication, brute force protection, country blocking and more. Our Premium customers also benefit from an IP blacklist that is updated in real-time. Because we only protect WordPress websites, our attack data is specific to WordPress. We know who is targeting WordPress websites and we can block them on your website, immediately.

    Install the free version of Wordfence today to immediately secure your website at the endpoint. Then consider upgrading to Wordfence Premium to receive real-time firewall rule updates, real-time malware signature updates and protection by our real-time IP blacklist.

    Note: All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

    The post Why Choose An Endpoint Firewall Like Wordfence appeared first on Wordfence.