Online Services

eWorldLinx

Tag: Wordfence

  • Just How Good Is Wordfence Customer Service?

    When my co-founder, Kerry and I started scaling Wordfence as a business, our first hire was in customer service. We had both been taking shifts answering customer service tickets and forum posts along with doing engineering, QA, finance and everything else. We knew customer service was labor-intensive, but we also knew that the kind of business we wanted to create in Wordfence would need to have great customer service.

    Since then we have grown the customer service team to six people. Providing excellent service to our customers is a very high priority to us, so we review our performance from time to time. Today I thought I’d share a few of the numbers with you to give you a sense of how we’re doing.

    We provide free customer service to our community via the WordPress.org forums. We also provide Premium customer service to anyone who owns a Wordfence license. So we looked at our performance both on the forums and in our Premium ticketing system.

    Wordfence Forum Customer Service Performance

    The WordPress.org website provides metrics for each WordPress plugin that shows you “Issues resolved in last two months”. You can find it on the WordPress.org page for our plugin and for any other plugin, on the right below the star rating.

    This is what our star rating and customer service data looks like as of this writing:

    In the past 2 months we have resolved 226 out of 266 customer service requests from our free community customers in the support forums. That means 85% of all requests have been resolved.

    We performed a review today of our performance, and many of the remaining unresolved requests are waiting for a customer to get back to us with more info or to let us know if the issue is resolved. We try to avoid forcing a resolved status on a post unless we get data that the issue is actually resolved.

    How Do We Compare?

    We wanted to know how we compare against other WordPress plugins. So we created a list of the top 50 plugins and their forum customer service performance. Then we removed plugins with less than 20 customer service requests in the past 2 months because we want to measure against plugins that receive a comparable volume of requests.

    That left us with 30 plugins out of the top 50 that received more than 20 requests in the past 2 months. We sorted the table by which plugins have resolved the highest percentage of customer service requests. That gave us this ranking table:

    Wordfence ranks 8th out of the top 30 plugins with 85% of requests in the past 2 months resolved. As you can see, we are one of the plugins that receive a higher volume of requests. That may be because we actively send our customers to the forums if they need help.  I think 85% and 8th out of the top 30 plugins is doing fairly well.

    It’s worth pointing out that TablePress is doing an amazing job. They received 320 requests in the past 2 months and have maintained a 90% resolve rate. What is more remarkable is that it looks like Tobias Bäthge, the plugin author, is answering his own customer service requests and being diligent about only marking requests resolved when the customer is happy. If you need to create tables in WordPress, definitely check out TablePress on their plugin page or website.

    Yoast SEO is also doing a good job, maintaining 80% resolved requests out of a total of 423 requests in the past 2 months.

    The top 7 plugins in the list don’t receive as much volume as Wordfence, TablePress or Yoast SEO, but they are all doing between 33 and 77 requests per 60-day period, and are maintaining between 91% and 100% resolved rates. Clearly these plugin authors are staying on top of things!

    Wordfence Premium Customer Service Performance

    For our Premium customer service system, we use Freshdesk. With this system, our customers can open a ticket that our CS team can track. We only provide support via our ticketing system, and we don’t provide phone support. This gives our team time to go off and research each issue in depth. That allows us to provide every support request with a detailed and well-researched response that has a high likelihood of resolving the customer’s issue.

    Our CS team is currently a total of six people, and they have a variety of skills, including programming, quality assurance, computer repair, web development, project management and technical writing. They work closely together and often collaborate with their coworkers for input or advice to help resolve a ticket.

    The CS team also works closely with our engineering team to ensure that customer voices are heard. When the engineering team prioritizes feature requests, for example, they take into account how many people have requested a feature or are affected by an issue.

    The Premium Customer Service Numbers for August

    So far in 2017, Wordfence has processed 9,979 customer service request tickets. That’s an average of over 1,200 requests per month.

    Our average time to provide a “first response” to a customer for August was 1 hour and 30 minutes. In addition, 38% of our customers received a reply within 15 minutes.

    Sometimes the numbers don’t tell the whole story, so we regularly survey our customers to find out what they think of the service we provide. In our 2017 customer survey, 89% of surveyed Premium customers said that the support they received was “Awesome,” the highest level of satisfaction on our survey.

    Customer Service Matters

    Software companies often try to turn as much as they can into an “engineering problem.” You’ve probably noticed how difficult or impossible it is to contact someone in customer service in some online companies. Customer service is a major expense, and companies may try to avoid allowing you to interact with a person to reduce costs.

    I think our team has done a great job of providing online documentation and self-service options for our customers. But sometimes you find that you have a unique problem that the forum posts, documentation and Google just can’t help with, and you need to help from a real person. That’s where our CS team comes in.

    We also find that communicating with our customers provides a valuable feedback loop. Our CS team represents our customers in conversations about product direction, and that is a valuable source of input for the engineering team and leadership.

    That is why we will continue to invest in providing excellent customer service to our free community customers and our Premium Wordfence customers.

    Mark Maunder – Wordfence Founder & CEO

    PS: In case you’re wondering how well our customer service team work together, here’s an example of Tim helping Åsa with her mini-golf swing. Incidentally, Tim holds the current record for most tickets processed total. So far he’s handled 22,039 Premium tickets since joining Wordfence in March of 2015.

    The post Just How Good Is Wordfence Customer Service? appeared first on Wordfence.

  • Wordfence Launches Short-Circuit Scan Signatures – Up to 6X Performance Increase

    In October 2016, the Wordfence team started chatting about a way to radically boost the speed of scans once we grow beyond a certain number of scan signatures. As a reminder, a scan signature is a pattern that recognizes a certain kind of malware.

    Today Wordfence has 4,523 signatures available for the free community, and we have an additional 226 new signatures that are only available to Wordfence Premium users. These become free once they are 30 days old.

    New Malware Constantly Emerging

    Our team continuously adds from 30 to over 100 new scan signatures each week. The site cleaning team constantly discovers new kinds of malware as they clean hacked websites, and each malware sample is turned into a scan signature and released to Wordfence to help it detect that malware.

    Wordfence is currently at a total of 4,749 scan signatures for our Premium customers (4,523 free + 226 Premium), and within one year, this will grow to somewhere between 6,000 to 10,000 signatures at the current rate we are discovering new malware.

    The constant increase in the amount of malware targeting WordPress is clear, and Wordfence needs to continually grow our scan signatures to keep pace.

    Radical Innovation to Address Growth in WordPress Malware

    In October last year, Matt Rusnak, who heads up QA for Wordfence, and Ryan Britton, who is our senior core developer for Wordfence, started chatting about a new algorithm to radically speed up the Wordfence scan and make it able to handle a much larger number of signatures.

    Matt suggested identifying common patterns across scan signatures, grouping those signatures together and then checking if a file contains the common pattern first before scanning with the signatures in each group.

    In theory, if we had 10,000 signatures, and if we are able to identify groups of 100 scan signatures and create a pre-check for each one, we would need to match only 100 scan signatures for every item we scanned instead of 10,000. Ryan dubbed this “short-circuiting.”

    Earlier this year, we started work on the project. We created the services to support short-circuiting, then tested and launched them on our back-end servers about a month ago. Support was released for short-circuiting within the Wordfence plugin in the past few weeks. And we have been working to create grouped scan signatures with common “short-circuit” patterns.

    Matt Barry, our lead developer who created the Wordfence firewall, worked with Ryan and Matt Rusnak to make this project happen, and they received help from other members of the engineering team.

    A 2X to 6X Speedup With Short-Circuit Scanning

    When we released Wordfence 6.3.17 late last week, you may have noticed an entry in the changelog which said, “Improvement: Prepared code for upcoming scan improvement which will greatly increase scan performance by optimizing malware signatures.”

    On Monday this week, we enabled short-circuit scanning on our servers. The speed improvement in Wordfence scans was breathtaking, to say the least.

    We are seeing a 2-to-6-times performance increase across our test sites and customer sites. This is an incredible improvement.

    On one major hosting provider, scans on one of our large test sites went from an average scan time of 8 minutes per scan to 1 minute and 20 seconds for a Wordfence scan to complete.

    Continuous Engineering Innovation in WordPress Security

    This is not the first time we have radically improved scan speed. Last year in September we increased scan speed by refactoring the way we perform many operations in the scan.

    In July of this year, we further improved scan performance for hosting providers by monitoring scan distribution across hosting provider VPS instances and introducing a smoothing algorithm.

    Short-circuiting scan signatures is a powerful new technique the team has created to provide a radical performance improvement on an already fast scan.

    While our many of our competitors don’t even provide a firewall and malware scan in their security products, the Wordfence engineering team is at the forefront of engineering innovation, ensuring that you benefit from a powerful firewall and malware scan combination with lighting-fast performance.

    Congratulations and thank you to Matt Rusnak, Ryan Britton, Matt Barry and Åsa Rosenberg, who all contributed to bringing short-circuit scanning to our customers.

    The post Wordfence Launches Short-Circuit Scan Signatures – Up to 6X Performance Increase appeared first on Wordfence.

  • The Benefits of Wordfence Premium

    On April 21 this year, Wordfence celebrated our fifth year making the world’s best firewall and malware scan for WordPress. The date came and went as we continued to focus on innovating and securing our customers. Today Wordfence has been downloaded over 45 million times and maintains a 4.8 star rating out of 5 stars, from over 3000 reviews on the official WordPress plugin repository.

    Today Wordfence is a team of 16 full-time employees, and our total team size is 30 people, including contractors. Most of our team is US-based, though we have several colleagues around the world in countries like Sweden and the UK.

    Wordfence has become a big project and is now very popular. We protect over 2 million websites, including many of the best known businesses and universities in the world.

    Most of our team’s energy is dedicated to our Premium customers. Our customer service team provides an extremely high level of support for those customers, and our engineering innovation is focused on improving the real-time protection we provide to Premium.

    The community edition of Wordfence is free, and is actually the same software that our Premium customers run. The difference between free and Premium is the data we provide that powers Wordfence and the service you receive from our team.

    Better Data Means Better Protection

    Firewall Rules and Malware Signatures in Real Time for Premium

    Wordfence at its core is a firewall and a malware scanner. But without data, a firewall does not know what to block, and a malware scan does not know what to detect.

    Our team is constantly doing research to uncover the newest threats to WordPress. We discover new threats through investigating hacked WordPress sites, by logging attacks across WordPress sites and analyzing them, and through online research and collaboration with our partners.

    When we find a new kind of attack, we turn that into a firewall rule and release it immediately to our Premium customers. When we discover a new kind of malware, we turn that into a detection signature and release it to our Premium customers.

    This flow of firewall rules and malware signatures happens in real time for our Premium customers, and it is continuous. In contrast, our free customers receive this data with a 30-day delay.

    The (Legendary) Wordfence Premium IP Blacklist

    Last week we published research that shows that well over 50% of all the attacks we block are blocked by the Premium Wordfence IP Blacklist.

    This is what that looks like represented graphically. Each color represents a unique Wordfence firewall rule and how many attacks it blocks per day. The blue represents everything that the Premium IP blacklist blocks.

    The first time I saw the above data, I was pleasantly surprised. Our team has gotten so good at identifying bad IPs and blacklisting them for our Premium customers that we now block more attacks with the blacklist than we do with firewall rules.

    Our IP blacklist is only available to Wordfence Premium customers and is extremely effective at blocking attacks. An additional benefit of the IP blacklist is that it completely blocks known attackers from your site. They can’t even do an initial scan to see your content, what version of WordPress you are running or to probe for other weaknesses.

    Priority Server Processing For Premium Customers

    Wordfence is not just a PHP plugin for WordPress. It comes with back-end services provided by applications that we run on our own physical servers, which are located at multiple data centers. Wordfence Premium customers receive priority processing on our back-end services. We provide a higher degree of reliability for Premium customers on our servers, and we prioritize Premium processing higher than our free customers.

    The Wordfence team constantly releases new versions of the Wordfence plugin, and alongside those releases, they are also releasing new versions of our server code.

    The main reason we provide server-based applications to help Wordfence is to offload much of the processing from your website onto our own machines. For example, we maintain a mirror of every version of every plugin, theme and core file for WordPress ever released. That is well over half a terabyte of data!

    We also maintain our IP blacklists, URL and hostname blacklists and other data to help identify malicious behavior.

    When you perform a scan, our databases do most of the work to determine if a file on your system is malicious. If that happened on your own hosting account, it would take a long time and would consume a large amount of disk space.

    To run Wordfence without our back-end services, you would need over a terabyte of disk space, fast multi-core CPUs, at least 32 Gigabytes of memory and a fast 1-gigabit connection to the network. Most hosting accounts have about 1% of that network speed, and with far less memory, disk and CPU resources.

    Exceptional Customer Service

    Today I was again reminded of one of the most powerful things that our CS (customer service) team do for our customers: they represent you when having conversations with the engineering team. Later this week, we will be announcing a major improvement in Wordfence. When the engineering team unveiled it today, the CS team were all cheering, because they care deeply about you and making sure your problems are solved and that you are protected.

    As a Premium Wordfence customer, you get access to our priority ticketing system. Our team works closely with you to secure your WordPress site.

    The CS team works one-on-one with our customers to solve problems and help you get the best protection from Wordfence for your site. They respond within 24 hours during the week and are very passionate about securing WordPress and securing your website.

    Most of our Wordfence CS team is US-based, and they are all WordPress and Wordfence experts. When you chat with Chloe, Tim, Andie or Asa, they are based in California, Tennessee, Florida and Sweden, respectively – to mention just a few of our amazing team members.

    Free and Premium – We Are Glad to Have You on Board

    Whether you use the free community edition of Wordfence to protect your site or you are one of our valued Premium customers, we are glad to have you as part of the Wordfence family of customers.

    Our team cares deeply about securing your site, and we want you to have the best protection possible. That is why we encourage all our free community users to upgrade to Wordfence Premium. Our current pricing is $99 per year, which works out to just $8.25 per month. It’s an incredible deal.

    Upgrade to Wordfence Premium, today, and get the best protection available for your WordPress website.

    Mark Maunder – Wordfence Founder & CEO

    The post The Benefits of Wordfence Premium appeared first on Wordfence.

  • Which Wordfence Firewall Rules Are Most Effective?

    Part of the threat intelligence work we do at Wordfence is to constantly analyze the performance of our own firewall rules to determine what is effective and to identify existing and emerging attack trends. Today I’d like to share with you some of the data that we are seeing. If you are curious which attacks our firewall most commonly blocks, and which firewall rules are most effective, you’re going to enjoy this blog post.

    Tracking Our Most Effective Firewall Rules

    For this analysis, we took attack data from June 24 to August 22 (two days ago). We calculated the total number of attacks that each firewall rule blocked in the Wordfence firewall. Then we represented that visually, and labeled the rules that were blocking the most attacks.

    You can see this data represented below:

    This is a stacked chart that shows what percentage of attacks each rule blocked, by day. The total number of attacks represented in this chart over the two-month period is 202,765,759. You read that correctly: over two hundred and two million unique attacks across the sites we protect. Wordfence protects over 2 million websites, which is why this number is so high.

    Each stacked area on the chart above represents a firewall rule in the Wordfence firewall that is blocking attacks. There are a large number of rules, and many of them block a low number of attacks, so they are compressed into a single line. The rules that block more attacks occupy a greater area.

    As you can see, our “directory traversal” rule blocks a large proportion of attacks. These are simplistic attacks that are very popular among unsophisticated attackers. For this reason, we see a lot of them, and they generate a lot of volume on the chart.

    Our SQL injection rule is also a workhorse. That is the orange rule second from the bottom. The Wordfence firewall includes a SQL “lexer and parser.” That means that Wordfence can understand SQL the way a database interpreter does, and it can make intelligent decisions about whether incoming SQL is malicious or not. As you can see, that rule blocks a large number of attacks.

    Emerging Attacks Blocked by Malware Scan Integration

    One of the most powerful rules in the Wordfence firewall that blocks a large number of emerging attacks is our malware scanner rule. I’ve marked the rule in bright yellow in the chart above, and labeled it “Scanner blocked malware.” In September of last year, the Wordfence team released a new version of the Wordfence firewall that integrates our malware scan with the firewall. That means that in addition to our regular firewall rules, Wordfence uses its malware scan logic to examine incoming requests.

    Wordfence currently has 4,628 free and premium malware scan signatures in production. Those are all signatures that identify a unique malware variant or family of malware. By integrating malware scanning into our firewall, it is as though we released over 4,000 distinct firewall rules simultaneously. It has massively improved the detection capability of the Wordfence firewall.

    As you can see from the chart above, the malware scan blocks a significant number of attacks. But the real benefit from this firewall-scan integration is that it blocks sophisticated attacks.

    For our Premium Wordfence customers, when we release a new malware signature in real time, we also add it to the malware scan. Additionally, we also put the rule into production on your firewall and use it to identify and block the newest attacks.

    Premium IP Blacklist Owns the Stats

    Wordfence also includes an IP Blacklist which is available only to our premium customers. Our systems track attacks in real time, and we use attack source data to create an IP blacklist, which we update throughout the day. As our algorithms have improved, the number of IP addresses on the blacklist has expanded, and the list now blocks a very large proportion of attacks.

    The following chart shows you what percentage of total attacks the Wordfence Premium blacklist blocks when we combine the data.

    The blue in the above chart represents the total percentage of attacks the Wordfence Premium IP blacklist blocks. The stacked charts below the blue area represent attacks that all other firewall rules block. This chart is for the same period, June 24 to August 22, 2017.

    The total attacks we logged for the period above is 725,248,603. A total of 202,765,759 attacks that our firewall rules blocked. A total of 464,007,181 attacks were blocked by the Premium blacklist.

    Keep in mind that Wordfence Premium blocks every request from a blacklisted IP. That helps explain why the number of requests we blocked from known bad IPs is so high. Here are a few of the kinds of requests from blacklisted IPs that we block:

    • We prevent them from visiting your home page and detecting WordPress.
    • Blacklisted IPs get blocked from all content, comments and comment-posting.
    • We block them from attempting a brute force attack.
    • We block them from accessing XMLRPC.
    • They are completely blocked from crawling your site.
    • We prevent them from accessing any PHP script in your WordPress installation directly, even if they try to bypass WordPress.

    When you upgrade to Wordfence Premium, you receive new malware scan rules in real time. As I explained above, these are also used in the Wordfence firewall. You also receive new firewall rules in real time. But one of the biggest benefits that many users are not even aware of is that Wordfence Premium enables the Wordfence IP Blacklist in your firewall. And as you can see, this blocks a large number of attacks – it blocks attackers from even accessing your site.

    Wordfence Free Is Awesome. Premium Is Next-Level.

    My personal goal for several years has been to make Wordfence “so good that you are crazy if you aren’t using it to protect your site.” Today I can say with confidence that our team has achieved that goal. If you aren’t using the free version of Wordfence to protect your site, you are missing out on the best available free protection for WordPress.

    With Wordfence Premium, we have taken that protection to the next level with real-time scan signatures, real-time firewall rules and the extremely effective real-time IP blacklist.

    As always, you are most welcome to post your comments below, and I will be around to reply where needed.

    Mark Maunder – Wordfence Founder/CEO.

    Special thanks to Wordfence team members Dan Moen, for producing the data behind this post, and Andie La-Rosa for editing.

    The post Which Wordfence Firewall Rules Are Most Effective? appeared first on Wordfence.