Top all-time · #942
Wordfence
Company blog · wordfence.com/blog · on HN as mmaundersecurityprogramming
Wordfence is the company blog at wordfence.com, writing about security and programming. Since 2013, 72 different Hacker News readers have linked it 119 times, most often “Hacking 27% of the Web via WordPress Auto-Update – Wordfence”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Rarely recommended · 1 of 30 sampled comments recommend it?
Why HN links it
HN readers cite Wordfence's security blog as a source on WordPress vulnerabilities, malware, phishing and browser security warnings, mostly as supporting links in discussions.
- Recommended for · 1 comments
- One commenter says the follow-up post on a spam plugin's author 'did a great job tracking everything down'.1
Summarised by Claude from a sample of 30 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Hacking 27% of the Web via WordPress Auto-Update – Wordfence4 people · 4 mentions · first linked 2016-11-22
- GoDaddy Breached – Plaintext Passwords – 1.2M Affected4 people · 4 mentions · first linked 2021-11-22
- Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited4 people · 4 mentions · first linked 2017-01-14
- Why Wordfence Supports Strong Encryption Without Backdoors3 people · 3 mentions · first linked 2016-02-17
- /3 people · 3 mentions · first linked 2015-11-23
- Peculiar PHP Present in Popular Pipdig Power Pack (P3) Plugin3 people · 3 mentions · first linked 2019-04-01
- /2 people · 3 mentions · first linked 2013-04-13
- US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware2 people · 3 mentions · first linked 2016-12-30
- Election Hack Report FAQ: What You Need to Know2 people · 2 mentions · first linked 2017-01-04
- Vulnerability in Google's WP Site Kit gives any site user Search Console access2 people · 2 mentions · first linked 2020-05-13
What Hacker News says?
Will this also apply to data URIs? Thinking of the recent data URI phishing exploits [1] [1]: https://www.wordfence.com/blog/2017/01/gmail-phishing-data-u...
Comment linking /blog/2017/01/gmail-phishing-data-uri/
on “Chrome 56 will mark HTTP pages with password fields as non-secure”Submitted Phishing attack uses Unicode characters in domains to clone known safe sites as a story · 214 points
HN discussionOnly type your Google password if the site is accounts.google.com. https://www.wordfence.com/blog/2017/01/gmail-phishing-data-u... Better yet, use FIDO.
Comment linking /blog/2017/01/gmail-phishing-data-uri/
on “Don't use third party auth to sign in”Submitted GoDaddy Breach Widens as a story · 167 points
HN discussionWordfence ; Seattle, WA; FULL TIME ; REMOTE Full-time PHP Developer with Security Emphasis Do you want to work in information security? How about being able to work anywhere on the Planet? On a beach in Hawaii, or taking your lunch break fly fishing a stream in Alaska. We are a fast growing information security company. You will be working for us remotely full-time, with full benefits including medical, dental, 401K…
Comment linking /blog/2015/06/were-hiring-php-developer/
on “Ask HN: Who is hiring? (July 2015)”Submitted Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited as a story · 130 points
HN discussionWordfence | REMOTE | Senior node.js dev with security focus | Seattle, WA Wordfence | REMOTE | Security Analyst : Forensics and Remediation | Seattle, WA Do you want to work in information security from anywhere on the planet? Wordfence is a fast growing information security company. You will be working for us remotely. Full-time positions have great benefits including medical, dental, 21 days PTO and 401K. We are…
Comment linking /careers/
on “Ask HN: Who is hiring? (June 2016)”Submitted Panama Papers: Email Hackable via WordPress, Docs Hackable via Drupal as a story · 126 points
HN discussion> As I understand it, signifiers included command and control servers known to be under Russian state control. If you could be more specific, we could address this. However, you cannot, because the allegations are all this vague. If it's the assertion that I think it is, the "command and control servers" were asserted by Crowdstrike to be under Russian control, and its evidence for this, again, were somewhere deep i…
Comment linking /blog/2017/01/election-hack-faq/
on “Key witness in Assange case admits to lies in indictment”Submitted US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware as a story · 97 points
HN discussionThe comment made about domain names not being trustworthy is why I like EV-certificates. Some people (notably google) argue that EV-certificates add very little of value because the user can just as easily check the domain name. Thing is, I could probably get some paypal or google like domain. Even if I can't, I could use a data URI as in [1] to put https://google.com in the address bar. Compare that to EV. To get a…
Comment linking /blog/2017/01/gmail-phishing-data-uri/
on “The Line of Death”Submitted WordPress Plugin Possible Cause in Mossack Fonseca Breach as a story · 82 points
HN discussionWordfence | Remote, anywhere globally | Full-Time We are a small, profitable cybersecurity business. We make the most popular security plugin for WordPress in the World. We are involved in various other fun security products. We're looking for a talented, highly motivated and experienced PHP developer. Experience with LAMP required. Infosec experience highly desirable. We're looking for someone who is passionate abo…
Comment linking /
on “Ask HN: Who is hiring? (August 2015)”Submitted Commuting Kills as a story · 65 points
HN discussionYeah, I read articles calling it sophisticated. This is a super simple and straight forward worm. Disguise yourself as a known app and ask for more permission than you should. IDN exploits [0] and attachment faking [1] are more sophisticated if anything. [0] https://www.wordfence.com/blog/2017/04/chrome-firefox-unicod... [1] http://fortune.com/2017/01/18/google-gmail-scam-phishing/
Comment linking /blog/2017/04/chrome-firefox-unicode-phishing/
on “Ask HN: Google Doc email virus?”Submitted Hacking 27% of the Web via WordPress Auto-Update – Wordfence as a story · 62 points
HN discussionThriveThemes still hasn't released a disclosure on an attack from March 2021.[0] This seems to be par for the course among theme developers. 0. https://www.wordfence.com/blog/2021/03/recently-patched-vuln...
Comment linking /blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wild/
on “WordPress themes, plugins backdoored in supply chain attack”Submitted Pipdig Update: Dishonest Denials, Erased Evidence, and Ongoing Offenses as a story · 51 points
HN discussion100% REMOTE | Multiple Roles for Defiant Inc which makes Wordfence. Defiant.com is hiring. We make Wordfence. If you're interested in cybersecurity and want to help protect over 4 million websites from attacks, this is your dream job. We are 100% remote and have been since we started hiring in 2015. We're profitable, self funding, a team of 38 awesome happy people. We have an excellent work-life balance meaning that…
Comment linking /blog/author/wfchloe/
on “Ask HN: Who is hiring? (April 2021)”Submitted 0-day exploit for Firefox/tor on windows as a story · 27 points
HN discussionThis is build by the company: https://www.wordfence.com
Comment linking /
on “Fast or Slow”Submitted 404 to 301 Plugin Considered Harmful as a story · 18 points
HN discussionWe reverse engineered the IOC's included in Thursday's report from the FBI that released malware data that is supposedly associated with the 'Russian' election hack. Turns out it's a hacking group in Ukraine, anyone can get it for free (but if you're nice you'll donate to their BTC account) and the DHS and FBI sample was several versions behind. https://www.wordfence.com/blog/2016/12/russia-malware-ip-hac... The tro…
Comment linking /blog/2016/12/russia-malware-ip-hack/
on “Russia Hysteria Infects WashPost: False Story About Hacking U.S. Electric Grid”Submitted Backdoor in Captcha Plugin Affects 300K WordPress Sites as a story · 12 points
HN discussionWait... so if I write a WP plugin, I'm entitled to disable other plugins I don't like when people install mine? Of course not. That endurance cache is not the only one, there's a list of "plugins we disagree with" which are disabled: https://www.wordfence.com/blog/2019/03/peculiar-php-present-... As for hosting providers: GoDaddy, BlueHost, etc - yes, they're all bad. But that doesn't justify moves like these. Serio…
Comment linking /blog/2019/03/peculiar-php-present-in-popular-pipdig-power-pack-plugin/
on “WordPress theme provider Pipdig using customer sites to DDoS competitors”Submitted Surviving Electmageddon: Protecting against a wave of DNS outages as a story · 11 points
HN discussion> It sounds like they got a little overaggressive fighting with the company that had hijacked their themes and were selling them last year. Some of this might be explainable in this fashion, but not all. https://www.wordfence.com/blog/2019/03/peculiar-php-present-... > Firstly, the plugin includes a content filter that automatically replaces references to Blogerize, a service which claims to be a beginner’s blogging…
Comment linking /blog/2019/03/peculiar-php-present-in-popular-pipdig-power-pack-plugin/
on “WordPress theme provider Pipdig using customer sites to DDoS competitors”Submitted US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware and Tor Exit Nodes as a story · 10 points
HN discussionHere's a second writeup, which also contains a response from pipdig: https://www.wordfence.com/blog/2019/03/peculiar-php-present-...
Comment linking /blog/2019/03/peculiar-php-present-in-popular-pipdig-power-pack-plugin/
on “WordPress theme provider Pipdig using customer sites to DDoS competitors”Submitted Profile of a Russian Attack IP as a story · 10 points
HN discussion
