[ad_1] Starting October 1st, 2024, WordPress.org will roll out new security measures aimed at enhancing the safety of accounts with commit access to plugins and themes. This was announced by the Automattic-sponsored developer Dion Hulse. Mandatory Two-Factor Authentication Beginning next month, WordPress.org will make two-factor authentication (2FA) mandatory for all plugin and theme authors. Authors can configure 2FA by visiting their WordPress.org profiles, and the platform has already started prompting them to do so. Dion Hulse emphasized the importance of securely storing backup codes, as losing access to both 2FA methods and backup codes could complicate account recovery. SVN Passwords for Commit Access WordPress.org will also introduce SVN passwords for committing changes to plugins and themes. This feature separates commit access from the main WordPress.org account credentials, offering an extra layer of security. Authors can generate SVN passwords through their profiles, ensuring that their main account passwords are protected. Those using deployment scripts, like GitHub Actions, will need to update their stored passwords with these new SVN credentials. For those wondering why the Plugin Review Team is not using 2FA with SVN, Dion explained, “Due to technical limitations, 2FA cannot be applied to our existing code repositories, that’s why we’ve chosen to secure WordPress.org code through a combination of account-level two-factor authentication, high-entropy SVN passwords, and other deploy-time security features (such as Release Confirmations).” For more information, authors can refer to the guides on Configuring Two-Factor Authentication and Subversion Access and Chris Christoff’s post on Keeping Your Plugin Committer Accounts Secure Community Reaction The community has reacted positively to these changes, with some expressing that these updates were long overdue. “At least we were earlier than someone stepping on Mars, ” joked developer Toma Todua. Recently, the WordPress Plugin Team has ramped up efforts to enhance platform security. In June, they temporarily halted plugin releases and forced all plugin authors to reset their passwords after five WordPress.org user accounts were compromised. [ad_2] Source link
Continue readingTag Archives: WordPress.org
#49 – Matt Cromwell on the Effectiveness of the WordPress.org Repository for Promoting New Plugins – WP Tavern
[ad_1] [00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My Is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes and in this case, the effectiveness of the wordpress.org repository for promoting new plugins. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to WPTavern.com forward slash feed forward slash podcast. And you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea featured on the show. Do that by heading over to WPTavern.com forward slash contact forward slash jukebox, and use the form there. So on the podcast today, we have Matt Cromwell. Matt is Senior Director of Operations and Marketing at StellarWP, where he provides marketing and business insights and coaching to burgeoning WordPress product owners. He’s also one of the founders of GiveWP, a donation plugin, which uses the freemium model. Having a free version on wordpress.org’s repository as well as a paid premium offering. The wordpress.org repository is where you find yourself when you click the add new button in the WP admin. It’s a place where plugin developers can, if they follow the guidelines, hosts to their plugins. It provides a direct line of access to all WordPress websites, and is therefore a convenient, free place to host your plugin. In return, the plugins in the repository must be freely available by the plugin authors. In the past few weeks, the repository has been in the news. Some statistics were unexpectedly removed, and this has led to a conversation about the governance of the repository, as well as questions about whether or not the repository is still a worthwhile place to offer your free plugins, if you have a premium tier. Alex Denning wrote a post entitled, “WordPress.org is ineffective for plugin distribution in 2022”, in which he lays out his thoughts as to why he no longer recommends the WordPress repository. The battle against already successful plugins, low conversion rates, and the difficulty in gaining visibility are amongst the arguments that he puts forward. Shortly after Alex’s post was published, Matt Cromwell posted a rebuttal entitled, “The case for the WordPress freemium model”. And this is the basis of the podcast today. We talk about Matt’s history in WordPress as a premium plugin owner and how his experience leads him to conclude differently. That the WordPress repository can be successful, given the right expectations and approach. He’s found using the repository to be an effective channel to drive the plugins premium tier, as well as a way of offering a useful free donation tool to the community. It’s a fascinating chat and is sure to be of interest to anyone thinking about starting a freemium plugin. If you’re interested in finding out more, you can find all of the links in the show notes by heading over to WPTavern.com forward slash podcast. Where you’ll find all of the other episodes as well. And so, without further delay, I bring you Matt Cromwell. I am joined on the podcast today by Matt Cromwell. Hello, Matt. [00:04:19] Matt Cromwell: Hi, thanks for having me. [00:04:20] Nathan Wrigley: You’re very welcome. We’ve got a, an interesting subject today, all about the wordpress.org ecosystem and whether or not it would be sensible or otherwise to put your free plugin over there. Before we get stuck into that debate, though properly, anybody that is unfamiliar with Matt, let’s give him an opportunity to introduce himself. So, Matt, just give us a few moments of your time to tell us who you are, what your relationship is with WordPress, what you’ve done in the past in the WordPress space. [00:04:47] Matt Cromwell: Sure. I’ve been in WordPress for a while. I would say about 2012 or so. Jumped in and started building websites with WordPress, mostly helping non-profit organizations, churches, educational institutions. Then ended up partnering up with my longtime business partner, Devin Walker, and he and I decided to tackle a big problem in WordPress, which at that time was how to take online donations. And so we created a plugin called GiveWP, and that was launched in 2015. That has catapulted us into our career, and has done really well and we’re really proud of it. So much so that we sold it last year to uh, Liquid Web, which is where we are now in the StellarWP brands. There, we have also just recently been asked to uh, take on a bit more. And so now Devin and I are both managing GiveWP as well as iThemes, Iconic and Kadence WP. So things keep getting more and more exciting. [00:05:44] Nathan Wrigley: Thank you very much. Yeah, really broad and rich history there. We could have spent the podcast talking about those products, but we’re not going to. Well, I think we might do tangentially as a way of demonstrating different things. But we’re on the podcast today to talk about a couple of pieces which came out. I will link correctly to both of the pieces that we’re in discussions about today. But I’ll mention them both in turn so that those listening to the podcast could possibly have a quick read of them before they pursue any further. So the first one was produced on the 18th of October by Alex Denning over at getellipsis.com, and that piece was called wordpress.org is ineffective for plugin distribution in 2022. And then a few days after that, you, Matt Cromwell, wrote a piece and that was at mattcromwell.com and it was called the case for the WordPress plugin freemium model. And in effect, your piece coming a little bit later was a rebuttal about what Alex was
Continue reading