As part of our new push to improve the security of WordPress plugins through our Plugin Security Scorecard tool, next month it is going to start lowering the grade for plugins if the developer isn’t linking to the results of a security review of the plugin. To make sure that we practice what we preach, we are doing security reviews of our plugins and linking to those results in the way we are suggesting other developers do so. We can’t hire someone else to do them, as we are not aware of anyone else that actually does reviews and has released any results to check on accuracy of their results. By comparison, we have been doing that for years.
For our first review, we checked over our Plugin Vulnerabilities Firewall plugin. [Read more]