WordPress Secure Code Reviews

Hi I’m Tim, a WordPress security consultant who helps organisations like yours stay protected online.

I provide a range of security focus services, one of which is my secure code review which is a review of custom code be it a plugin, theme or indeed anything else you or someone else has written on your behalf.

The secure code review is aimed at developers who are selling commercial plugins and themes to a wide audience. It is not exclusive and I’m as happy looking at code made specifically for your inhouse projects as well. The secure code review is a mix of automated and manual reviews, the automated includes using code sniffing and static analysis (where possible) to identify issues, as well as actual testing the functionality as a bad actor would with automated tools. The second part of the review is a line by line review of the code base, this manual review flags up where logic might not work as intended. Think of me as the second pair of eyes, but one that hasn’t been staring at this project for weeks on end so I’m coming in fresh and with a new perspective. This is a security review, but vulnerabilities are often derived from bugs, so where I spot issues that are not security related I tend to jot them down as well.

How does it work?

Code reviews are designed to be as painless as possible, it starts by getting in touch and then we will do a quick discovery call to get a little bit of a background about yourselves, your site and what your hopes and reasons for the review are.

After the call I will ask for a copy of the code base as part of that I will send a copy of our NDA (or sign yours if you have one) so you know your code is not going anywhere. I need the code base to generate the quote, the cost is determined on the size and complexity of the code base, but for most plugins and themes it is £1950 some codebases might be more expensive.

If you are happy with the quote then there is some paperwork to be done in the form of a contract.

The final step before getting started is the invoice, which is also when we book in the date for the review. The review normally takes 3 days on average and you can expect the report within 4-5 working days. But I will go through specifics with you at the time.

With all the paperwork done I will ask for an up to date version of the codebase. Testing is done on my own specially designed VM (virtual machine), it allows me to do much more aggressive testing but in a very controlled environment, where all my automated tools are preconfigured.

When the report is ready, its sent over and contains:

• A summary of what was found
• A Traffic light based report highlighting priority issues, with each item an explanation of what the issue is as well as a recommendation on how to fix it.
• Next step recommendations for what to do to take the site security even further.

The last step is organising a meeting to go through the report, this is an opportunity for me to explain and highlight items and you to ask lots of questions about the review and recommendations.