It’s been a busy week in the world of websites, and if you run a WordPress site — even a small one — there are a few things worth five minutes of your time. A serious security flaw has been putting sites at risk, there’s a plugin worth double-checking, some handy new features are on the way, and there’s a timely reminder about who can actually use your website. Here’s the plain-English version.
1. If you haven’t updated WordPress this week, do it now
Security researchers found a serious flaw in WordPress itself, nicknamed “wp2shell”, that let attackers break into a site without a username, password, or any plugin installed — just a stock WordPress install was enough. It’s about as bad as these things get, and it affected the vast majority of WordPress sites worldwide. WordPress has already released fixes and, unusually, pushed the update out automatically to affected sites because of how serious it is. Even so, it’s worth logging into your dashboard and checking your version number is 7.0.2 (or 6.9.5 if you’re on an older version). If you use a managed WordPress host, ask them to confirm you’re covered.
2. Check your plugins too, especially login ones
Separately, a widely-used login plugin (miniOrange’s single sign-on tool) was found to have a serious hole in its “forgot password” process that could let someone take over accounts without ever knowing the password. It’s a good reminder that your website’s security isn’t just about WordPress itself — every plugin you’ve installed is a potential door in. If you’re not actively using a plugin, the safest move is to delete it, not just deactivate it. For the ones you do use, keep automatic updates switched on where you can.
3. Making your site look right on every screen is about to get easier
On a brighter note, the next version of WordPress (7.1, due out in August) is bringing a much-requested improvement: you’ll be able to style how something looks on mobile, tablet and desktop directly in the editor, with a resizable preview instead of clicking between three fixed screen sizes. If you’ve ever fiddled with your site on a laptop only to find it looks cramped or oddly spaced on a phone, this is aimed squarely at that headache. Nothing to do yet, but worth knowing it’s coming.
4. A reminder: your website needs to work for everyone
Away from WordPress specifically, there’s been renewed attention on website accessibility for UK businesses. Under the Equality Act 2010, businesses of any size are expected to make “reasonable adjustments” so disabled visitors can use their website — things like readable text contrast, sensible font sizes, and forms that work with screen readers. There’s no small-business exemption, and a disabled visitor can bring a claim if a site is genuinely inaccessible. Most WordPress themes handle the basics reasonably well, but it’s worth an occasional check: can you navigate your own site using only a keyboard? Is your text easy to read at a glance? A little care here protects both your customers and your business.
The takeaway
None of this needs to be complicated. Set aside ten minutes this week to log into your WordPress dashboard, check your version number, update any plugins showing an alert, and remove anything you no longer use. If you’re not confident doing this yourself, or you’re not sure whether your site is affected, get in touch and we’ll happily take a look for you — a quick health check now is far cheaper than a hacked website later.
