WordPress plugins continue to be under attack by hackers using stolen credentials (from other data breaches) to gain direct access to plugin code.  What makes these attacks of particular concern is that these supply chain attacks can sneak in because the compromise appears to users as plugins with a normal update.

Supply Chain Attack

The most common vulnerability is when a software flaw allows an attacker to inject malicious code or to launch some other kind of attack, the flaw is in the code. But a supply chain attack is when the software itself or a component of that software (like a third party script used within the software) is directly altered with malicious code. This creates the situation where the software itself is delivering the malicious files.

The United States Cybersecurity and Infrastructure Security Agency (CISA) defines a supply chain attack (PDF):

“A software supply chain attack occurs when a cyber threat actor infiltrates a software vendor’s network and employs malicious code to compromise the software before the vendor sends it to their customers. The compromised software then compromises the customer’s data or system.

Newly acquired software may be compromised from the outset, or a compromise may occur through other means like a patch or hotfix. In these cases, the compromise still occurs prior to the patch or hotfix entering the customer’s network. These types of attacks affect all users of the compromised software and can have widespread consequences for government, critical infrastructure, and private sector software customers.”

For this specific attack on WordPress plugins, the attackers are using stolen password credentials to gain access to developer accounts that have direct access to plugin code to add malicious code to the plugins in order to create administrator level user accounts at every website that uses the compromised WordPress plugins.

Today, Wordfence announced that additional WordPress plugins have been identified as having been compromised. It may very well be the case that there will be more plugins that are or will be compromised. So it’s good to understand what is going on and to be proactive about protecting sites under your control.

More WordPress Plugins Attacked

Wordfence issued an advisory that more plugins were compromised, including a highly popular podcasting plugin called PowerPress Podcasting plugin by Blubrry.

These are the newly discovered compromised plugins announced by Wordfence:

• WP Server Health Stats (wp-server-stats): 1.7.6
  Patched Version: 1.7.8
  10,000 active installations
• Ad Invalid Click Protector (AICP) (ad-invalid-click-protector): 1.2.9
  Patched Version: 1.2.10
  30,000+ active installations
• PowerPress Podcasting plugin by Blubrry (powerpress): 11.9.3 – 11.9.4
  Patched Version: 11.9.6
  40,000+ active installations
• Latest Infection – Seo Optimized Images (seo-optimized-images): 2.1.2
  Patched Version: 2.1.4
  10,000+ active installations
• Latest Infection – Pods – Custom Content Types and Fields (pods): 3.2.2
  Patched Version: No patched version needed currently.
  100,000+ active installations
• Latest Infection – Twenty20 Image Before-After (twenty20): 1.6.2, 1.6.3, 1.5.4
  Patched Version: No patched version needed currently.
  20,000+ active installations

These are the first group of compromised plugins:

• Social Warfare
• Blaze Widget
• Wrapper Link Element
• Contact Form 7 Multi-Step Addon
• Simply Show Hooks

More information about the WordPress Plugin Supply Chain Attack here.

What To Do If Using A Compromised Plugin

Some of the plugins have been updated to fix the problem, but not all of them. Regardless of whether the compromised plugin has been patched to remove the malicious code and the developer password updated, site owners should check their database to make sure there are no rogue admin accounts that have been added to the WordPress website.

The attack creates administrator accounts with the user names of “Options” or “PluginAuth” so those are the user names to watch for. However, it’s probably a good idea to look for any new admin level user accounts that are unrecognized in case the attack has evolved and the hackers are using different administrator accounts.

Site owners that use the Wordfence free or Pro version of the Wordfence WordPress security plugin are notified if there’s a discovery of a compromised plugin. Pro level users of the plugin receive malware signatures for immediately detecting infected plugins.

The official Wordfence warning announcement about these new infected plugins advises:

“If you have any of these plugins installed, you should consider your installation compromised and immediately go into incident response mode. We recommend checking your WordPress administrative user accounts and deleting any that are unauthorized, along with running a complete malware scan with the Wordfence plugin or Wordfence CLI and removing any malicious code.

Wordfence Premium, Care, and Response users, as well as paid Wordfence CLI users, have malware signatures to detect this malware. Wordfence free users will receive the same detection after a 30 day delay on July 25th, 2024. If you are running a malicious version of one of the plugins, you will be notified by the Wordfence Vulnerability Scanner that you have a vulnerability on your site and you should update the plugin where available or remove it as soon as possible.”

Read more:

WordPress Plugins Compromised At The Source – Supply Chain Attack

3 More Plugins Infected in WordPress.org Supply Chain Attack Due to Compromised Developer Passwords

Featured Image by Shutterstock/Moksha Labs

Enterprise technical SEO is the practice of optimizing a large, enterprise company’s website to help search engines find, crawl, understand, and index your pages. It helps increase visibility and rankings in search engines.

Enterprise websites are where technical SEO shines. There’s so much money at stake. One mistake can keep millions of pages out of the index or remove an entire site from search results. One fix can potentially be worth millions of dollars in revenue.

Let’s look at what it takes to be successful at technical SEO in an enterprise environment.

Enterprise sites can have complex infrastructures and a lot of legacy systems in place. You’ll have to work with a lot of teams, work through a lot of issues, and work hard on getting buy-in.

Working with others

Technical SEOs will likely work with a lot of dev teams, but you may end up working with all kinds of teams in different area like products or services, international because of hreflang, taxonomists and/or ontologists for website structure, infrastructure, CMS teams, or even security for things that get indexed but shouldn’t be.

You’ll probably have to create a lot of reports for a lot of different teams and executives. Check out our guide on enterprise SEO metrics and reporting for some tips.

Organizational improvements

Many teams start off doing ad-hoc work, but eventually things start to centralize, you create standards and processes (SOPs), and eventually you start to get more buy-in by being more proactive and doing things like training other teams.

A lot of this progression depends on a leader who can be successful, visible, and sell SEO in the organization. They will likely spend as much, or more time promoting successes as they will doing the work.

They may have to create SEO forecasts, have lots of executive meetings to show results, train other teams, create those SOPs, send newsletters to keep others informed, etc.

For technical SEOs in particular, make sure you also promote the work of the developers and teams you work with. If you can get them visibility and a promotion, you’ll have an advocate for SEO who is bought in and will be more likely to work with you on future projects.

Professional development

Take advantage of any funds you’re given for SEO courses, conferences, etc. I highly recommend attending Ahrefs Evolve if you get a chance. If you want to be a manager, you may also look into managerial or leadership courses.

A big part of technical SEO will be setting up your crawls and monitoring for issues. While it would be great if you could get everything technically perfect, it’s rarely realistic on enterprise websites.

One of the things I like about Ahrefs’ Site Audit is that you can choose to ignore issues that you don’t find important.

You can also add any custom issues that you want. We have every data point for the pages and links configurable as issues, as well as changes between dates. You can even change the prioritization level for each issue.

You might also want to break down issues by CMS or even by template so you know exactly which group each issue belongs to and can see when they resolve the issues. This can be done with segments in Site Audit.

You can help a lot of other teams with their data needs. You will likely be asked for things like checking for scripts or outdated file versions, words you’re not supposed to mention, extracting authors, publish dates, update dates, or other useful data.

In many crawlers, you’ll need to do this setup before crawling, but in Ahrefs Site Audit you can actually search within the HTML or text after the crawl has already happened.

For your crawling, you have a few options.

Normal crawls

Catch issues before they launch

You can also use Ahrefs’ Site Audit to crawl staging and dev environments to check for any issues before they’re launched to the public.

Catch any issues faster with crawl sampling

You can run Ahrefs’ Site Audit for a custom list of pages daily and get alerted to any changes. Using a sample across different templates or systems, you can find issues faster.

You could also run a smaller crawl on any section that made any new pushes to production.

The fastest way to catch changes: always-on crawling

IndexNow is allowing us to add a real-time option, and at the same time we will be able to save resources for our users and ourselves.

For sites using IndexNow and the new always-on option in Site Audit, we’ll be able to notify users of issues shortly after they make updates to their pages.

This is how that will look:

I can’t think of a system that would be better than this. A practically real-time monitoring and alerting system. As a technical SEO, this is a dream come true for me.

Check out our study on technical SEO issues. We ran audits on over 1,000,000 websites to see the most common issues.

You have to prioritize tasks and focus on the most significant issues. I typically use an impact / effort matrix as a visual to help others understand what I consider the most important tasks. Here’s what that looks like:

You will likely have to work with any dev teams for a better effort prediction, but in my experience I’ve found they appreciate it if you take a first pass at estimating the effort involved. Then give them the opportunity to make adjustments based on how much effort they think it will take.

You may have major incidents and end up in what are sometimes called fire drills or war room situations where stakeholders are gathered to work through a problem. In this case, something likely went horribly wrong and is costing the company a lot of money. This will always override any other priorities.

I doubt there’s a major website that is technically perfect. If there was, I’d be concerned they were wasting resources on things that don’t matter over things that do.

What’s interesting about enterprise, is that sometimes you have to make decisions that aren’t necessarily ideal. For instance, you might have some pages or sections of the site with issues that never get fixed because doing so is more expensive than the work involved. The return on investment (ROI) just isn’t there.

Instead of doing what is right, sometimes you’ll have to choose the least bad option. You won’t have control of everything. Just do the best you can and when you have the opportunity, make the most future-proof decisions you can.

I wanted to cover some projects to help you get started with technical SEO in an enterprise. Of course you may want to start with a technical SEO audit first in order to identify the issues.

Check indexing

You probably have some pages indexed that shouldn’t be, and many pages noindexed that should be indexed. Canonicalization is another issue to check to make sure the version of a page you want indexed is the one that is indexed.

First, check the Indexability report in Site Audit for “Noindex page” warnings.

Google can’t index pages with this warning, so it’s worth checking they’re not pages you want indexed.

You can also check the Site Structure report in Site Explorer for any pages with organic traffic that shouldn’t have traffic.

Recover links with link reclamation

Sites, and the web in general, are always changing. We ran a study that found that ~two-thirds of links to pages on the web disappeared in the nine-year period we looked at.

In many cases, your old URLs have links from other websites. If they’re not redirected to the current pages, then those links are lost and may no longer count for your pages.

It’s not too late to do these redirects, and you can quickly reclaim any lost value and help your content rank better. I normally assign a dollar amount like $400 per referring domain in order to make a business case for this.

Here’s how to find those opportunities:

• Paste your domain into Site Explorer
• Go to the Best by links report
• Add a “404 not found” HTTP response filter

I usually sort this by “Referring domains.”

I even created a script to help you match redirects. Don’t be scared away; you just have to download a couple of files and upload them. The Colab notebook walks you through it and takes care of the heavy lifting for you.

While this script could be run periodically, if you’re constantly having to do redirects, I would recommend that you automate the implementation. You could pull data from the Ahrefs API and visits from your analytics into a system. Then create logic like >3 RDs, >5 hits in a month, etc. and flag these to be redirected, suggest redirects, or even automatically redirect them.

If you had redirects in place for a year or more already, the value is likely already consolidated to the new pages. That’s what Google recommends and seemed to be true when we tested it. You could also add a flag for “was redirected” into the automation logic that checks if the page was previously redirected for a year to account for this.

Add internal links

I’ve always found internal links to be a powerful way to help pages rank higher.

Even these links may be difficult to get in an enterprise environment. Sometimes different people are responsible for different sections of the website, which can make internal linking time-consuming and may require meetings and a lot of follow up to get internal linking done.

On top of the political hurdles, the process for internal linking can be a bit convoluted. You either have to know the site well and read through various pages looking for link opportunities, or you can follow a process that involves a lot of scraping and crawling to find opportunities.

At Ahrefs, we’ve made this simple, scalable and accessible so anyone can find these opportunities. The easiest way to see internal link opportunities is with the Internal Link Opportunities report in Site Audit. We look at what your pages are ranking for and suggest links from other pages on your site that talk about those things.

Add schema markup

I’m a fan of schema markup as long as it gets you a search feature. Check out our guide to schema markup to see which ones you should be implementing. There are some cool tools now that can even suggest schema markup based on what is seen on the page.

Fix Page Experience

• Core web vitals. This is how fast your pages load.
• HTTPS. You want your pages to be secure. A surprising number of sites, >6%, redirect HTTPS to HTTP.
• Mobile-friendliness. Are your pages usable on mobile?
• Interstitials. You don’t want intrusive interstitials, or those that take up a good chunk of the screen.

We cover most of these in Site Audit. For example, we pull PageSpeed Insights data so you get actual Chrome User Experience Report (CrUX) metrics for Core Web Vitals as well as Lighthouse metrics in Site Audit.

We also flag mobile SEO issues.

General website health / maintenance

• Broken links. Find them and fix them.
• Redirect Chains. Google will follow up to 10 hops. I don’t worry until after 5 hops.
• Add sitemaps. I would make sure this is automated. If you are asked to manually create them, you can do it, but just know that if it’s manual these will rarely be kept up-to-date. If you’re creating them based on crawled pages, then it’s likely all search engines can crawl them anyway.

You may want to check if any of the chains are too long. Look for this in the “Issues” tab in the Redirects report.

Fix Hreflang issues

Hreflang helps show the right page to the right user in search. This can be crucial for enterprise companies to get right as the dropoff from bad pathing or annoying users can cost you a lot of money.

We flag a number of different hreflang issues in Site Audit.

There are also some nice visualizations to help you explain issues like this first-if-its-kind hreflang cluster visualization. It shows and tells you what is broken, making it much easier to explain to stakeholders than the typical spreadsheet.

Optimize crawl budget

Crawl budget can be a concern for larger sites with millions of pages or sites that are frequently updated. In general, if you have lots of pages not being crawled or updated as often as you’d like, then you may want to look into speeding up crawling.

Optimize ecommerce pages

Ecommerce SEO would be important for any sites selling products.

For enterprise sites, faceted navigation in particular can be tricky. Luckily we have a great guide on faceted navigation.

Fix JavaScript SEO issues

The bigger the site, the more likely you are to run into multiple tech stacks. Some of those may be JavaScript frameworks. These are relatively newer than CMSs and less understood by SEOs, so we have a guide on JavaScript SEO that covers many of the issues you’ll face and how to troubleshoot them, as well as how the rendering process works for Google.

Migrate other websites

A website migration is any significant change to a website’s domain, URLs, hosting, platform, or design. Big companies like to change these things and it creates havoc. Try to write any standards to keep things consistent and minimize the impact of changes.

Keep traffic during mergers and acquisitions

Enterprise companies buy other companies all the time. When I worked in enterprise SEO, I felt like I was constantly doing one website merger project or another. There’s a lot that can go wrong and a lot of money on the line. Check out our guide on SEO for mergers and acquisitions for more info.

Analyze log files

Pull data from APIs

Machine learning tasks

• Ahrefs’ Site Audit. It really is best-in-class. Check it out! We’re the most used cloud-based site audit tool. We crawl ~700 million pages a day.
• Google Search Console. It has several useful tools to check indexing, crawling, etc.

Also check out our guide to enterprise SEO tools.

Final thoughts

If you have any tips, enterprise SEO experiences you’d like to share, or questions, let me know on X or LinkedIn.

Has someone written something about your business online that’s misleading, inaccurate, or just downright nasty?

If you’re worried this could impact your business, you’ll need to start online reputation management (ORM). But where should you start with ORM? And what the heck is it?

In this beginner’s guide, I’ll explain what online reputation management is, why it’s important, and how you can manage your business’s reputation effectively online.

Online reputation management is the process of monitoring, maintaining, and positively influencing the perception of your business across the Internet using digital marketing tactics.

Although ORM may seem similar to digital PR, it focuses more on responding to customers’ reviews and correcting misleading information that could negatively impact your business’s reputation.

Online reputation management shows customers their opinions matter and encourages them to contact you directly if they have an issue.

ORM usually focuses on Google, websites, and social media—because that’s where people leave reviews. But, as we can see below, the emergence of LLMs adds further complexity into the mix.

If we zoom in, it’s clear that managing your online reputation is actually even more nuanced than this.

You’ve probably noticed that almost everything feeds back into Google. Google uses SERP features to highlight important content from third-party sites, such as social media, within its search results.

So if there’s a bad review about your company on any of these platforms, it could be pulled into Google’s search results.

ORM is important because, if done right, it can help you win back potential customers and protect your business’s sales and revenue.

It’s also important because:

• Certain online places hold a disproportionate influence
• It’s never been easier or faster to put a review online
• Responding to customers’ feedback builds trust and credibility with your brand

Let’s explore these concepts further.

Certain online places hold a disproportionate influence

When people think of online reviews, they think of Google reviews first. There’s a reason for this—Google has made it ridiculously easy to leave a review for any business, making them an important focus for ORM.

Often, all you have to do is search for the brand and click the “write a review” button—right from the search results.

This star rating also shows on Google maps. These ratings can make or break a business.

I held a quick poll on LinkedIn to confirm whether this was true, and this was confirmed:

Maintaining a good star rating is vital for customer-facing businesses like restaurants or hotels and anyone with a small business.

For example, someone looking for a restaurant can filter Google Maps results to show only businesses with a specific rating.

Put yourself in the shoes of your customers who notice a terrible review—this might be the journey they go through:

TLDR: If your business doesn’t have a good star rating on Google, you’ll miss out on potential sales due to your online reputation.

In addition to Google reviews, you may have noticed that Reddit has recently started to appear more frequently in Google searches. This is due to Google adding the new discussions and forums search feature to the search results.

Here’s what it looks like:

This feature highlights forum results from sites like Reddit and relevant forums in the search results where “diverse personal experiences” are considered beneficial.

The issue for ORM is that these personal experiences could pose a reputational threat to your business, as they can be highlighted in the search results, as in this example, from a UK broadband provider.

A quick check of Ahrefs’ Site Explorer shows that Reddit URLs with the word “review” that rank number one in Google have skyrocketed since last year. This means Reddit is influencing review keywords more than ever before.

This means you can’t afford to ignore platforms like Reddit anymore for online reputation management. At the very least, you’ll need to monitor and respond to conversations there.

It’s never been easier or faster to put a review online

After he placed the review, the restaurant owner responded by sending him a meeting invitation for a fight in the car park at 3 a.m.

In this example, the restaurant’s name wasn’t mentioned. Still, the fact that it got 2.1 million likes shows the reputational damage this kind of content can do.

Responding to customer’s feedback builds trust and credibility with your brand

Leaving negative reviews without responses can suggest that your business doesn’t care about its customers, so it’s really important for ORM to respond when there’s a negative comment.

Here’s an example of where I complained about service at a restaurant and then left a negative review.

What made my review experience different was that the business contacted me with a comment to discuss further and followed up with an email.

Returning to their reviews on Google now, I can see that this business has made a decent effort to respond to almost every comment on Google reviews—good and bad.

Because they replied, I would consider going back there, but if they didn’t, I probably would have written them off completely.

In other words, responding to customers shows a commitment to customer satisfaction and can help limit damage if a negative incident occurs. It can also help attract new customers and retain existing ones.

1. Check the 1st page on Google for reputational threats

These highlighted results could pose a reputational risk to this company.

If we click on the Trustpilot review, we can see that 92% of users have given this company a 1-star rating—impressively bad.

Although many companies won’t have this level of negative sentiment against their brand, it’s important for online reputation management to be aware of the status of the first page of Google for your brand.

So far, we’ve easily identified some obvious brand weaknesses, but to go further, we need to do a SERP SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis on other brand-related keywords.

Although this may seem like a boring business school 101 exercise, it’s the fastest way to determine what to focus on from a reputational standpoint.

Here’s how I’d do this using Keywords Explorer’s SERP Overview.

1. Search for “your brand + review”
2. Label each search result as a strength, weakness, opportunity, or threat

Once you’ve done this for your brand and brand + review(s), you’ll know the degree of risk for these keywords.

2. Find popular branded search terms…then create content to address those searches

Some Google SERPs may have results that could influence your brand narrative in the wrong way.

Here’s an example of how we addressed this at Ahrefs for the keyword “ahrefs affiliate program.”

Rather than leaving a question like “Does Ahrefs have an affiliate program?” unanswered or letting third-party sites answer it, Ahrefs’ CMO, Tim Soulo, decided to take matters into his own hands and write a blog post about the Ahrefs affiliate program to answer the question once and for all.

The result was that the new article ranked number one for this query in the space of a year. Tim also followed it up with a LinkedIn post on Ahrefs’ affiliate program, which also started ranking.

Within a year, all of the competitor results were displaced, and now Ahrefs owns most of the SERP for this keyword (shown in yellow).

In short, the trick here is to:

• Identify a branded keyword that poses a potential reputational risk (or that you want to control the SERP for)
• Fill the gap with your content – As Tim did by creating a blog about the Ahrefs affiliate program
• Back it up with 3rd party authority sites or related onsite content – As Tim did with the LinkedIn post and our authors did with the supplementary blog content

3. Ask customers how to improve your products and services

• Canny.io, our product feedback platform
• UGC platforms like Reddit
• From our customer support platform

Our Ahrefs canny.io board allows customers to share feature suggestions to help improve our product.

This is important because it helps our customers be part of the journey and invest in the product. On the platform, customers can upvote their favorite feature requests or add their own suggestions.

Another way Ahrefs gets feedback is through UGC platforms like Reddit. Impressively, our CMO, Tim Soulo, has asked Reddit for feedback for over eight years.

It’s no secret that sometimes feedback can be challenging to read, but it’s a necessary process for improving your service.

We also collect feedback from our customer support team and monitor customer sentiment through Intercom.

We also have a feedback channel on Slack that is dedicated to highlighting customer feedback—good and bad.

4. Promote fair reviews on big authority sites

One criticism from the review was that Ahrefs doesn’t have a free trial. They haven’t mentioned Ahrefs Webmaster Tools, which gives website owners free limited access to Site Explorer and Site Audit.

Another criticism was that Ahrefs “wasn’t competitively priced.” Since the review was written, we have introduced a new starter plan that is only $29 per month—so it seems unfair to say this now. This article is a good target for our own ORM efforts.

You should monitor these things on big authority sites that mention your brand. Ensure you’ve set up your brand alerts to keep track of these reviews.

5. Set up brand alerts for Reddit and websites

I use a tool called Feedly to monitor important Reddit threads and Google News related to Ahrefs.

This is one of the best ways to monitor this type of information. You can even track newsletter mentions through the platform.

If you want to track your brand’s web mentions, my favorite tool is Ahrefs’ Alerts. This tool allows you to track conversations on third-party websites.

Here’s how to set this up in Ahrefs Alerts:

• Go to Ahrefs Alerts > Mentions > + Add Alert
• Create an alert for your company name (e.g., “ahrefs.”)
• Hit Add

To prevent Ahrefs from sending alerts for mentions on your own domain, add your website as an excluded domain. I also recommend adding sites like youtube.com and other sites you prefer not to monitor as well.

How to manage your online reputation on social media

Monitoring your most important social media channels in real-time

At Ahrefs, we monitor our Twitter—sorry, our “X”—feed in Slack, so the whole team knows how our brand is being discussed on that platform.

Set up brand alerts for social media

At Ahrefs, we use Brand24 to monitor our social media presence. It’s a great way to track critical mentions of your brand, analyze sentiment, and create reports.

When you get praise on social media — endorse (and amplify it)

Along with monitoring for potential social media threats, you must endorse and amplify your brand when you get positive feedback from others.

At Ahrefs, we do this on a company and personal level for other team members. It’s easy to do this on LinkedIn. Rather than going for a bland “Like,” try another more spicy option.

Here’s an example of the Ahrefs account doing this—it stands out much more.

Here’s another example where my colleague Shermin Lim shared that she loved a post from a Ahrefs’ workshop attendee sharing positive feedback.

Finally, here’s an example of when SEO superstar Aleyda Solis mentioned my article on SEO challenges in her newsletter.

And Ryan Law was the first to love my comment on the post—thanks, boss!

All this activity helps to ensure that you are putting your best foot forward online.

Final thoughts

Tools like Keywords Explorer’s SERP overview can help dissect Google’s SERPs and identify reputational threats for your brand. Got questions? Ping me on X.