Connect with us
Cloak And Track Your Affiliate Links With Our User-Friendly Link Cloaking Tool, Try It Free

SEO

2024 WordPress Vulnerability Report Shows Errors Sites Keep Making

Published

on

2024 Annual WordPress security report by WPScan

WordPress security scanner WPScan’s 2024 WordPress vulnerability report calls attention to WordPress vulnerability trends and suggests the kinds of things website publishers (and SEOs) should be looking out for.

Some of the key findings from the report were that just over 20% of vulnerabilities were rated as high or critical level threats, with medium severity threats, at 67% of reported vulnerabilities, making up the majority. Many regard medium level vulnerabilities as if they are low-level threats and that’s a mistake because they’re not low level and should be regarded as deserving attention.

The WPScan report advised:

“While severity doesn’t translate directly to the risk of exploitation, it’s an important guideline for website owners to make an educated decision about when to disable or update the extension.”

WordPress Vulnerability Severity Distribution

Critical level vulnerabilities, the highest level of threat, represented only 2.38% of vulnerabilities, which is essentially good news for WordPress publishers. Yet as mentioned earlier, when combined with the percentages of high level threats (17.68%) the number or concerning vulnerabilities rises to almost 20%.

Here are the percentages by severity ratings:

  • Critical 2.38%
  • Low 12.83%
  • High 17.68%
  • Medium 67.12%

Authenticated Versus Unauthenticated

Authenticated vulnerabilities are those that require an attacker to first attain user credentials and their accompanying permission levels in order to exploit a particular vulnerability. Exploits that require subscriber-level authentication are the most exploitable of the authenticated exploits and those that require administrator level access present the least risk (although not always a low risk for a variety of reasons).

Unauthenticated attacks are generally the easiest to exploit because anyone can launch an attack without having to first acquire a user credential.

The WPScan vulnerability report found that about 22% of reported vulnerabilities required subscriber level or no authentication at all, representing the most exploitable vulnerabilities. On the other end of the scale of the exploitability are vulnerabilities requiring admin permission levels representing a total of 30.71% of reported vulnerabilities.

Permission Levels Required For Exploits

Vulnerabilities requiring administrator level credentials represented the highest percentage of exploits, followed by Cross Site Request Forgery (CSRF) with 24.74% of vulnerabilities. This is interesting because CSRF is an attack that uses social engineering to get a victim to click a link from which the user’s permission levels are acquired. This is a mistake that WordPress publishers should be aware of because all it takes is for an admin level user to follow a link which then enables the hacker to assume admin level privileges to the WordPress website.

The following is the percentages of exploits ordered by roles necessary to launch an attack.

Ascending Order Of User Roles For Vulnerabilities

  • Author 2.19%
  • Subscriber 10.4%
  • Unauthenticated 12.35%
  • Contributor 19.62%
  • CSRF 24.74%
  • Admin 30.71%

Most Common Vulnerability Types Requiring Minimal Authentication

Broken Access Control in the context of WordPress refers to a security failure that can allow an attacker without necessary permission credentials to gain access to higher credential permissions.

In the section of the report that looks at the occurrences and vulnerabilities underlying unauthenticated or subscriber level vulnerabilities reported (Occurrence vs Vulnerability on Unauthenticated or Subscriber+ reports), WPScan breaks down the percentages for each vulnerability type that is most common for exploits that are the easiest to launch (because they require minimal to no user credential authentication).

The WPScan threat report noted that Broken Access Control represents a whopping 84.99% followed by SQL injection (20.64%).

The Open Worldwide Application Security Project (OWASP) defines Broken Access Control as:

“Access control, sometimes called authorization, is how a web application grants access to content and functions to some users and not others. These checks are performed after authentication, and govern what ‘authorized’ users are allowed to do.

Access control sounds like a simple problem but is insidiously difficult to implement correctly. A web application’s access control model is closely tied to the content and functions that the site provides. In addition, the users may fall into a number of groups or roles with different abilities or privileges.”

SQL injection, at 20.64% represents the second most prevalent type of vulnerability, which WPScan referred to as both “high severity and risk” in the context of vulnerabilities requiring minimal authentication levels because attackers can access and/or tamper with the database which is the heart of every WordPress website.

These are the percentages:

  • Broken Access Control 84.99%
  • SQL Injection 20.64%
  • Cross-Site Scripting 9.4%
  • Unauthenticated Arbitrary File Upload 5.28%
  • Sensitive Data Disclosure 4.59%
  • Insecure Direct Object Reference (IDOR) 3.67%
  • Remote Code Execution 2.52%
  • Other 14.45%

Vulnerabilities In The WordPress Core Itself

The overwhelming majority of vulnerability issues were reported in third-party plugins and themes. However, there were in 2023 a total of 13 vulnerabilities reported in the WordPress core itself. Out of the thirteen vulnerabilities only one of them was rated as a high severity threat, which is the second highest level, with Critical being the highest level vulnerability threat, a rating scoring system maintained by the Common Vulnerability Scoring System (CVSS).

The WordPress core platform itself is held to the highest standards and benefits from a worldwide community that is vigilant in discovering and patching vulnerabilities.

Website Security Should Be Considered As Technical SEO

Site audits don’t normally cover website security but in my opinion every responsible audit should at least talk about security headers. As I’ve been saying for years, website security quickly becomes an SEO issue once a website’s ranking start disappearing from the search engine results pages (SERPs) due to being compromised by a vulnerability. That’s why it’s critical to be proactive about website security.

According to the WPScan report, the main point of entry for hacked websites were leaked credentials and weak passwords. Ensuring strong password standards plus two-factor authentication is an important part of every website’s security stance.

Using security headers is another way to help protect against Cross-Site Scripting and other kinds of vulnerabilities.

Lastly, a WordPress firewall and website hardening are also useful proactive approaches to website security. I once added a forum to a brand new website I created and it was immediately under attack within minutes. Believe it or not, virtually every website worldwide is under attack 24 hours a day by bots scanning for vulnerabilities.

Read the WPScan Report:

WPScan 2024 Website Threat Report

Featured Image by Shutterstock/Ljupco Smokovski

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address

SEO

Google On The 2 Types Of Searches It Still Struggles With

Published

on

By

Google On The 2 Types Of Searches It Still Struggles With

While Google has made strides in understanding user intent, Director & Product Manager Elizabeth Tucker says two types of queries remain challenging.

In a recent episode of Google’s Search Off The Record podcast, Tucker discussed some lingering pain points in the company’s efforts to match users with the information they seek.

Among the top offenders were searches containing the word “not” and queries involving prepositions, Tucker reveals:

“Prepositions, in general, are another hard one. And one of the really big, exciting breakthroughs was the BERT paper and transformer-based machine learning models when we started to be able to get some of these complicated linguistic issues right in searches.”

BERT, or Bidirectional Encoder Representations from Transformers, is a neural network-based technique for natural language processing that Google began leveraging in search in 2019.

The technology is designed to understand the nuances and context of words in searches rather than treating queries as a bag of individual terms.

‘Not’ There Yet

Despite the promise of BERT and similar advancements, Tucker acknowledged that Google’s ability to parse complex queries is still a work in progress.

Searches with the word “not” remain a thorn in the search engine’s side, Tucker explains:

“It’s really hard to know when ‘not’ means that you don’t want the word there or when it has a different kind of semantic meaning.”

For example, Google’s algorithms could interpret a search like “shoes not made in China” in multiple ways.

Does the user want shoes made in countries other than China, or are they looking for information on why some shoe brands have moved their manufacturing out of China?

This ambiguity poses a challenge for websites trying to rank for such queries. If Google can’t match the searcher’s intent with the content on a page, it may struggle to surface the most relevant results.

The Preposition Problem

Another area where Google’s algorithms can stumble is prepositions, which show the relationship between words in a sentence.

Queries like “restaurants with outdoor seating” or “hotels near the beach” rely on prepositions to convey key information about the user’s needs.

For SEO professionals, this means that optimizing for queries with prepositions may require some extra finesse.

It’s not enough to include the right keywords on a page; the content needs to be structured to communicate the relationships between those keywords.

The Long Tail Challenge

The difficulties Google faces with complex queries are particularly relevant to long-tail searches—those highly specific, often multi-word phrases that make up a significant portion of all search traffic.

Long-tail keywords are often seen as a golden opportunity for SEO, as they tend to have lower competition and can signal a high level of user intent.

However, if Google can’t understand these complex queries, it may be harder for websites to rank for them, even with well-optimized content.

The Road Ahead

Tucker noted that Google is actively improving its handling of these linguistically challenging queries, but a complete solution may still be a way off.

Tucker said:

“I would not say this is a solved problem. We’re still working on it.”

In the meantime, users may need to rephrase their searches or try different query formulations to find the information they’re looking for – a frustrating reality in an age when many have come to expect Google to understand their needs intuitively.

Why SEJ Cares

While BERT and similar advancements have helped Google understand user intent, the search giant’s struggles with “not” queries and prepositions remind us that there’s still plenty of room for improvement.

As Google continues to invest in natural language processing and other AI-driven technologies, it remains to be seen how long these stumbling blocks will hold back the search experience.

What It Means For SEO

So, what can SEO professionals and website owners do in light of this information? Here are a few things to keep in mind:

  1. Focus on clarity and specificity in your content. The more you can communicate the relationships between key concepts and phrases, the easier it will be for Google to understand and rank your pages.
  2. Use structured data and other technical SEO best practices to help search engines parse your content more effectively.
  3. Monitor your search traffic and rankings for complex queries, and be prepared to adjust your strategy if you see drops or inconsistencies.
  4. Monitor Google’s efforts to improve its natural language understanding and be ready to adapt as new algorithms and technologies emerge.

Listen to the full podcast episode below:

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

SEO

Google Warns Of Soft 404 Errors And Their Impact On SEO

Published

on

By

. Gradient vector illustration of upset man sitting at work desk with laptop and seeing a system error.

In a recent LinkedIn post, Google Analyst Gary Illyes raised awareness about two issues plaguing web crawlers: soft 404 and other “crypto” errors.

These seemingly innocuous mistakes can negatively affect SEO efforts.

Understanding Soft 404s

Soft 404 errors occur when a web server returns a standard “200 OK” HTTP status code for pages that don’t exist or contain error messages. This misleads web crawlers, causing them to waste resources on non-existent or unhelpful content.

Illyes likened the experience to visiting a coffee shop where every item is unavailable despite being listed on the menu. While this scenario might be frustrating for human customers, it poses a more serious problem for web crawlers.

As Illyes explains:

“Crawlers use the status codes to interpret whether a fetch was successful, even if the contents of the page is basically just an error message. They might happily go back to the same page again and again wasting your resources, and if there are many such pages, exponentially more resources.”

The Hidden Costs Of Soft Errors

The consequences of soft 404 errors extend beyond the inefficient use of crawler resources.

According to Illyes, these pages are unlikely to appear in search results because they are filtered out during indexing.

To combat this issue, Illyes advises serving the appropriate HTTP status code when the server or client encounters an error.

This allows crawlers to understand the situation and allocate their resources more effectively.

Illyes also cautioned against rate-limiting crawlers with messages like “TOO MANY REQUESTS SLOW DOWN,” as crawlers cannot interpret such text-based instructions.

Why SEJ Cares

Soft 404 errors can impact a website’s crawlability and indexing.

By addressing these issues, crawlers can focus on fetching and indexing pages with valuable content, potentially improving the site’s visibility in search results.

Eliminating soft 404 errors can also lead to more efficient use of server resources, as crawlers won’t waste bandwidth repeatedly visiting error pages.

How This Can Help You

To identify and resolve soft 404 errors on your website, consider the following steps:

  1. Regularly monitor your website’s crawl reports and logs to identify pages returning HTTP 200 status codes despite containing error messages.
  2. Implement proper error handling on your server to ensure that error pages are served with the appropriate HTTP status codes (e.g., 404 for not found, 410 for permanently removed).
  3. Use tools like Google Search Console to monitor your site’s coverage and identify any pages flagged as soft 404 errors.

Proactively addressing soft 404 errors can improve your website’s crawlability, indexing, and SEO.


Featured Image: Julia Tim/Shutterstock

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

SEO

SEO Reporting for Agencies (With Real Report Examples)

Published

on

SEO Reporting for Agencies (With Real Report Examples)

SEO agencies obsess over their SEO reporting process. It’s their main method to share their achievements with their clients. Without it, clients could be left in the dark about their SEO progress—and trust me, you don’t want that.

In this article, I’ll share the structures of some real-world agency reports that have been shared with me and how different size agencies approach SEO reporting.

SEO agencies juggle multiple clients, so time spent on a fixed task like reporting can quickly add up.

For example, let’s say your agency has five clients and spends two hours per month on the entire SEO reporting process.

That’s over one day per month just spent on SEO reporting.

For this reason, as an agency owner, you want your clients to be high-paying with standardized reporting deliverables, but this is often far from reality.

And it can often look something like this:

And often, the higher the budget, the more tailored your reporting becomes.

Let’s face it: An enterprise client probably won’t be impressed by a basic PDF report you generated in 10 seconds using a third-party tool if they’re paying $XX,000 per month.

Likewise, a client paying $1000 per month would probably not know where to start if you gave them a 60-page SEO report and hooked them up with a Tableau dashboard.

SEO Reporting for Agencies With Real ReportSEO Reporting for Agencies With Real Report

So, based on this, we can say that there are two main types of client reports:

  • Small-medium business (SMB) SEO reports
  • Enterprise businesses’ SEO reports

But before we discuss the details, let’s explore the main differences between SMB and enterprise SEO reporting.

Element Small-medium business (SMB) SEO reporting Enterprise business SEO reporting
Scope Usually, one domain in one business category Can have multiple domains, multiple territories, and multiple business categories
Target audience Site owners, marketing team Marketing team, development team, senior stakeholders, other teams
KPIs ROI, website traffic, conversions, leads Different teams may have different KPIs for SEO
Recommendations High-impact changes that are easy to implement Incremental changes that provide long-term growth

In my experience, SEO reporting for SMBs usually consists of three elements:

SMB SEO reporting illustrationSMB SEO reporting illustration
  • SEO dashboards – Allows the client to check their SEO performance or KPIs at any time—usually fully automated
  • SEO report – Periodic update on the total SEO campaign, usually monthly. Focuses on commentary and insights, and the format of the report can vary
  • Presentation – Often, a video call with the client to run through the report and get feedback on the SEO performance

Sidenote.

Sometimes dashboards and SEO reports are combined, creating a hybrid format.

Agencies can automate their SEO reporting easily by using a free and easy-to-use solution like Google Looker Studio (GLS).

With Google Looker Studio, there are three options:

Option Difficulty Time investment
Set up your own dashboard Medium Time-consuming
Use existing templates Easy Less time-consuming
Use Ahrefs GLS templates Easiest Minimum

If you don’t want to create your own dashboards, we’ve done the hard work for you and have three Google Looker Studio connectors that pull the best bits from Ahrefs.

If you aren’t confident with APIs, this is one of the best ways to get data out of Ahrefs so your clients can see it without time-consuming manual reporting.

SEO reports for SMBs are usually a document that gives a periodic update on a website’s performance.

So what’s normally included in an SMB SEO report? In my experience, it can cover some or all of the following topics—depending on the focus of the client.

SEO reporting for SMBs illustrationSEO reporting for SMBs illustration

Tip

If your agency is working with an SMB, the easiest way to get started with SEO reporting is to use a simple, free template like our updated SEO report template and tweak it to your client’s exact requirements.
SEO Report Template illustrationSEO Report Template illustration

Not sure how to tweak it? Here are some real SEO agency report structure examples you can take inspiration from.

SEO agency report structure #1

1719681966 491 SEO Reporting for Agencies With Real Report1719681966 491 SEO Reporting for Agencies With Real Report

With this report a lot of the detail was in the organic visibility section, where it split out visibility by sector.

Also interestingly, it detailed the links acquired during the month for the agency in a classic link report—at the enterprise level, this is less common as enterprise clients acquire links all the time without lifting a finger.

SEO agency report structure #2

1719681967 312 SEO Reporting for Agencies With Real Report1719681967 312 SEO Reporting for Agencies With Real Report

This is a delivery-focused report. The “impact analysis” section is interesting as it details the impact that their landing page optimization work has had, concluding with two growth figures.

This is a good way to communicate to the client the value of the work you are doing.

Clients like to have their say when it comes to the SEO calls—after all, they’re paying for it. For SMBs, ensuring they get a good ROI is usually top of their minds.

At an SMB level, the agency should be able to provide a comprehensive assessment of the SEO status of the website and get feedback from the client.

For most SMB clients, the usual format is this:

  • Weekly status update call
  • Monthly report call following delivery of the monthly report

In my experience, it rarely deviates from this format.

The first rule of enterprise SEO reporting is that there are no rules. So, generally speaking, what the client wants, the client (usually) gets.

Here are a few examples of scenarios that can happen when enterprise clients come on board at your agency and start talking about SEO reporting:

  • “We already have our own in-house report. You can use our template [sends you horrible looking template].
  • “Our old agency had this report, can you do something similar?”
  • “We want dashboard reporting so we can monitor results in real-time.”
  • “Integrate your SEO reporting with our existing tools.”
  • “We want the SEO report to be integrated with PPC.”
  • “We want SEO to be included in a regular performance report.”

As enterprise SEO reporting is often just a chapter of the bigger performance marketing report, the SEO section has to be tailored to exactly what the client wants, with zero fluff.

When it comes to dashboard reporting, enterprise clients will usually expect a Tableau, PowerBI, or a custom-built solution, plus some data from Google Looker Studio.

Here’s a snapshot of what that can look like:

Tableau Dashboard Performance OverviewTableau Dashboard Performance Overview

I used Tableau when I was working with enterprise clients and found it hugely useful for SEO reporting.

The deliverables for enterprise SEO reports are broadly the same as those for SMB reports, but as always, the devil is in the details.

In short, there’s usually:

  • More personalization to the client’s business
  • More tools used – Rather than having one or two trusted tools for SEO reporting, a “big six” agency will have access to most, if not all, of the best enterprise SEO tools in the market
  • More reports created and shared with different teams
Enterprise SEO reporting illustrationEnterprise SEO reporting illustration

Here are three examples of enterprise SEO reporting for inspiration.

Media agency report structure #1

1719681968 604 SEO Reporting for Agencies With Real Report1719681968 604 SEO Reporting for Agencies With Real Report

This report example shows that it’s mostly focused on performance and technical SEO. This agency report had a separate content report that they shared with the content team.

Media agency report structure #2

1719681968 873 SEO Reporting for Agencies With Real Report1719681968 873 SEO Reporting for Agencies With Real Report

In this example, the client already had Tableau and Google Looker Studio dashboards set up and got most of their data from these two sources.

The report was created to communicate SEO activity within the business and educate stakeholders about its value.

As you can see, the focus of this report was organic performance, technical SEO, competitor performance, and dissuading clients from self-sabotage (AMP).

Another thing to notice: there is no executive summary.

The client just wanted to drop straight into the organic performance, and this was a screenshot directly from a Tableau dashboard with commentary.

This client operated in ~20 major international markets and needed a summary of the most important movements within those markets.

This report was mainly used to educate other stakeholders on SEO’s benefits and gain buy-in for further SEO improvements to the website. The “industry updates” section helped to do this.

Media agency report structure #3

1719681968 276 SEO Reporting for Agencies With Real Report1719681968 276 SEO Reporting for Agencies With Real Report

Although reporting with a spreadsheet may seem archaic to some, it was what this enterprise SEO client had always done—and they weren’t prepared to change.

In this example, the spreadsheet report was a weekly requirement, and the client also requested a monthly and quarterly report in slide format.

Presenting your reports to enterprise clients is a big deal, and you’ll often present your findings to more than one team during the month.

Here are three examples of the reporting presentation schedules that I had with some of my previous clients. As you can see, a single report or dashboard is rarely enough for most enterprise SEO clients.

Client 1

  • Daily performance reports on core KPIs from Adobe Analytics/GA 360 with a call if necessary
  • Weekly commentary update with SEO performance highlights using Ahrefs, Pi Datametrics, GSC, and other tools
  • Weekly performance call to discuss performance for the week
  • Bi-weekly call with the development team to discuss priorities, notes written up using Confluence and Jira tickets submitted
  • Monthly multi-channel performance report slides presented in person to highlight key wins and discuss strategy

Client 2

  • Weekly report with call notes taken on Trello for the marketing team
  • Weekly report spreadsheet, data from Adobe Analytics, discussed in call
  • Monthly multi-channel performance report in person or video call
  • Quarterly business review in person to discuss strategy

Client 3

  • Weekly call with notes written on Confluence and submitting JIRA tickets for development requests
  • Monthly report using slides and presented through video call

Final thoughts

The type of SEO reporting an agency delivers usually depends on your client’s budget. At SMB level, it’s easier to standardize elements of SEO reporting, but at enterprise level, sometimes you have to throw your trusty templates out the window and start from scratch. As every client is different, their reporting needs will differ too.

SEO reporting is an art for many SEO agencies. Do it well, and clients will give even poor-performing SEO campaigns a second chance. But do it badly, and you’ll almost certainly get the chop when it comes to contract renewal time.

Got more questions? Ping me on X. 🙂



Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

Trending