SEO
WordPress Backup Plugin Vulnerability Impacted 3+ Million Installations
Security researcher at Automattic discovered a vulnerability affecting popular WordPress backup plugin, UpdraftPlus. The vulnerability allowed hackers to download user names and hashed passwords. Automattic calls it a “severe vulnerability.”
UpdraftPlus WordPress Backup Plugin
UpdraftPlus is a popular WordPress backup plugin that’s actively installed in over 3 million websites.
The plugin allows WordPress administrators to backup their WordPress installations, including the entire database which contains user credentials, passwords and other sensitive information.
Publishers rely on UpdraftPlus to adhere to the highest standards of security in their plugin because of how sensitive the data is that’s backed up with the plugin.
UpdraftPlus Vulnerability
The vulnerability was discovered by an audit conducted by a security researcher at Automattic’s Jetpack.
They discovered two previously unknown vulnerabilities.
The first was related to how UpdraftPlus security tokens called, nonces, could be leaked. This allowed an attacker to obtain the backup, including the nonce.
According to WordPress, nonces are not supposed to be the main line of defense against hackers. It explicitly states that functions should be protected by properly validating who has the proper credentials (by using the function called current_user_can()).
“Nonces should never be relied on for authentication, authorization, or access control. Protect your functions using current_user_can(), and always assume nonces can be compromised.”
The second vulnerability was tied to an improper validation of a registered users role, precisely what WordPress warns that developers should take steps to lock down plugins.
The improper user role validation allowed someone with the data from the previous vulnerability to download any of the backups, which of course contains sensitive information.
Jetpack describes it:
“Unfortunately, the UpdraftPlus_Admin::maybe_download_backup_from_email method, which is hooked to admin_init didn’t directly validate users’ roles either.
While it did apply some checks indirectly, such as checking the $pagenow global variable, past research has shown that this variable can contain arbitrary user input.
Bad actors could use this endpoint to download file & database backups based on the information they leaked from the aforementioned heartbeat bug.”
The United States Government National Vulnerability database warns that UpdraftPlus didn’t “…properly validate a user has the required privileges to access a backup’s nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.”
WordPress Forced Updates of UpdraftPlus
The vulnerability was so severe, WordPress took the extraordinary step of forcing automatic updates on all installations that hadn’t yet updated UpdraftPlus to the latest version.
But publishers are recommended to take it for granted that their installation was updated.
Affected Versions of UpdraftPlus
UpdraftPlus free versions before 1.22.3 and UpdraftPlus premium versions before 2.22.3 are vulnerable to the attack.
It’s recommended that publishers check to see that they are using the very latest version of UpdraftPlus.
Citations
Read the Jetpack Announcement
Severe Vulnerability Fixed In UpdraftPlus 1.22.3
Read the UpdraftPlus Announcement
UpdraftPlus security release – 1.22.3 / 2.22.3 – please upgrade
Read the U.S. Government Documentation on the Vulnerability
SEO
Bing Expands Generative Search Capabilities For Complex Queries
Microsoft has announced an expansion of Bing’s generative search capabilities.
The update focuses on handling complex, informational queries.
Bing provides examples such as “how to effectively run a one-on-one” and “how can I remove background noise from my podcast recordings.”
Searchers in the United States can access the new features by typing “Bing generative search” into the search bar. This will present a carousel of sample queries.
A “Deep search” button on the results page activates the generative search function for other searches.
Beta Release and Potential Challenges
It’s important to note that this feature is in beta.
Bing acknowledges that you may experience longer loading times as the system works to ensure accuracy and relevance.
The announcement reads:
“While we’re excited to give you this opportunity to explore generative search firsthand, this experience is still being rolled out in beta. You may notice a bit of loading time as we work to ensure generative search results are shown when we’re confident in their accuracy and relevancy, and when it makes sense for the given query. You will generally see generative search results for informational and complex queries, and it will be indicated under the search box with the sentence “Results enhanced with Bing generative search” …”
This is the waiting screen you get after clicking on “Deep search.”
In practice, I found the wait was long and sometimes the searches would fail before completing.
The ideal way to utilize this search experience is to click on the suggestions provided after entering “Bing generative search” into the search bar.
Potential Impact
Bing’s generative search results include citations and links to original sources.
This approach is intended to drive traffic to publishers, but it remains to be seen how effective this will be in practice.
Bing encourages users to provide feedback on the new feature using thumbs up/down icons or the dedicated feedback button.
See also: Google AIO Is Ranking More Niche Specific Sites
Looking Ahead
This development comes as search engines increasingly use AI to enhance their capabilities.
As Bing rolls out this expanded generative search feature, remember the technology is still in beta, so performance and accuracy may vary.
Featured Image: JarTee/Shutterstock
SEO
12 Link Builders Share Strategies That Work in 2024
I asked 12 SEOs for the link building strategy that’s working best for them right now.
Here are the tactics they shared, how to do them, and tips for success.
This has been my go-to link building strategy for quite some time now. What makes this approach very effective is that it touches multiple campaign objectives beyond just building topical authority and improving search rankings.
How to do it
Let’s say you were doing this for MailChimp. You might want to find listicles that feature brands like ConvertKit and Aweber but not MailChimp—like this one:
To find these, run this search in Ahrefs’ Content Explorer:
[competitor 1] +[competitor 2] -[your brand] title:(best OR top)
For example, to find listicles that mention Aweber and ConvertKit but not MailChimp, you’d search for: convertkit +aweber -mailchimp title:(best OR top)
If you spot a listicle where you feel you should be listed, find their email address and reach out to them.
Here’s an example email Jason used:
I don’t recommend copying Jason’s email word for word, but here’s his and Alex Tachalova’s advice on what to include:
Some key pointers for emails:
- Briefly highlight why your product or service merits inclusion on their list.
- Reference other reputable lists that have already featured your product or service.
- Inquire about their criteria and requirements for inclusion.
- Offer free tool access, complimentary products for review, or case studies that they can review (if you’re providing a service).
Our pitches generally include:
- The client’s previous features in listicle posts.
- A suggestion to collaborate on enhancing the quality of their listicle post, given the client’s industry expertise.
- An analysis of top-ranking listicle posts to identify missing tools or information that could offer a competitive edge and improve their post’s rankings.
As Jason points out, this strategy has benefits beyond improving rankings for your website. It also exposes your brand to more people as you’re consistently listed as a top option in your industry.
For example, Jason got his client mentioned in nearly every top-ranking listicle for “best dropshipping suppliers.” That’s a lot of extra brand exposure!
Apart from the selfie battle I have with Tim Soulo, this is one of the most effective link-building strategies we’re using right now.
How to do it
Start by finding a trending topic journalists care about. Google News and Google Trends are good places to start.
We start by identifying current trends using tools like Google Trends and monitoring industry news.
We use lots of techniques from monitoring news sources in real time to conducting research with Google News to understand the types of topics that have been previously covered at specific times of year.
You can also use the Growth metric in Ahrefs’ Keywords Explorer.
For example, if I enter “vaping” and sort by the Growth column, I see lots of lung health searches breaking out in the past three months:
I also see this echoed in Google News:
It’s then a case of sourcing some unique data, publishing it in an easy-to-utilize format, and sending it to journalists. Matt Diggity shared a few great sources with me:
For government databases you have usa.gov for the states. Data.gov is another alternative. UK Data Service is the equivalent for the UK. Eurostat is great for other countries in the EU. And Statistics Canada is for… yeah, Canada. Internationally, World Bank Open Data and United Nations Data are treasure troves. Pew Research Center is great for social issues, public opinion, and demographic trends. FBI Crime Data Explorer is great for crime stats. And the CDC is great for health data.
Amanda also often uses freedom of information (FOI) requests for data, as she did for her piece on the UK’s illegal vape hotspots:
This campaign earned links from 72 referring domains and got featured in many online newspapers:
How do you find journalists?
Here’s Jason’s advice:
We start by researching those who have previously covered similar topics or industries. We use tools like Muck Rack, Cision, or even X to find journalists by searching for keywords related to our story. We look at bylines in relevant publications to see who is writing about related subjects and review their past articles to understand their interests and writing style.
Journalists are always looking for comments, tips and advice from thought leaders. Nurture these relationships and meet request deadlines, and you position yourself as the PR expert who can help during busy periods.
How to do it
One way is to sign up for HARO and other alternatives, but Eva recommends a more proactive approach. She builds relationships with journalists relevant to her clients so they come directly to her for tips and quotes.
How can you find these people?
Eva uses keyword alerts:
I have Google Alerts set up for relevant keywords related to a brand or topic. For example, I have the words “vet,” “dog behaviour,” and “cat behaviour” set up for a pet insurance brand so I can see the related coverage mentioning these words.
You can also use Ahrefs Alerts. The benefit of this over Google Alerts is that you can filter by language, traffic, Domain Rating (DR), etc. to separate the wheat from the chaff:
Alternatively, use Content Explorer to find people who’ve talked about topics recently. Just search for a keyword and filter for pages published in the last 90 days.
For example, if I search for “vet,” I see this recent article on a DR 83 site from Jessie Quinn:
It looks like she’s written a couple of pet-related articles recently:
Her profile also says she writes for many well-known sites and has a pug called Daphne:
This journalist would clearly be a great person to build a relationship with!
How? Eva says it all starts with a simple “hello”:
Reach out and introduce yourself and your client to journalists and niche publications who cover related topics regularly. Offer them the opportunity to receive exclusive commentary when requested. After a journalist has covered your campaign or expert commentary, always drop them a note to say thank you. You never know it can also lead to another request or opportunity for your client.
Oh, and don’t rely on AI when actually replying to requests, whether direct or via platforms like HARO. Greg explains why:
AI is not yet capable of replacing a high quality writer. Simply copy/pasting their content over to a journalist outreach email is a fantastic way to earn your client a spot on a journalist or publication’s ban list. When our writers use AI, they use it for idea generation to overcome writer’s block. This is how I recommend using it.
Data-driven digital PR campaigns, like maps, are our most effective method for driving backlinks at the moment.
How to do it
Start by brainstorming topics with map potential that make sense for your brand.
Ask yourself, what would a journalist and user expect you to be an expert on? For a cocktail brand, doing a map on speakeasy bars around the world would make perfect sense, or a map on the rooftop bars with the best reviews, etc.
If you’re struggling for ideas, search for a topic in Content Explorer and filter for pages with lots of backlinks. These are proven ideas you know people want to link to.
For example, if I search for “tax,” I see over 300 referring domains to a page listing countries where you have to pay “tourist tax”:
This immediately sparks an idea: map out countries with the most and least expensive “tourist taxes.”
Once you have your map, send it to journalists who might be interested in covering it.
Find journalists who write about that kind of content, either literally map based data, or perhaps in the example above, they write about travel.
George did this for his map of which states will pay the most taxes over their lifetime…
… earning links from 188 referring domains in the process:
As Jason suggested earlier, tools like MuckRack, Cision, and X can be useful for finding journalists interested in your topic. But you can also just search Content Explorer for pages published about a topic in the last 90 days, and extract journalist names from there.
Our unique process for this has worked amazingly well for us for years now. In fact, we’ve just finished some internal research and found our assets like this generate an average of 102 referring domains.
How to do it
- Enter a topic into Ahrefs’ Keywords Explorer
- Go to the Matching terms report
- Filter for keywords that include terms like “statistics,” “facts,” “graph,” etc.
This will find keywords people search for when looking for facts and figures for their articles. Rank for these, and your page will often earn links on autopilot.
Here’s Darren’s advice on what make a good keyword:
The most important thing is that there isn’t just one or two top-ranking pages soaking up all the links. If there’s 3 or 4 that have 100+ and a couple with 20+ or so, that’s all good. It shows there’s a nice spread and journalists/linkers are happy to mix it up themselves.
This is exactly how the SERP looks for “uk salary statistics:”
In fact, Darren and his team created one of the top-ranking pages. As of today, it’s earned links from 98 referring domains:
And this is without outreach!
Importantly, we don’t do outreach for these campaigns. They’re designed to remove that element of time and therefore making it more affordable for clients compared to our other activities.
How do you create a winning page? It’s all about picking low-hanging opportunities and beating the competition on the content front.
We’re often looking for opportunities where the ranking pages aren’t properly fulfiling a user’s intention. They may not have many images to engage users, the key stats might be buried in a wall of copy, etc. So we’re utilising content marketing 101 to see where we might be able to elevate a page and make it more engaging.
From some campaigns, I’ve seen over 291 referring domains secured from media sites. The crazier the giveaway, the more chance of backlinks.
How to do it
Brainstorm trending topics with potential for a unique promotion that you can tie back to your brand.
For example, Dish Network ran a promotion offering $1,000 to anyone willing to binge watch 15 hours of The Office:
It earned links from 150 referring domains, including big media sites like Thrillist, Business Insider, CNET, Mental Floss, and many others.
Struggling for ideas? Try asking ChatGPT:
Hey ChatGPT. I found a unique promotion online where Dish Network offered to pay people $1,000 to binge watch 15 hours of The Office. My brand is [brief description]. Give me a few ideas for a similar promotion I can run.
Here’s one idea it came up with for a coffee brand:
Not bad!
But who should you tell about your wacky campaign once you have it? Here’s a smart tip from James:
It’s as simple as reaching out to the same publications and journalists who’ve covered similar things before. You can find plenty of these already online from movies and tv shows.
For example, you can just export the 150 sites linking to The Office campaign via Site Explorer and reach out to them.
I have to give credit to Russ Jones (RIP) who was one of the most switched on link builders and SEOs I have ever met for this tip he shared with me.
How to do it
Start by finding relevant pages with lots of backlinks in Ahrefs:
- Search for a topic in Content Explorer
- Filter for pages with 100+ referring domains
- Filter out subdomains, homepages, and multiple pages per domain
In the example above, there are 1,952 pages about tax with links from over 100 websites. One of them is this federal income tax calculator with 1,500 referring domains:
Next, run a free audit with a tool like AccessScan to check how accessible the page is for people with disabilities:
In this case, the page is non-compliant. This means that over 1,500 sites are linking to a resource that isn’t accessible for users with vision, motor and cognitive impairments—including a few government and education websites:
Here’s what James says to do next:
You reach out to the website and say the resource on your page is not accessible to visually impaired users. This is a highly successful outreach method vs just sending emails at scale asking for guest posts.
Of course, this does mean you need to create an alternative resource that is compliant. But that’s easily worth it when there’s a pool of hundreds or thousands of potential linkers.
I know it might sound a bit old-school, but guest posting still delivers great results. However, the days of mass emailing generic pitches are over. The strategy is the same—offering valuable content for a link—but the execution needs a fresh approach.
How to do it
First, you need to find sites that might be open to a guest post.
To do that:
- Run an “In title” search for a broad industry term in Content Explorer
- Filter for sites with a Domain Rating (DR) between 30-60 (this removes big sites that probably won’t accept guest posts)
- Go to the “Websites” tab
Here you will see the top 100 sites getting the most search traffic to content about your topic. These are good sites to pitch a guest post, as they’ve already written about similar topics before.
Bibi recommends using AI to help with your pitch:
Ai is an awesome tool [for pitching]. It can help you create everything from catchy subject lines to compelling pitches and even eye-catching visuals.
For example, she used AI to create Midjourney images that combined cats and dogs with her target niche. When she reached out to trucking companies, this charming approach got a lot of positive attention.
If zany or “out there” isn’t really your jam, that’s fine. As Bibi says, it’s not a necessity. The point is to use AI to improve your pitches and make them more creative.
You don’t always need to be funny or wild, but AI lets you create highly targeted content in formats that would typically require a whole team with specialised skills. So, even though guest posting might seem basic, the possibilities are endless with AI. Just keep experimenting with it!
Find a page with links, make something better, pitch it as a replacement (aka the “skyscraper” technique)
[/blockquote]
Most people assume that “skyscraper” is dead because it worked well in 2017, then got abused until it didn’t work anymore. But we’re finding that it’s starting to open up again now.
How it works
This is arguably the most famous link building technique there is, but if you’ve been hiding in a cave for the last decade, here’s how it works in a nutshell:
For example, this list of best headphone recommendations has 469 referring domains…
… but it hasn’t been updated since 2021:
Given how fast the headphone industry moves these days, this means that hundreds of sites are linking to a completely outdated list of recommendations.
To take advantage of this, you would:
- Publish an up-to-date list of headphone recommendations (aka. “skyscraper” content)
- Pitch this as a replacement to everyone linking to the outdated post.
Here’s a quick tip from Eric to help maximise your results:
Give people extra incentive to link by offering to share their content on your social networks. We do this when promoting our clients’ content and it still works relatively well.
Keep learning
Thanks to everyone who contributed to this post. If you want to learn even more about building links, check out these posts and courses:
SEO
Google AIO Is Ranking More Niche Specific Sites
New data from BrightEdge shows significant changes to Google AI Overviews, prioritizing topic-specific sites and a stronger focus on ecommerce ahead of the year-end shopping season.
Google Core Update And AIO
An interesting insight from the data is that there is more overlap between AIO and Google’s organic search results, that there is more agreement between the two results. Is AIO mirroring the organic search results or are the organic search results more closely aligned with AIO?
The organic search results themselves changed after the August 2024 core algorithm update and so did AIO. BrightEdge’s data offers evidence of how Google’s organic search results changed.
BrightEdge data shows:
- The overlap of URLs cited in AI Overviews with those ranking in the top 100 increased from 37% to 41% post-update.
- This is following Google’s August 15th Core Update.
- The shift indicates that AI Overviews are prioritizing organic results more than before, pulling from lower-ranked results to create comprehensive responses.
BrightEdge data shows that AIO is ranking lower-ranked web pages for more precise answers. Something else to consider is that both AIO and the organic search results changed and it could be the criteria for ranking changed in a similar way for both AIO and organic, that the algorithms for both are doing something similar.
A significant characteristic of the last update is that it is showing less of the big brand sites and more of the independent niche sites. BrightEdge data shows that AIO is also ranking websites that are more precisely about a topic.
Keep reading because there’s more about that in BrightEdge’s data which could offer insights into what’s going on in the organic SERPs.
BrightEdge Dataset
Research was conducted using the BrightEdge Data Cube X, an SEO and content performance platform for researching industries. |
Data Cube X Facilitates:
- Comprehensive Keyword Research
- Competitive Analysis:
- Automated AI-Powered Content and Keyword Research
- Traffic Fluctuation Analysis
Non-Logged-In AI Overviews
Google has rolled out AI Overviews (AIO) to users that are not logged-in to Google accounts, expanding the audience for AIO to a greater amount of people. But it’s not showing across all industries. The data shows that the integration of AIO varies.
Within the context of users who are not logged in, Ecommerce search results for not logged-in users dropped in AIO is less than logged-in users by a whopping 90%.
Users that are not logged-in didn’t see AIO in the following topics:
- Education: 21% relative decrease
- B2B Tech: 17% relative decrease
- Healthcare: 16% relative decrease
Although there’s a decrease in AIO shown to non-logged-in users for ecommerce queries, there is an increase in product grids that are shown to these users compared to logged-in users. BrightEdge speculates that Google is better able to target logged-in users and is thus showing product grids to them on a more precise basis than to non-logged-in users.
More Product Comparisons
BrightEdge’s data indicates that Google AIO is showing more product comparisons and visuals.
Their data shows:
- In August, product carousels for apparel-related queries increased by 172%.
- The use of unordered lists across industries rose by 42%.
These adjustments make AI Overviews more user-friendly by organizing complex product features and specifications for easier decision-making.
All of those features allow users to make comparisons between products by what the products look like as well as by price. A takeaway from this data is that it may be increasingly important to show original product images (if possible) and to make sure that images shown are high quality and allow users to get a good sense of the product.
Data is always important and it’s a good way to make a product listing or product review stand apart from competitors. Any information that makes improves a consumer’s decision making is valuable.
A good example is for clothing where it’s not enough to indicate that something is a size small, medium or large. Sizes are inconsistent from manufacturer to manufacturer and even within a brand’s own products. So, for clothing, it may be useful to add comparison information about actual sizes within a product line in terms of inches or metric measurement so that a consumer can make an even better choice.
Comparison between products, especially within the context of a product review, is important. One of the product review best practices (and maybe a ranking factor) that is recommended by Google is a comparison of the product being reviewed. Google’s product reviews best practices recommendation is that publishers compare a product to another product so that users can presumably make a better decision.
Google recommends:
- “Cover comparable things to consider, or explain which might be best for certain uses or circumstances.”
According to BrightEdge:
“As the holiday shopping season approaches Google is refining AIO search results to focus on comparative content, which rose by 12% in August. AIOs prioritized product carousels with engaging imagery, which rose by 172%. Unordered lists (lists of items that are related but in no specific order, such as general searches for ‘winter boots’ or ‘iPhone cases’) also increased by 42%.”
Google AIO Rankings Are More Precise
A data point that all search marketers should be aware of is that Google is ranking more precise content in AIO in a way that might reflect on what is going on with the organic search algorithms.
BrightEdge discovered that generalist sites had massive decreases in rankings while specialists sites had increases. People like to talk about “authority sites” and what they’re usually referring to is “big brands” with a lot of money and reach. But that’s not authority, it’s just a big brand with reach.
For example, most people consider news organizations as authority sites. But who would you go to for SEO information, Search Engine Journal or big sites like the New York Times or Fox News? What the BrightEdge data shows is that AIO is making a similar consideration of what kinds of sites are actual authorities on a given topic and then showing those sites instead of a big brand site.
The obvious question is, does this have something to do with Google’s last core update in August? One of the goals of Google’s last update is to show more independent sites. If the AIO trends mirror the organic search results to a certain extent, then perhaps what Google’s algorithms are doing is identifying sites that are authoritative in a topic and showing those sites instead of a more general big brand site.
BrightEdge’s data shows that AIO rankings of generalist technology review sites dropped. TechRadar.com dropped by 47.3 and TomsGuide.com dropped by 16.4%. This trend was also seen in health related queries where the kinds of sites that AIO quotes also became more precise.
AIO showed less consumer-focused sites and blogs and began showing more sites that are precisely about health. The BrightEdge data showed that consumer news and general sites like VerywellHealth.com experienced 77.9% drop in AIO exposure and EverydayHealth.com virtually dropped out of AIO with a 95.6% decline.
Sites like MayoClinic.org experienced a 32.4% increase and citations of the U.S. Department of Health & Human Services AIO increased by +83.2%. It’s not just a trend away from consumer and general news sites, it’s a trend toward more precise rankings of expert and authoritative content.
BrightEdge noted that the following precisely-focused sites experienced increases:
- Spine-Health.com +266.7%
- Arthritis.org +89.5%
- BrightEdge’s report observes:
“This demonstrates Google’s push toward more detailed, factual content in AI Overviews.”
AIO And Organic SERPs
Google has significantly increased the use of product carousels for apparel-related queries, reflecting a 172% rise. These carousels and grids allow for easier product comparisons based on visuals, pricing, and features.
AI Overviews and Google’s organic search results have more overlap than before. The reason for that may reflect a change to prioritize increasingly precise answers from sites that are authoritative for specific topics. Niche sites have gained prominence in both organic and AI Overviews while large more general sites have lost visibility.AI Overviews continues to evolve but the changes from last month indicate that there is a certain amount of agreement between what’s in the SERPs and AIO.
Read more about AI Overviews data at BrightEdge
Featured Image by Shutterstock/BobNoah
-
WORDPRESS6 days ago
Automattic sends WP Engine its own cease-and-desist over WordPress trademark infringement
-
SEARCHENGINES6 days ago
Daily Search Forum Recap: September 26, 2024
-
SEARCHENGINES5 days ago
Daily Search Forum Recap: September 27, 2024
-
SEO6 days ago
Why Content Is Important For SEO
-
SEARCHENGINES7 days ago
Google Noindex Bug With JavaScript Pages
-
SEO5 days ago
Squarespace Update Strengthens Its Robust Website Builder
-
AFFILIATE MARKETING6 days ago
Bernie Madoff’s Niece on Her Mission to Fight Pay Inequities
-
AFFILIATE MARKETING7 days ago
How to Teach Kids About Money and Set Them Up for Success
You must be logged in to post a comment Login