The plugin supply chain risk, explained
Each plugin adds code you rely on someone else to maintain. How plugin supply chain attacks work and how to keep the risk low.
Nikolas Gannon · · 1 min read · Systems and security
A plugin is a small program that adds a feature to your site. It is also code written and maintained by someone else, so each one is something you are trusting.
How the chain works
An attacker does not need to hack your site directly. They find a weakness in a popular plugin, or in the update system that delivers it. One compromised plugin reaches every site running it. That is a supply chain attack. It is less common than an ordinary plugin bug, but when it happens it can affect a lot of sites at once.
Plugins and everyday security
More often, the issue is simpler. A plugin has a bug, a fix is released, and sites that do not update stay affected. The more plugins a site runs, the more updates there are to keep on top of.
The trade-off
Every plugin brings a feature, plus some code to trust and some updates to apply. Many small business sites have plugins they no longer use. Removing those is an easy win.
What to do
- Audit your plugins. Delete every one you do not actively use.
- Keep the rest updated on a schedule, not when you remember.
- Prefer themes and plugins with active maintenance and a track record.
- If you would rather not manage plugins at all, a static site is one option, since it has no plugin system.
Where static fits
A static site has no plugins, so this particular kind of risk mostly does not apply. Any outside services it uses, for forms or booking, still need choosing with care.
If you want a list of what your current site runs and what needs attention, the free audit covers it.
Free resource: Website security check
Free resource: Website health check
Read next: What a static site actually is · Is WordPress safe after PHP2Shell and wp2shell?
Questions
What is a plugin supply chain attack?
An attacker compromises a plugin or the way its updates are delivered, and the problem reaches every site that installs that update.
How common is it?
Less common than ordinary plugin bugs, but it does happen, and it can affect many sites at once.
How do I reduce the risk?
Run fewer plugins, keep them updated and choose ones that are actively maintained.