Mathew PaquetChecklist · 4 min read
The Last Valve: Four Checks to Keep Your Website Patched
AI can find security holes faster than ever. These four checks make sure the fixes actually reach your website.
Your website runs on free, shared code, called open source. Your plugins sit on top, WordPress under them, and at the bottom, the code that encrypts every visit. A lot of it is kept up by small teams of volunteers.
On October 8, Anthropic, the company behind Claude, launched OSS Scanner. Its AI now sends security bug reports straight to some of those teams, with no person checking them first. A week earlier, Google paused part of its own open source bug bounty, citing a significant rise in automated submissions, the vast majority not valid.
The line that matters most is in Anthropic's own announcement: "we often saw months pass between a vulnerability being found and being fixed." Its public dashboard says that as of October 2 it had reported 6,157 security holes. Patches it knows about: 516. That's a floor, since it only counts the patches Anthropic knows about. But it fits that line about months.
Between a hole being found and your site being safe, there are three valves:
OSS Scanner isn't checking your plugins. It's aimed at code like OpenSSL, the encryption library, which is usually your host's job to update. Your plugins are your job. And the same kind of AI is available to anyone looking for holes.
Patchstack, a company that sells WordPress protection, says that in 46% of the WordPress holes found last year, the developer hadn't shipped a fix by the time the hole went public. When there's no fix, updating can't help you. So start with what you run. In WordPress, your plugins are on the Plugins screen.
When a hole gets fixed, there's normally a public warning. That warning is what your security plugin, or your developer's tools, are listening for. Anthropic's dashboard says some maintainers shipped the fix without publishing any warning at all. The fix exists. Nothing rings.
So ask each company you pay for a plugin, a theme or a tool. Start with the paid ones: Patchstack found premium plugins and themes had three times more holes that attackers actually used than free ones, partly because fewer researchers can see their code.
Three quick security questions:
1. How fast did you ship your last security fix?
2. Do you mark security fixes in your release notes?
3. Where do people report a security hole to you?
Thanks, [YOUR NAME]
WordPress has let you turn on automatic updates for plugins since 2020 (version 5.5). They're off unless you turn them on. Patchstack says that for the holes attackers go after hardest, the typical time from going public to the first attack was about five hours.
How to turn them on, from WordPress's own help page:
By default WordPress emails the site owner after automatic updates, so you know what changed. Make sure that email goes to someone who reads it.
The few your business runs on
Your checkout, your forms, your page builder: update those on a set day every week, right after a backup. A backup only counts if it's stored somewhere other than your server, and you've restored it once to see that it works.
The encryption code under your site is usually your host's job. Your plugins are yours. Get the line in writing, and ask a developer or agency that looks after your site the same thing.
which parts of our website do you update, and which parts are ours?
Please reply in writing so we have it on file.
Why in writing. "I thought you were doing it" is exactly how the last valve stays shut.
Sources
Mathew's LibraryLibrary card
Keep reading free with your library card
One email opens this checklist and all 3 resources in Mathew's library. No account, no password.
Open your Plugins screen in WordPress today, delete what you don't use, and turn on automatic updates for most of the rest.
Saving works best in your phone's browser. A copy is also in your inbox.