Making WordPress Products Fast and Safe

[00:00:00] Katie Keith: Well, welcome everyone. This is WP Product Talk, the place where every week we interview an experienced WordPress products owner on strategies, tips, experiences, failures, and successes of running successful and thriving WordPress product businesses. I'm Katie Keith, CEO at Barn2 Plugins.

[00:00:54] Matt Cromwell: And I'm Matt Cromwell, co-founder of GiveWP and Senior Director of Customer Experience at StellarWP.

[00:01:01] Katie Keith: And today's topic is developing your WordPress product with performance and security in mind.

[00:01:07] Matt Cromwell: I'm excited to talk about this subject because it has definitely been a pain point, uh, as a product owner for quite a while, and I hope, I believe that most folks listening in probably can relate to that. Um, and I feel like it's something that we all should be talking about a lot more personally.

[00:01:23] So,

[00:01:25] Katie Keith: yeah, and joining us today to talk about all that is Remkus de Vries. So, um, remember to comment on YouTube if you're watching there. And also you can comment on Twitter using the WP Product Talk hashtag. So please leave your comments live and then we can answer them as we go through the show.

[00:01:44] Matt Cromwell: Welcome, Remkus.

[00:01:46] Remkus de Vries: Thank you. Great to be here.

[00:01:48] Matt Cromwell: Thanks for being here. Hey, you know what, I've introduced you in a couple different formats, but how do you introduce yourself? What do you, what do you call yourself and what do you do?

[00:01:58] Remkus de Vries: Um, that's a good question. I try to avoid calling myself anything specific, to be really honest.

[00:02:04] Matt Cromwell: Mm-hmm.

[00:02:05] Remkus de Vries: Um, um, this is gonna get philosophical real quick, but, um, I'd like to be more than whatever role that I have. Um, but if you were to ask me like, what is it you do inside of WordPress and, and that sort of thing, that's an easier answer. Um, I, I focus in on the performance side of, uh, any WordPress site, WooCommerce.

[00:02:29] Uh, and when I say performance, I, I actually mean business performance. So that's the actual web performance, but that's also technical. SEO. Um, that's things like conversion, security, um, all the things that help a site owner make, uh, more money with their site, essentially.

[00:02:49] Excellent. Well, that's why you're here.

[00:02:51] So thanks for being here.

[00:02:53] Katie Keith: Yeah. And that's a wide definition of performance, so that's really interesting. Yeah.

[00:02:57] Remkus de Vries: Yeah. So I, I started with, um, web performance in as a, as a first thing because it's the most obvious one. But, um, upon reflection and talking it over with few other people in the, in the field that, um.

[00:03:13] The way that I look at it is, it, it's, it's not just one thing. There are multiple facets to what is actually performance. And I, I'd like to see that the hole is treated as a whole instead of, lemme just make it faster. Because you can make it faster and you can kill conversions. Um, you can make conversions a lot better and make it a a, a heck of a lot slower.

[00:03:37] Um, and technical. SEO is, I guess, something that you'll always have to do. Um, for those who don't know what technical SEO it means, it is that part within SEO where you essentially take care of the, um, the, the, the technical health of the site, right? So no, 4 0 4 is not, no three oh ones when, when it's not needed.

[00:03:57] Uh, but also make sure everything is loaded when it's supposed to be loaded. And, you know, the, the whole thing that you present is, um, um. Uh, as optimal as it's supposed to be. Um, I, I got distracted 'cause I saw Ryan Duff's comment, but, uh, trust me, Ryan, it's red, uh, on this side. Extremely.

[00:04:18] Matt Cromwell: Is there a comment?

[00:04:19] Is that on Twitter? Yeah. Oh, where are we at? Uh,

[00:04:22] Remkus de Vries: he said, I just said that you must have beauty mode

[00:04:24] Katie Keith: enabled. Yeah,

[00:04:27] Remkus de Vries: no, it's, it, the back of my head and the side is, uh, I'm scorched so.

[00:04:34] Matt Cromwell: Yeah, thanks for being here anyway, despite the, uh, not so fun sun experience. Yeah, no worries. Which is ironic 'cause Katie's in Myorca and she's in better shape than you. What's going on in, uh, Netherlands? That

[00:04:46] Remkus de Vries: I, I spend two days outside. Uh, you don't go outside

[00:04:50] Katie Keith: all day. You just don't do it. Yeah.

[00:04:53] Remkus de Vries: Not enough protection.

[00:04:54] Um, little, little caught by. So my only, my only, um, um. A slight, uh, piece of happiness there is that there. I I, I'm joined in this pain by my whole crew that who were organizing with me. So we're all burned, we're all toast, we're all, um, have been seeing better days. Hmm.

[00:05:14] Matt Cromwell: Nice. Cool. Well, we like to kick off these discussions with why this subject is so important for WordPress product owners in particular.

[00:05:26] Um, so. Um, that's the question, and I think, uh, Katie looks like you're up first. What's your thought on this?

[00:05:34] Katie Keith: Well, I would divide it into the importance in terms of marketing to grow your own product company and to help with customer success for your customers. Because as product owners, we've got our own websites where we need to think about performance and security, and also the impact of our products on our users.

[00:05:54] So in terms of our own marketing and websites, uh, performances as, uh, Remus already said is important for SEO and that side of things. And also any security issues with your own website can get you de ranked as well as causing reputational damage, um, which is hard to recover from. So. There's lots of direct business reasons, uh, for that and with your customers as well when they're using your products on their own WordPress sites.

[00:06:21] If a plugin slows it down, then you are likely to lose the customer, get extra support, tickets, complaints, bad reviews, all of those negative. Things. Um, and also, um, if, if it's slow, then the customer's less likely to, uh, renew in the future if indeed you've not refunded them initially. So customers really expect good performance and hate plugins or themes that slow down your site.

[00:06:44] And of course, if you have a security issue in your plugin itself or your theme, then that has a loss of, um, implications as well as the risk it places on your customers. Sites and the damage to them, it damages you as a company, um, because that needs to be reported and, um, all of that.

[00:07:03] Matt Cromwell: Yeah. Yep. Oh, absolutely.

[00:07:07] Um, Remkus, what's your take?

[00:07:09] Remkus de Vries: So reputation management is probably the, the, the most important one. Um, yeah. I, I'd, I'd, I'd go as far as saying that, um, understanding what the actual full implications are, and Katie gave a good, good, uh, good list of all the things that sort of, um, touch this topic. Um, I would summarize 'em to the, the, the, the main bracket of reputation management because, uh, ultimately you are selling products, right?

[00:07:38] So your end client really depends on you to know what you're doing. Um, it's very important to understand that whatever you are offering as a product owner has to be working in an environment where there's lots of other different, uh, solutions working alongside yours. Um, so there's obviously compatibility sort of thing.

[00:07:58] Um, but the, the, the, the most important thing is to, to fully understand, uh, what a, you know, you are a cog in the larger wheel of somebody else's success. And it's easy to forget that that's the actual place that you have. So yeah, reputation management means you make sure that whatever you're putting out there is secure, is fast, is performant, is thought out, and all of those things does what it says that it, you know, what, what's, what's advertised of what it's supposed to do.

[00:08:31] Um, and, and I guess, um, I think, I think the whole, the whole point of this is understanding, uh, I. The full impact of what your service offers. So I'll give you an example of, of something, uh, I won't name it the the plugin specifically, but there's a client of mine who has a, um, a very large interconnecting plugin with WooCommerce and every other release there, there's a bug.

[00:09:02] And sometimes the bug means I can't exclude products on this, or I can't do this, or, and it's weird little things. Even though the plugin, when it works, works wonderfully, those little bugs make it annoying. And, and then the nice thing is they are very conscious of performance. So that part works great.

[00:09:22] There's a lot of stuff you can, um, you can screw up on the front end when you're adding stuff to WooCommerce. 'cause it's, it's very easy to make a WooCommerce site slow. Um, and they're taking great care of that part. But then there's the little bugs that go,

[00:09:34] Matt Cromwell: Hmm,

[00:09:35] Remkus de Vries: why? It is a shame because for me that's reputation, reputation damaging, um, mm-hmm.

[00:09:42] And I, I, I feel for a lot of, um, I'm being very, uh, generic here, but there's a lot of, uh, product companies still not fully understanding what their position is and what they actually need to do to make sure, um, what their, what their service is promising to do is not just the service itself. It's the whole thing that.

[00:10:05] It falls into,

[00:10:07] Matt Cromwell: hmm.

[00:10:09] Remkus de Vries: I like that.

[00:10:10] Matt Cromwell: Yeah, no, no, it's really helpful. I like that, um, the way you said it, uh, in terms of you're a cog in the wheel and the success of your clients or your customers. Um, yeah, I think that's a good way to couch it and think about it. Um, for me too, like it's definitely the best way to show that you are very customer centric because of the way in which everything you do.

[00:10:33] Impacts, um, your customer websites and as like, like you're highlighting right now, the, you know, if whatever you have in your plugin or your theme or your product, one form or another, it negatively impacts your customer, you're gonna be the first one they come to for sure. Like, no question about it. As a support person that's like.

[00:10:54] Yeah, I hear about it all the time. Um, and, uh, I, I really do think that, um, being intentional about, uh, security and performance is what it takes, uh, in, or is one of the things, one of the most important things to show a customer centric, uh, mindset. Um, and I do think WordPress products in particular always have to be customer centric as much as possible.

[00:11:17] Um, it's something I hope that we talk more and more about, uh, on the show here. So. Um,

[00:11:23] Remkus de Vries: if, if I'd like to, if, if, if I can hook into that. Um, yeah, there's, um, uh, I forgot the name, but I, I guess it doesn't really matter. But there, there's a, um, there's a developer who started to develop plugins for the sake of, I wanna start earning an income outside of what my current job is.

[00:11:42] Started thinking about gaps in the market, figured out a couple of plugins. Built them, sold them, and is doing great. And he said it wasn't until, like a couple of years in when he already switched from, um, uh, being, uh, employed to being self-employed and, you know, the, the plugins were doing really well. It wasn't until a couple of years in that he realized that he started because he wanted to make money.

[00:12:09] Hmm. And less so about wanting to solve a problem. Helping the end customer. And he said when he made the switch in terms of, okay, I'm not just doing this to make money. Yeah, yes, of course I make, I wanna make money, I wanna provide for my family and all of that. Of course he said, but I then started to catch the bug of I want to solve the problem for my clients the best way I know how.

[00:12:32] And that was a, uh, if I, if, if the name pops me back up in my head, I'll, I'll, uh, I'll say, I'll, I'll mention it, but, um, I, I heard that and I was like, of, of course that made a huge difference because

[00:12:44] Matt Cromwell: mm-hmm.

[00:12:45] Remkus de Vries: Just providing a service is not the same as wanting to solve somebody's problem.

[00:12:50] Matt Cromwell: Yeah.

[00:12:51] Remkus de Vries: Uh, and for a lot of people, performance and security and scalability, those are real problems.

[00:12:59] Matt Cromwell: Yeah.

[00:12:59] Remkus de Vries: Yeah. That

[00:12:59] Katie Keith: mindset does really help because when you're thinking about the customer first, those things become priorities. Yeah. Even though they don't necessarily contribute directly to the bottom line. And that fits in with other, um, non-essential things that are really important, such as accessibility as well.

[00:13:16] If the customer comes first, you invest in all of this. If the profit comes first, you might do, but you are making a very different calculation.

[00:13:24] Remkus de Vries: You, you're, you're gonna go for the 80% right? And, and you'll miss out on the 20. And, um, um, Mr. Pareto was, uh, was quite, uh, was quite accurate, saying that the last 20% requires a lot of extra effort.

[00:13:37] But the, the yield is also quite big, right? Because the reputation management starts with the 20% extra

[00:13:43] Matt Cromwell: because

[00:13:43] Remkus de Vries: the bulk of the, of the clients. So she's gonna come anyway because you solved the largest problem for them.

[00:13:48] Matt Cromwell: Yep. And one way in which this I think kind of played out publicly in the WordPress space was, um, when Google really started clamping down on performance as a key indicator for search results.

[00:14:01] And the one that got hit the hardest by that was Elementor. Um, Elementor really had to be like, oh my goodness. Like, we really are actually making sites really, really slow. Um, and it took them a long time to actually, uh, turn their product around so that it was more performant and started adding things in there that actually helped, uh, that, and it, it still, I honestly think they have still a ways to go on that front.

[00:14:26] I think they have a

[00:14:27] very long, I think

[00:14:28] they got, yeah, I feel, I feel like for a long time though, they got. Hit negatively, uh, on the reputation management front. Yep. Because it just, they, nobody could see them taking that issue seriously. Nobody noticed any serious, they made designers

[00:14:42] Remkus de Vries: happy.

[00:14:43] Matt Cromwell: Say it again.

[00:14:44] Remkus de Vries: They made designers happy. They made, um, whatever we call the category that installs. Uh, element and then configures the site. Um, inside Elementor, they made that crowd very happy 'cause it was very easy to use.

[00:14:58] Matt Cromwell: Mm-hmm. Yeah.

[00:14:59] Remkus de Vries: But it's, it's missing out on a huge crowd. It's missing out a lot of usability and it's missing out on a lot of opportunity.

[00:15:05] Matt Cromwell: Yeah.

[00:15:07] Katie Keith: Yeah. And that's hugely important for page build. I think they made improvements there. One of the biggest, but

[00:15:10] Matt Cromwell: it's taken a while. All,

[00:15:13] Katie Keith: all customers are thinking about performance with page builders in particular, aren't they? So if you are not performing as a page builder, that's a real issue, whereas some other plugins, maybe people don't directly think about it.

[00:15:25] Remkus de Vries: Yep. Well, it's, it's nice that if you, if you look at the performance side of things, of, of solutions happening in WordPress, injecting themself in, in your site, uh, if you run any, um, uh, lighthouse report, uh, then you'll see whenever you're having too many layers of diffs, just, just narrowing down to that one little button that you're using.

[00:15:47] You know, that doesn't make a lot of sense because ultimately that is a, uh, uh, a performance thing that has an impact in your browser. Um, we can't ignore it. Uh, but the, the, the better approach is you don't, you shouldn't want to ignore it. You should want to fix it. Like, how, how can I do this smarter? And, uh, them switching to a flexbox, uh, approach is, is a, is a good switch, but there's still a lot of stuff that they can do to become more performant, to become the smarter solution.

[00:16:18] Matt Cromwell: Yeah. Absolutely. I think, uh, I'll wrap up the important side with, uh, my only other take is it definitely is the biggest risk involved in being a distributed product, um, when you don't get this right, when you don't get performance or security, right? It. Goes badly, um, in really bad ways. There's lots of different aspects of distributed products that, that you might not have the perfect, um, uh, uh, implementation of.

[00:16:50] Uh, you might not have the greatest design or whatnot, but when you get performance and security wrong, uh, it comes back to hit you really, really hard. Um, so yeah,

[00:17:01] Remkus de Vries: it, it does and, and it, it happens all the time.

[00:17:06] Matt Cromwell: Yeah. Um, moving into story time, uh, we wanna talk a little bit about our personal experiences with this subject.

[00:17:16] Um, and, um, I, I'm up first it looks like, um, a couple different things. I feel like I have been on the. Receiving and often, uh uh, unfortunately, um, one of my favorite stories on this front though, happened early in the GiveWP History. Um, there was this instance where, uh, the make do wordpress.org um, had documentation for how to implement a certain filter.

[00:17:48] I'm not gonna remember what that filter was. Um, but, um. Uh, it was, it was a common commonly used filter in a lot of plugins. Um, and the documentation, um, said, here's a snippet on how you can leverage this filter. And a lot of plugins give included, Yost included, others included, um, used that snippet, um, and, uh, distributed their products with it.

[00:18:12] And then it turned out that that snippet specifically, um. Had a security vulnerability that made a website vulnerable to uh, uh, hacking. Um, and it came out, um, to the the.org team. And what they did I thought was really, really smart. They're like, this isn't a plugin vulnerability. This is a like a documentation setup.

[00:18:35] Like we, we all of a sudden distributed some vulnerable code to a whole bunch of users across a whole bunch of products, and how can we get a patch out, not just for one product, but for all of 'em that might be impacted? Hmm. Um. And so they started reaching out to individual plugin owners, and the plugin owners all started coordinating together, um, behind the scenes to launch their patches, um, all at the same time, uh, so that the vulnerability could then be discussed publicly.

[00:19:07] With the patches in place. Um, there were, I think over 30 different plugins, um, that all coordinated together, and I think there were a lot more than that, that were impacted. Um, but it was a really cool example of like in this specific, uh, use case where we are all different companies with different products, um, having to coordinate around one.

[00:19:31] Particular vulnerability, um, how we all came together, um, in order to basically enforce a responsible disclosure, um, and, uh, and to be able to patch and release all, all responsibly as well. Um, it it, it was one of the, one of the fun little quirky highlights, I think, uh, personally.

[00:19:52] Katie Keith: So how did they know who was using it?

[00:19:54] Because it is just something you've taken from the documentation. You didn't have to register that you were using it.

[00:20:00] Remkus de Vries: No. You can scan the The directory. Yeah. There's ways to scan no plugin. So it's

[00:20:04] Katie Keith: only the wordpress.org plugins that they would've known about then any premium ones. They wouldn't.

[00:20:09] Matt Cromwell: Yes, that's right.

[00:20:10] Yeah. Okay. And yeah, you're right at that time, if you were a premium plugin that had that vulnerability, you probably wouldn't have found out about it until it was made public. Um, so, which, which is, you know, a bit of a issue too, so, Hmm.

[00:20:25] Katie Keith: Scary.

[00:20:26] Matt Cromwell: But like, what it was, there was no other way around it. Um, honestly, um,

[00:20:32] Remkus de Vries: reminds me a little bit about the, the Tim Thumb.

[00:20:34] Um, uh mm-hmm. Spectacle, I would always say.

[00:20:39] Matt Cromwell: Mm-hmm.

[00:20:40] Remkus de Vries: For those who don't know, thi Tim Thumb was a, uh, drop in library sold, or, um, shared in a lot of, uh, themes, uh, premium themes mostly. Uh, and it would take care of, uh, automatic, um, featured image sizes and stuff like that.

[00:20:59] Matt Cromwell: Mm-hmm.

[00:20:59] Remkus de Vries: Uh, and there was a huge vulnerability in it.

[00:21:03] Actually a, a couple right after, uh, the next one. Um, and it had a similar problem. It was mostly in premium themes.

[00:21:13] Matt Cromwell: Yeah.

[00:21:13] Remkus de Vries: How are you gonna solve that one? Mm-hmm. It was huge, huge risk, uh, to, to have it activated. 'cause essentially if you had it on your site, you were going to get hacked. That is,

[00:21:23] Matt Cromwell: yeah.

[00:21:25] Remkus de Vries: Probably because it was

[00:21:25] Matt Cromwell: easily scannable about whether or not you had that library. Yeah.

[00:21:29] Remkus de Vries: Very easy. Yeah.

[00:21:31] Matt Cromwell: I think it, honestly, Tim Thumb was one of the big things that gave WordPress a bad reputation for security. Honestly.

[00:21:39] Katie Keith: It was so, so widely known, wasn't it? People were talking about that as the example.

[00:21:44] Matt Cromwell: Yeah. Yeah. Another example is actually only happened this week, which is kind of a different, uh, uh, issue. Um, it came to light. There was a, there's a woman, a blogger who recently had her stripe, API Keys exposed publicly in one form or another, and somebody took her stripe, API keys, and was able to leverage that too.

[00:22:08] Make charges against her account and even to like set up other accounts, which was a little bit, um, I was a little bit skeptical about some of the details of the story, but, um, she reported to have lost over $70,000 in revenue and Stripe would not do anything about it because it was her Stripe, API keys.

[00:22:28] And so some folks started asking around with different products who, um, who leverage Stripe, like GiveWP like gravity forms, like WooCommerce, like whether or not we are storing the stripe unrestricted API keys in the database or not. Um, which generally speaking, we all do, uh, for sure. Yeah. Um, and um.

[00:22:50] It's because that's the way you communicate with Stripe. Now there might be other ways that we can leverage the Stripe, API, um, that might be different. Like we could try to do some sort of encryption of the API key. Um, but unencrypting it on the fly is a pretty challenging too. There's some things we're talking about and thinking through in order to improve that, but the.

[00:23:12] We are not considering it currently super high risk because it requires that somebody hacks your whole entire site to get access to those keys in the first place. Um, and some of the folks reporting on it seem to feel strongly, um, that having the API keys in your database is, is a vulnerability. I don't believe it's actually a vulnerability.

[00:23:35] Um, technically

[00:23:36] Remkus de Vries: it is.

[00:23:38] Matt Cromwell: For the, I mean, your database is made Yeah. For storing this type of data.

[00:23:42] Remkus de Vries: Sure.

[00:23:43] Katie Keith: Theoretical vulnerability that is dependent on the existence of other vulnerabilities.

[00:23:48] Remkus de Vries: Yep. But, uh, to expose it, the only way to mitigate this is to hash, to have it indeed, uh, hashed. That is the only way.

[00:23:55] It's not a vulnerability, but having any type of credentials in, um. In your database is technically a risk. And I, I say this coming from, uh, having worked at a large insurance company, um, for many, many years, and, um, they look at, uh, what is the vulnerability a little bit more, uh, with a very sharp edge of this is, and this is not, and this most certainly was one of those.

[00:24:19] Matt Cromwell: Mm-hmm. Yeah. Like even like the WordPress user password is, is MD five hashed, for example? Yeah.

[00:24:26] Remkus de Vries: Which is, which is probably something that, uh, uh, we should consider as a, as a low entry, um, encryption.

[00:24:33] Matt Cromwell: Mm-hmm.

[00:24:34] Yeah. I know there, there are MD five hash farms out there that are always trying to figure out Yeah.

[00:24:39] Uh, there are equivalent passwords and things like that, but still, yeah.

[00:24:44] Remkus de Vries: And, you know, understanding how fast things are going in terms of computer power, uh, available to us. Um, just a simple example of, uh, if you have a MacBook, the latest version, what is it? The M two MAX Pro, I forgot the exact, uh, naming, but if you compare that to what was available three years ago, it is so much faster.

[00:25:04] Matt Cromwell: Mm-hmm. And

[00:25:05] Remkus de Vries: if you extrapolate that to what the supercomputers are doing and all that, then it's just a matter of time there. The email of it, it to being guessed or, um, decrypted is just getting easier and easier. So, yeah. Um, but, you know, passwords is a whole nother thing that, uh, we need, probably need to solve better, but that's, that's a tough thing to solve.

[00:25:26] Inside your plugin, what you can do is have, uh, large hashed, um, um. Ways of, of saving whatever credentials you have. But that's, that's a horrible story. Losing, losing 70 K over. Yeah. Exposing your, um, your payment provider's keys.

[00:25:46] Matt Cromwell: Yeah. I think the, the point that you're highlighting as well is that security, let's just say security performance is another one, but like, security is not an all or nothing.

[00:25:57] It's not a Yes no. Um, there's a scale or a, a, a wide range of, of, um, security concerns, um, or security risks. Um, and it's not like, oh, well. Now that means you're not secure, uh, or now it means you are.

[00:26:14] Remkus de Vries: Um, no, it, it highly depends on the, um, the skillset of the, of the perp. Like how much effort are they willing to put in?

[00:26:25] Um, but finding vectors is surprisingly, uh, easy to do. And then it's just a matter of which one is the, the one I can find an entrance. And from that entrance, what can I then happen to make, uh, make happen on, on, on the next level. So if you, if you ever read, um. That they, every now and then there's a, there's a security researcher who publishes how they discovered a, a certain bug, right?

[00:26:52] If, if you've never read those, uh, as a product owner within WordPress, um. It's an incredible eyeopener in terms of the amount of layers they are stacking on top of each other, just to figure out if there is an entry. And sometimes that's buffering and sometimes that's just coming up with weird combinations of URLs that they're just gonna try and see if does something, allows something.

[00:27:17] Um, but these write outs are, are a good indication to, um. To have, you know, good wrong word are, are a great way to trigger you into, oh crap, there's a lot more they can do that I've just never thought about. Which then helps you produce better code because that's ultimately why they, uh, they publish what they publish, what they do.

[00:27:42] Um,

[00:27:46] I think if you start looking into these, you'll be amazed of the. There's stuff out there. Um, oh,

[00:27:52] Matt Cromwell: absolutely.

[00:27:53] Remkus de Vries: It's scary. Uh, security is a very, very, very fluid concept in terms of, it just starts with the person trying to get into your site. How skilled are they? How much money and time they want to throw at it.

[00:28:07] Mm-hmm. Yeah, it's, it, it's, it's a little, you should treat it as a scary world 'cause it is.

[00:28:14] Matt Cromwell: Mm-hmm. Absolutely.

[00:28:15] Katie Keith: Is that the most common way in, do you think people manually trying to, um, penetrate the site or, uh, because I, you kind of hear about people doing it in a more automated, um, they're doing an automated

[00:28:27] Remkus de Vries: is because they are aware of a, of a plugin.

[00:28:31] Uh, having a large security flaw, which if it's a zero day thing, it's, it's super, uh, super important. But there are small plugins that are just slow in releasing, and somebody else is like, you're being too slow and they're publishing the route, how to get in. And once you have a route, you can script it. Um, and that's a, that's a, that's a easy way to, uh, bulk scan sites.

[00:28:54] Right. So you just, mm-hmm. You just start with one site and just spider through, just like, uh, Google does, for instance. And, um, um, I, I, I learned from a researcher that it's, there's a surprisingly high number of hacks happening just because they happen to be on your system already. So just key logging and.

[00:29:16] Nothing more than that. Um, if you're running old Windows machines and you haven't ever patched up, there's a very high chance you have a key logger on there. Now, the, the, the question is how malicious are they? How, how far are they willing to go? So browsers, obviously, if you have those up to date, you, you already solve a lot of problems.

[00:29:34] But stuff like that is just, um, uh. If you're not aware of what those uh, options are, then there's no way you're ever gonna find solutions to mitigate that. So this is something you need to educate yourself on in terms of what are ways that I, you know, unintentionally open the door or maybe just remove a couple of layers just by me being smart about something, which I'm not aware of, what that impact is.

[00:30:02] Um, on a, on a different subject within coding. It's a very interesting field, uh, for sure. Mm-hmm.

[00:30:12] Matt Cromwell: Katie, what's your experience at Barn2 with, uh, performance and security in your plugins?

[00:30:19] Katie Keith: Yeah, I'm gonna talk about performance rather than security because. While we put security kind of as a priority in the coding and everything, we've never had a reported vulnerability amazingly, in any of our plugins.

[00:30:32] So I don't have any stories around that. Um, with performance, we have a plugin, which is interesting because almost by definition it can cause performance problems by the nature of what it does. So this is, um. Our, um, all time biggest selling plugin, WooCommerce product table, which takes your products and puts them in a table or order form with many products per page.

[00:30:57] And normally in WooCommerce, you might have nine or 12 products on the page, but our product table plugin will have more than that and it will also have additional data, which isn't normally loading on the shop page, such as variations. And each product can have dozens or hundreds of variations. And in our product table, by definition, each of those is loading, and each variation takes roughly the same amount of time to load as a whole product, like a simple product.

[00:31:26] So even if you've got like a 20 row product table with five variations per product. Times, you know, 20 times five, you've got a lot of products on the page. And that's the nature of the plugin and that's what people love about it because it's a really quick way for the customer to buy lots of products and all of that.

[00:31:45] But, uh, of course a lot of our support tickets are about performance because by the very nature there and lot of data's loading in one place. So we've always had this kind of conflict and contradiction, um, as the authors of this. Popular plugin and, uh, people saying, oh, I want it to load faster. And we've introduced various things to speed it up.

[00:32:07] So, um, the main thing is we've introduced a lazy load option, which loads one page of the table at a time. So if you've got pagination with like 10 pages of a table, then only one will load and it loads after the rest of the page. Um, and so we advise people to do that, but that's not as good in many ways as the standard method of loading it with the rest of the page because there's some limitations in terms of how it retrieves data from the database and the searching is limited, for example.

[00:32:39] And so there's some functionality that doesn't work in lazy loads. We haven't come up with a perfect solution, which I think is a relevant point to make regarding performance that sometimes something does take time to load and you have to do everything you can, but sometimes you do have to say to the customer, think about how you're using this product.

[00:33:00] You are telling it to display a huge amount of data, and maybe you need to kind of. Use it differently, which I kind of hate having to tell customers because you just want it to work. But we haven't found a perfect solution to that one. Um, and it's, we've been going through this for like, uh, seven years with this product and constantly looking for opportunities to improve performance, but we are never gonna get it perfect on that one.

[00:33:25] Mm-hmm. Which is a challenge.

[00:33:28] Matt Cromwell: There are ways. Have you asked Remkus what he thinks

[00:33:33] Katie Keith: to hire him?

[00:33:35] Remkus de Vries: So this is a good example of something that happens, especially in WooCommerce, but it's a, it happens with many plugins where they just need to retrieve large data sets all the time. Um, there, there are ways, uh, but it always comes with a cost.

[00:33:50] And then the, you know, is the cost worth, um, the. The benefit. But, um, there's, there's ways of caching certain things in between, uh, like breaking the process down into small pieces of what is cached, uh, is probably the direction I would look into most because at some level you are, and I, and, and I have a similar, um, similar problem with a client where that sort of, sort of magic needed to happen where we just ha introduced, um.

[00:34:24] Various levels of, uh, transient cash or just smarter ways of, of solving the big retrieve. Um, 'cause the big retrieve is just that you, you can never optimize that one. If it's big, it's big. There's just what it is. It's um, how can you do it? So throw more

[00:34:41] Matt Cromwell: hosting at it basically is all you can do, right?

[00:34:44] Remkus de Vries: Uh, so the, the, the most logical thing to add in, in total, um, if, if you can't solve it in code, would be having, uh, uh, Redis, uh, and object cash Pro.

[00:34:56] So those two just increase the, the amount of data that your WordPress site can retrieve from the database is that in itself already does so much that the perceived problem that you are having might just disappear if you're already are on good hosting. Hmm.

[00:35:14] Katie Keith: Interesting. Yeah, we've got basic caching for the whole table.

[00:35:18] Um, but sometimes we have to tell people to turn that off. For example, if they have stock data, they want that to be refreshed quickly. Yeah. Um, and things like that. So, but we haven't.

[00:35:30] Remkus de Vries: Yeah, I, I think I understand which, which direction that's being solved. But the transient API, you can use it for one thing, but you can also use it for small things.

[00:35:38] And Yes, uh, chaining them doesn't necessarily make everything faster, but there is a, there is a benefit to be had, but these particular types of performance issues are, are tough because there's so many, like you said, there's so many variables and, and versions of the types of data that you ask that you can go blanket like, okay.

[00:35:57] Here, this is my, my solution, and now everything is fixed and wonderful. It, it just, it doesn't work that way. It depends too much on what the actual end, uh, end request is going to be.

[00:36:09] Matt Cromwell: Mm-hmm.

[00:36:10] Remkus de Vries: Which, if you have a flex flexible plugin is not ever a certain,

[00:36:14] Matt Cromwell: Hmm.

[00:36:15] Yeah, I love that story though, or that experience, Katie, because, um, it is, you know, there are certain products where the issue of performance does become hyper relevant, um, more than others.

[00:36:27] Um, and that's, that's a really good example, um, where it's clear that you all have really tried to be really intentional about it. Um, but it's nevertheless really complex problem having a, a huge data set that is maybe being updated regularly and being able to load that. Publicly on the front end dynamically.

[00:36:46] Like that's, that's sounds super challenging no matter how you dice it. So it is, um, Remkus. So, um, in, uh, two or three, five minutes or less, like, uh, what's your, what's your experience with this subject? Can you distill it down for us?

[00:37:04] Remkus de Vries: Probably not. Excuse me. Um, I don't think I have a specific story without, uh, really deep diving into, uh, just issues and problems that I've, I've run into for clients and having to solve them and, and all of that.

[00:37:22] But, um, in, in terms of, um, like a, a common theme that I see a lot is, uh. Folks not fully understanding the implications of, um, optimized code. And that doesn't necessarily mean, um, I'll, I'll, I'll give you a gr I'll, I'll give you a good example. So in PHP, when you, you have the ability to switch for, you know, there's 10 scenarios you need to run through.

[00:37:58] You use switch and you go from the next and the next and the next and the next. Um, I've seen examples where. People made beautiful code, worked wonderfully, fantastically, even, but there was no early exit of the code. So there wasn't a check right inside the function saying, are we even supposed to do this?

[00:38:16] So what happened on every single page load, um, that function was running and in itself is not necessarily not even a problem. But if, if you're running a site that has a million visits, uh, a million page views per month, then that quickly becomes a problem because you can see the resources. Just adding up unreasonably high versus the number of page views that you're seeing.

[00:38:39] And sure, you can cache it, but if, if that happens to be WooCommerce site and most people are, um, on your site having something in their cart, which by that, by by default, uh, invalidates your cache, they're not in. So you can't optimize for that. So, um, if I combine a lot of stories. By just exa that, by using that example.

[00:39:03] That's a good one to keep in mind as you are optimizing in your code, be aware of how much can you, should you, uh, early exit optimize in terms of, uh, in terms of just raw code. Like, am I supposed to be doing this right now? All the time on every single page load. That's a question you need to ask yourself.

[00:39:28] The, the, the simple example is that you've, you, you probably all have seen, um, you, I'm sure as at one point in your WordPress, um, history, you've been in the dashboard and you saw the default fonts of WordPress being changed to something else. Hmm.

[00:39:45] Matt Cromwell: Yeah, a

[00:39:45] Remkus de Vries: great example because somebody in queued a style sheet, which was meant to do just something on the, either the plugin settings page or on the front end, but they queued everywhere.

[00:39:55] Everywhere. Yeah. That's a small example, but it's, it's the same principle, right? So you're not supposed to do everything at everywhere at all times. Um, be conscious of what you're doing, where, um. Is my, um,

[00:40:09] Matt Cromwell: yeah,

[00:40:10] Remkus de Vries: as, as condensed I, as I can get it without really deep diving.

[00:40:15] Matt Cromwell: I'll give a little backstory there, how that was applicable at give a long time ago.

[00:40:20] Um, I will say that like when give first launched, um. Caching plugins were all the rage and they were all not created equal, or most, actually nine out 10 of them were created badly. Yeah. Um, they were the bane of my support existence. Um, and, um, we honestly, we had, we had a lot of back and forth internally on like how we are going to cash or how are we going to load our assets on the front end.

[00:40:48] Uh, because technically we have the ability to limit the JavaScript and CSS to only wear a give. Form existed on the front end, but we noticed that when we had that in place, uh, our caching plugins tended to break the donation forms almost every time. Um, and it was one of those situations where we wanted to do what was best and most performant for the website.

[00:41:14] Um, and this is also before, um, what is it, um, what is it called? The HTTP protocol that lets you do multiple things at the same time slash two. Yeah, exactly. Uh, before all of that also. So we wanted to do it, but it, it, it just continued to be a major support burden. And so in the, at the end of the day, we were just loading our, our CSS and scripts throughout the whole front end of the site, which didn't feel very optimal at all.

[00:41:43] But the donation forms were working, um, even with cache caching, plugins enabled, um. Some folks who are astute, definitely didn't love that. Um, and I had to have a nice long support conversation about that. You like a lot of, yeah, I don't love it either. Um, but you know, I'm trying to choose between, uh, two evils here, so, yeah.

[00:42:08] Remkus de Vries: Yeah, like I said, you've made a lot of friends,

[00:42:12] Matt Cromwell: uh, got a lot more contacts since then.

[00:42:16] Remkus de Vries: Potential friends.

[00:42:17] Matt Cromwell: Yeah. Uh, uh, definitely a lot of folks who like to give me their strong worded opinion for sure. So, yeah. Yeah. Um, nice. Well, we have, uh, only a few minutes left. Um, and we wrap it up typically with talking about our best advice for anybody who's just getting into WordPress product ownership.

[00:42:37] Um, I. And, uh, Katie, you're up first. What's your best advice for folks on this, uh, topic?

[00:42:45] Katie Keith: Uh, well, I'd say to make performance and security an integral part of the product design and review process rather than an afterthought. And if possible, based on your company size, budget, et cetera, commission third party audits and support, because you don't have to be an expert in this area, but you do need an expert in this area.

[00:43:06] Matt Cromwell: Excellent. Good one. Raki.

[00:43:11] Remkus de Vries: Um, yeah, it, it's a, it's in this along the same lines, but it's, uh, uh, test small, test, big test, often, test weird scenarios, uh, and automate testing as much as you possibly can. Um, but assume you know nothing.

[00:43:31] Matt Cromwell: Excellent. Those are both great advice. I really, honestly don't have much to add to it, those, that's exactly the same advice I would give.

[00:43:38] Um, maybe the only thing I would add, um, is if somebody says that there's a problem, most likely they're right. So take everything that comes across your desk seriously and dig in and do your due diligence. Um, I think sometimes folks, uh, product owners have a tendency to. Minimize, um, feedback a little bit and say like, ah, it's not such a big deal.

[00:44:02] Um, you always think it's not such a big deal until it actually really bites you in the wrong way. So, yeah. Until it hurts you. Yeah, exactly. I. Um, actually in the chat I said, who has a horror story about a plugin or theme that ruined your website performance? Uh, we got one comment here real quick that says, Tim Zac resulted in injection to our membership software.

[00:44:26] A member. Ah, I remember hackers were able to, uh, change the PayPal email in the configuration without us noticing. Oh my gosh, that's super smart. Um, and so that they received all of the sales, um. For a few days. Uh oh man. That's horrible. That's a, that's definitely a horror story. Um, especially when it's like you're changing a setting.

[00:44:48] Like so much of the like malware scanner type things will scan for changes in files and whatnot. And that one is actually a, a change in the database, um, that might easily not get caught. Um, so thanks for the comment. Um. Thanks for being here. Really appreciate it. This was a great conversation. Um, sure.

[00:45:09] Remkus de Vries: Happy to be here

[00:45:11] Matt Cromwell: next week. We are having another Freezeland person.

[00:45:17] Remkus de Vries: Friesian. Yep.

[00:45:18] Matt Cromwell: Sorry,

[00:45:20] Remkus de Vries: another free

[00:45:21] Matt Cromwell: another. Yeah, exactly. The only other one in WordPress, right?

[00:45:25] Remkus de Vries: No, there's more. There's more.

[00:45:27] Matt Cromwell: I know I keep joking with you about this. Uh, Bo Rima is gonna join us. Uh, he's gonna be talking about, um, Dollie in particular, uh, but also.

[00:45:36] Uh, the opportunity WordPress products have to be distributed in a new fashion, uh, basically using, uh, a hosted version of your product, um, in, in new ways. Um, it's definitely things like Insta, WP and wp um, CS have really made this, uh, an interesting aspect, uh, and an interesting opportunity in the WordPress space.

[00:45:57] And, um, Bo is gonna come and, and talk with us about it. So I'm excited. So,

[00:46:02] Katie Keith: yeah. Oh, and also that will be the first week of our rotating co-hosts. Uh, last week we announced that in addition to Matt and myself, we'll be rotating with Zach Katz and Amber Hinz as co-host. So next week we'll be Matt and Amber, and then I'll be back the week after that.

[00:46:21] So that should be good too.

[00:46:23] Matt Cromwell: Yeah, I'm excited for that too. It'll be a good time. So everyone have a great week and go out there and be secure and fast. Thanks so much.