The last two updates for the security plugin Block wp-login were “Important security update”. That shouldn’t be the sort of thing that happens with a security plugin, but it isn’t surprising if you look at our bewildering exchange we had with the developer of that in the comments of our post about a vulnerability in another of their security plugins. The vulnerability fixed is good example that security plugins can have serious downsides, while providing little upside. In this case the functionality doesn’t really seem like something the average website needs, if it was a good idea it should be integrated in to WordPress, and the vulnerability would stop people from logging in to WordPress.

…

[Read more]