KeenWP

Curated resource guide

WordPress Supply-Chain Security

Reduce exposure to compromised plugins, maintainers, repositories, dependencies, and build systems across the WordPress delivery chain. These references cover provenance, integrity, update servers, Composer and npm risk, CI secrets, abandoned software, vendor review, advisory monitoring, dependency reduction, and emergency upstream response.

Scope

What this guide covers

  • Plugin/theme/core update provenance
  • compromised plugins and maintainer accounts
  • dependency and Composer/npm risks
  • GitHub/repository compromise
  • CI/CD secrets
  • stolen credentials
  • update-server security
  • package integrity
  • checksums
  • abandoned plugins
  • ownership transfers
  • malicious dependencies
  • third-party code snippets
  • nulled software
  • build pipelines
  • signing/integrity concepts
  • vendor due diligence
  • monitoring security advisories
  • minimizing dependency surface
  • and emergency response to a compromised upstream dependency

Selected references

Curated resources

Links open the original publisher so you can use the complete, current material in context.

  1. 01
    5
    Recommended starting point

    Detailed Plugin Guidelines

    The rules used for plugins hosted in the WordPress.org directory. Even for privately distributed work, they provide a valuable review of licensing, security, behavior, and user trust.

    developer.wordpress.org
  2. 02
    5

    Composer Audit

    Check installed PHP packages against security advisories and abandoned-package metadata.

    getcomposer.org
  3. 03
    5

    npm audit

    Review known vulnerabilities reported for the resolved npm dependency tree.

    docs.npmjs.com
  4. 04
    5

    GitHub Dependabot

    Automate dependency alerts and carefully reviewed update pull requests.

    docs.github.com
  5. 05
    5

    SLSA

    Use a shared framework for build integrity, provenance, and software supply-chain maturity.

    slsa.dev
  6. 06
    5

    OpenSSF Scorecard

    Assess observable repository security practices and investigate findings before adopting a dependency.

    securityscorecards.dev
  7. 07
    5

    Sigstore Documentation

    Learn keyless signing and verification for software artifacts and build provenance.

    docs.sigstore.dev
  8. 08
    5

    Secure Use of GitHub Actions

    Harden workflow permissions, third-party actions, untrusted input, credentials, runners, and supply-chain boundaries.

    docs.github.com
  9. 09
    5

    npm Package Provenance

    Publish verifiable links between npm packages, source repositories, and supported CI build environments.

    docs.npmjs.com
  10. 10
    5

    GitHub Artifact Attestations

    Generate and verify build provenance for release artifacts produced through GitHub Actions.

    docs.github.com
  11. 11
    5

    CycloneDX

    Represent application components, services, dependencies, and vulnerabilities in a standard software bill of materials.

    cyclonedx.org
  12. 12
    5

    CISA Software Bill of Materials

    Use public guidance and ecosystem resources to incorporate SBOMs into dependency risk management.

    cisa.gov