If you’re new on the blog or haven’t visited in many years, you don’t know I moonlight as an SEO (web developer, marketing consultant, whatever). Main idea: I play with hosting/websites on a daily basis.
After having quite the year with hackings, malware and SPAM attacks on some of the accounts we run, I finally subscribed to Wordfence’s newsletter. If you know me, then you can count the subscriptions I have with one hand and maybe have 3 fingers left.
One week ago, I get this via email: PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads.
OK, sh*t happens, nothing is 100% secure, it can sometimes hit the fan. I go clean up and make sure all the websites are safe, then I go to look for more information, where other than the official plugin’s page. Right?
Wrong.
Nothing in the news section (it should have been plastered all over the website, we are talking about their biggest security issue in years), nothing visible. OK, maybe LinkedIn has something.
Yes, this is what they were showing:
So, blabbering about AI, some more AI and, at the end, you guessed, AI.
NOTHING about them sending out MALWARE in their Pro package. Not being hacked, not having a small issue, but sending out an INFECTED plugin version to their paid clients.
To this day we never received an email about this (similar to the one sent by Wordfence), or any other type of communication.
Even now, their LinkedIn page still shows absolutely no trace of this security incident. Never happened …
This is why, I uninstalled ALL our Pro packages, and canceled the subscription which was supposed to renew this week. Not because of an incident (although sending malware is more serious than having someone break into your website), but because of their complete lack of transparency.
Have you given up a service/product in a similar situation? Would you have renewed your subscription, if you were in my case?