In most cases, when planning custom functionality for your site, you focus on its capabilities first. Only after that do you consider what vulnerabilities your new piece of software may have — and sometimes after some damage has already been done.
Why is custom code riskier than using plugins?
Plugins for WordPress usually get dissected and analyzed by tens of thousands of people, including those who try to find and abuse any security holes. This happens constantly, and you reap the benefits of all that work without having to lift a finger.
That’s not the case with custom-developed functionality, which hasn’t been stress-tested by anyone else. Of course, this is exactly the advantage of having a custom development: it does exactly what you need and nothing else. However, that also means that the burden of making sure that it’s secure lies entirely on whoever developed it.
What actually should be checked
A couple of questions that should be asked before any custom development becomes available, formulated in plain language and not technical jargon.
Who can access or manipulate data via this feature, and is it really the people who should? Login or booking forms, by definition, usually deal with customer data and it would be useful to know exactly how they do it.
What will happen if someone tries to enter some unexpected information? A form field that was previously tested only for valid input can work quite differently if someone uses it to enter unexpected or even harmful data.
Is there any non-encrypted transfer or storage of information that is prohibited to do? User passwords, credit card numbers, etc., have their own specific requirements to be considered safe beyond simple functionality.
What will happen in case of failure? A feature which silently fails and allows everything is different from a feature which fails completely and does nothing at all. And the latter is what you usually want.
Whose responsibility is this?
So many business owners assume that security review is included in development process automatically. This can be true in some cases. Usually this is something that is done separately as well, and only when there is a special request for this – otherwise, no one will check if your app is safe until there is a special request to do this.
Don’t get me wrong – this is not an accusation to developers in general. Developing something that will work and developing something that has been thoroughly reviewed for any possible security vulnerabilities are two different processes, and it is perfectly acceptable to ask about which process your app will go through.
Before you give approval to something custom
Some things to think about before signing off: has the application been tested for unexpected data as well as data it has been developed for? Is there any difference in treatment of customer data between the plugin and custom-made app? And has anyone other than developer checked the software?
None of these questions will delay the process. They will require just a few days of discussion, not weeks to finish developing.