Alert: Two-Factor Authentication Issues via SMS

This notice relates to the following platforms: WordPress.com VIP, VIP Go

We are currently experiencing sporadic problems with Two-Factor Authentication SMS messages not being received. This is not affecting users who use authentication apps on their mobile devices.

For now, users can gain access to their account using their saved backup codes.

Sorry for the trouble! The issue is currently being investigated with our SMS provider and we shall provide an update when further information is available.

Please visit the VIP Lobby for more detailed updates (you can request access if you don’t have it already) at https://lobby.vip.wordpress.com – we will continue to update this post until the issue is resolved.

If you have any questions, please email vip-support@wordpress.com.

Update on 30th October: SMS notifications should now be working normally after remedial work was performed over the weekend. We are still working with our SMS provider to understand the cause and to ensure the issue isn’t repeated. Thank you for patience during this time.

Although SMS notifications are a valid way of receiving authentication confirmation, we would strongly recommend using phone apps, such as Authy, where possible. This would also be a great time too to remind all users that they should have a copy of their backup codes. You can find out more about both of these in our recently published post ‘Tips on Managing Two Step Authentication’.

WordPress 4.9: What to Test For

This notice relates to the following platforms: WordPress.com VIP, VIP Go

WordPress 4.9 is slated for release in early November. In this post, we will share more details on what is included in the release, along with suggested testing. You can also find detailed walkthroughs of the core update on WP Tavern and Kinsta.

When will the changes be deployed?

WordPress.com VIP: We will be deploying incremental updates leading up to the public release with the bulk of the enhancements pushed out during the week of October 30, 2017.

VIP Go: The release will be deployed to all Go sites on November 14, 2017.

Please note that the deployment dates are subject to change if critical issues are discovered during testing or the public release is delayed. We’ll post updates to the Lobby if the dates do change.

What’s changing?

Most of the changes in 4.9 relate to the Customizer. You can now draft and schedule Customizer changes (#)(#) and generate a Customizer preview link (#). WordPress will now perform an educated mapping of menus and widgets when switching themes (#), and the usability of the Customize JS API has been improved. (#)(#)(#)

There are also a few widget changes: a new gallery widget (#), and text widgets will now support oEmbeds, media, and shortcodes. (#)(#)(#)

As for infrastructure changes:

  • For the REST API, support has been added for registering complex data structures for settings and meta, and there is now support for objects in schema validation and sanitization. (#)
  • There are new capabilities for activating and deactiviting individual plugins – activate_plugin, deactivate_plugin, and deactivate_plugins. (#)
  • You should now use WP_Term_Query when transforming tax queries. (#)
  • Capabilities have been introduced dedicated to installing and updating language files. (#)
  • ​​max-width is now being used for default captions. (#)
  • SWFUpload is being removed. (#)(#)
  • For VIP Go clients, a confirmation link in an email now has to be clicked when a user attempts to change their email address. (#)
  • Code editing improvements have been made, which will effect those using the Customizer’s Additional CSS and Custom HTML widget. (#)
  • Core will be almost fully compatible with the upcoming release of PHP 7.2 (with the release of 4.9.1, it will be fully compatible).

For VIP Go customers using multisite, this is of note:

  • get_site_by has been introduced. (#)
  • 4.9 improves initializing available roles when switch sites. (#)(#)

For WordPress.com customers, the following will not be merged into wpcom:

What should I test for?

  • refresh_blog_details() is deprecated, so any calls to this should be removed.
  • In changes to roles and capabilities, mapping do_not_allow as a capability to a role is no longer valid. Using it to disallow an action from happening is still valid.
  • Role switching during switch_to_blog() has changed.
  • If you are using the customizer, we recommend reviewing the testing details listed here.

What do I need to do?

We highly recommend updating your local development environments to the beta release using the Beta Tester plugin or updating it to track trunk (i.e. bleeding edge) via either the Subversion or GitHub repos. (If you’re using VVV, one of the default sites will already be tracking trunk. For Chassis users, you can switch your install to switch over to a separate checkout.)

For sites on VIP Go, you can have your Go-hosted development sites switched to trunk as well. If this is something that interests you, please reach out and we can set it up for you.

What if I find Issues?

If you have testing feedback or questions related to this release, please open a support ticket with details and we will be happy to help.

Tips on Managing Two Step Authentication

This notice relates to the following platforms: WordPress.com VIP, VIP Go

We know that Two Step Authentication can be a bit tricky for some users, so we wanted to share a few Frequently Asked Questions that could help your colleagues.

What is Two Step Authentication?

Two step authentication is a method of securing accounts that requires you not only know something (a password) to login, but that you also possess something (a mobile device).

The benefit of this approach to security is that even if someone guesses or obtains your password, they would still need to steal your mobile device in order to break into your account.

Do I need SMS?

SMS is the least secure method of two-step authentication and, if you change phone numbers, will stop working unless you remember to change your phone number on all of your accounts.

We recommend, instead, to use a phone app, which will provide the two step codes but will add additional layers of security. Authy is recommended and free, as is Google Authenticator (both are available on Android and Apple platforms). The latter is the most secure but Authy will transfer all of your codes between phones, if you change it.

What happens if I can’t access my codes?

If you can’t access your code via SMS or a phone app, then you can use backup codes which can be downloaded from the security section of your WordPress.com account screen. We strongly recommend that you print and store your backup codes in a secure place.

What happens if I don’t have backup codes?

The VIP team needs to fully validate the user and request by contacting an authorized contact at your company before we can help a user regain access. This can sometimes take a few days, which is why we suggest you store your backup codes somewhere safe, as it can be quite a hassle! So, for your own sanity, please ensure you save your backup codes.

What are our other security best practices?

VIP has a number of user security best practices, which include using password managers and using strong, unique passwords.  If you haven’t looked over this list in a while, it would be worthwhile to review to see if there are any improvements you can make.

Alert: VIP Go Customizer Availability Issues

This notice relates to the following platforms: VIP Go

Update 08:59 UTC: The main outage incident took place from roughly 07:24 to 08:55 UTC and should now be resolved.

We are currently troubleshooting issues with the customizer on VIP Go, and sites may experience blank customizer screens in the meantime.

Sorry for the trouble! We are working on the issue, and will follow up with another alert once this is resolved.

Please check Twitter for the latest updates: @WPVIPStatus

If you have any questions or concerns please open a ticket via our support interface and we’ll gladly assist you.

Alert: VIP Go Service Interruption

This notice relates to the following platforms: VIP Go

ROOT CAUSE UPDATE:

The VIP Go origin servers were unavailable between approximately 04:42:13 and 05:05:46 UTC on April 6, 2017. In this situation our caching layer is designed to serve cached content while the origin servers are unavailable, we saw approximately 90% of requests receiving expected responses with the remaining 10% receiving a 503 Service Unavailable response.

We apologise for the inconvenience.

The root cause was a server management process that removed critical files when some routine updates were deployed. The server management tools and process have now been changed, making it impossible for the same issue to occur in future.

If you have any questions, please contact us via support ticket.

Between 22:00 and 22:05 Pacific Time (05:00 and 05:05 UTC) there was a VIP Go platform outage that impacted the performance and availability of VIP Go sites. All services should be back to normal operation.

Sorry for the trouble! We are investigating the cause for the service disruption and will follow up with an update.

If you have any questions or concerns please open a ticket via our support interface and we’ll gladly assist you.

Edit: The title was updated to identify the platform as VIP Go, rather than WordPress.com VIP Go.