It's that time of year again - another large hosting company puts its foot in its mouth and potentially starts a wave of user leaving their service.
Over the past weekend, SiteGround rolled out a new WordPress AI Plugin. Nothing wrong with that, but it's what they did next that really causes concern.
In their wisdom, they decided to roll out the plugin to all of their clients (1+ million installs) and activate it on the websites by default. Let's dig into that a little.
They took a plugin that they wrote, installed it on every one of their clients' websites, even if they don't manage it, and then activated the plugin - on production sites!
There was an email sent to customers; I got mine on May 11th, saying they were preparing for the upcoming WordPress 7.0 release and that customers would be automatically upgraded. If you have auto-upgrade turned off, it won't force an upgrade. Buried in the email, there's wording about them rolling out AI Studio, and that you can install the plugin. They do not make it clear that they will auto-install the plugin on all sites, and there was no way to prevent the installation. The only information was that you can uninstall it later. We manage dozens of sites for customers, but we have to manually go into each site to disable and delete the plugin before they accidentally expose information? That's not cool!
My personal problem with all of this, aside from someone installing a plugin on a production site that we know nothing about and do not need, is: what happens to the data? SiteGround says that if you don't click the interactive chat button, your data won't be sent to their AI system for processing. But what are the chances that people didn't click the chat button to see what the heck that new circle thing is doing in the admin interface?
You can control lots of aspects of your WordPress site and WooCommerce websites, for that matter, and that's where major red flags are raised for me. A user could type "show me all customers from California that ordered in the last month," and it would take all your customer records, send them to an AI system, parse the data, and return the results. I'm sorry, where did you just send my customer data? Who touched it? Who is potentially scraping data? Who just exposed our client base, product base, income, name, address, phone number, email address, etc of a customer?
This has the potential to be a big security risk. I have real concerns about this, and the fact that it was automatically installed on a live site without my consent is even more concerning!
I have an article that goes into more detail on what happened, my big issues, and what we recommend users do. Check it out for more information: https://www.bigredseo.com/siteground-ai-plugin-controversy/
As a warning to all web designers and web hosting companies alike - do not install something, or modify something, on a client's site without prior permission. Just because it's your server doesn't mean you get to bypass the processes and procedures for live production sites. This error in judgment by SiteGround is going to have ramifications. Many people are on the hunt for a new hosting company.
Over the past weekend, SiteGround rolled out a new WordPress AI Plugin. Nothing wrong with that, but it's what they did next that really causes concern.
In their wisdom, they decided to roll out the plugin to all of their clients (1+ million installs) and activate it on the websites by default. Let's dig into that a little.
They took a plugin that they wrote, installed it on every one of their clients' websites, even if they don't manage it, and then activated the plugin - on production sites!
There was an email sent to customers; I got mine on May 11th, saying they were preparing for the upcoming WordPress 7.0 release and that customers would be automatically upgraded. If you have auto-upgrade turned off, it won't force an upgrade. Buried in the email, there's wording about them rolling out AI Studio, and that you can install the plugin. They do not make it clear that they will auto-install the plugin on all sites, and there was no way to prevent the installation. The only information was that you can uninstall it later. We manage dozens of sites for customers, but we have to manually go into each site to disable and delete the plugin before they accidentally expose information? That's not cool!
My personal problem with all of this, aside from someone installing a plugin on a production site that we know nothing about and do not need, is: what happens to the data? SiteGround says that if you don't click the interactive chat button, your data won't be sent to their AI system for processing. But what are the chances that people didn't click the chat button to see what the heck that new circle thing is doing in the admin interface?
You can control lots of aspects of your WordPress site and WooCommerce websites, for that matter, and that's where major red flags are raised for me. A user could type "show me all customers from California that ordered in the last month," and it would take all your customer records, send them to an AI system, parse the data, and return the results. I'm sorry, where did you just send my customer data? Who touched it? Who is potentially scraping data? Who just exposed our client base, product base, income, name, address, phone number, email address, etc of a customer?
This has the potential to be a big security risk. I have real concerns about this, and the fact that it was automatically installed on a live site without my consent is even more concerning!
I have an article that goes into more detail on what happened, my big issues, and what we recommend users do. Check it out for more information: https://www.bigredseo.com/siteground-ai-plugin-controversy/
As a warning to all web designers and web hosting companies alike - do not install something, or modify something, on a client's site without prior permission. Just because it's your server doesn't mean you get to bypass the processes and procedures for live production sites. This error in judgment by SiteGround is going to have ramifications. Many people are on the hunt for a new hosting company.
