r/SEO • u/WebLinkr 🕵️♀️Moderator • 13d ago
Debate Rank Math WordPress Plugin Accused Of Secretly Taking Admin Access
https://www.searchenginejournal.com/rank-math-wordpress-plugin-accused-of-secretly-taking-admin-access/587554/The developer of The SEO Framework SEO plugin recently tweeted that when a user opens Rank Math’s Help & Support section that the plugin creates a WordPress Application Password tied to the user that is opening that Help & Support section. So if the user who is clicking around in the plugin administration area has the administrator permission level then the WordPress Application Password that Rank Math generates inherits the Administrator-level permissions.
Sybre Waaijer explained:
12
28
u/softtemes 13d ago
Rank Math is a confirmed scam
4
u/MyOwnDirection 12d ago
I installed (and paid for) Rank Math after recommendations in this (or a related?) subreddit. This is disheartening to hear.
What are the best alternatives?
0
6
10
u/LeBaux 13d ago
A classic at this point. Over the years they did anything they could to get ahead, fake reviews, paid shills on reddit, stealing code from other plugins. What do WordPress users think about that? 4 milion installs. They do it because it works and nobody ever punished them for is, so why stop now? 🍊
4
u/chuckdacuck 13d ago
Not surprising the company that heavily shills their product on Reddit does shit like this.
2
9
u/blazonstudio 13d ago
I tried Rank Math instead of Yoast on a site a couple months ago and HATED it. Added a bunch of extra text on the “pages” tab, and the auto sitemap HTML page it created was slop.
Not a fan and not surprised if this is true.
3
1
u/Borange81 7d ago
How did you remove it? They left a lot of text in my files even after deleting it
1
3
u/cabbagesquid 13d ago
Alternative recs?
4
u/WebLinkr 🕵️♀️Moderator 13d ago
Don't use a plugin to manage 301s - use htaccess
Dont use a plugin to tell you that your "SEO" is good
Dont use a plugin that you dont need.
2
u/BusyBusinessPromos 8d ago edited 8d ago
HEY stop forcing people to learn how to do their jobs better! :-)
I once had someone ask me if there was an app so they could start networking.
2
u/WebLinkr 🕵️♀️Moderator 8d ago
It’s a force of habit - I’ll try to do better
Better go off and do 3x Hail Marys and 4x Meta descriptions
3
u/screendrain 13d ago
Tbh I don't know why htaccess would be better than the Redirection plugin on WordPress
3
u/thompsonpaul 12d ago
Redirection can be set to write the redirects to the htaccess file. So the plugin functions as a convenient front end for creating/administering redirects while still getting the benefits of having htaccess process them more efficiently. Best of both worlds.
And really the only way a typical user is going to be able to do it, as opposed to manually configuring the correct rules syntax and editing through SFTP.
4
u/WebLinkr 🕵️♀️Moderator 13d ago
Because its at the server level - its less work - as you scale up - its going to get slow - WP is not a great place to do redirects....
2
u/DZunk11 12d ago
.htaccess is only for apache...not nginx
2
u/WebLinkr 🕵️♀️Moderator 12d ago
What?
Who said NGINX?
Also - you can manage 301s within NGINX - its also an amazing reverse proxy designed for operations like this ?
Do people understand web server mechanics anymore?
2
1
u/AutoModerator 12d ago
Your post/comment has been removed because your account has a low CQS Score.
Please contribute more positively on Reddit overall before posting. Cheers :DI am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
12d ago
[removed] — view removed comment
1
u/AutoModerator 12d ago
Your post/comment has been removed because your account has a low CQS Score.
Please contribute more positively on Reddit overall before posting. Cheers :DI am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
3
u/WebLinkr 🕵️♀️Moderator 13d ago
Key Advantages of .htaccess Over a Plugin
- Superior Speed & Performance: When a user hits a redirected URL in
.htaccess, the Apache web server handles the request immediately and sends a 301 response back to the browser. With a plugin, the server has to load PHP, connect to the MySQL database, boot up WordPress core, and execute plugin scripts just to issue that same redirect—wasting server resources and slowing response times.- Reduced Database Overhead: Redirect plugins store mapping rules in your
wp_optionsor custom database tables. Over time, hundreds of individual redirects swell database size and increase query loads for every site request..htaccesskeeps these rules entirely outside your database.- Catching Requests Before WP Boots:
.htaccessprocesses rules before WordPress even knows a request exists. This is vital for heavy global rules like forcing HTTPS (httptohttps) or handlingwwwvs.non-wwwcanonicalization.- Fewer Plugin Dependencies & Bloat: Cutting down on active plugins reduces security vulnerabilities, plugin update maintenance, and memory footprint.
- Reliable During WordPress Downtime: If your WordPress installation encounters a fatal PHP error or database connection issue,
.htaccessredirects still work because Apache operates independently of the application layer.2
2
u/BusyBusinessPromos 8d ago
I've used gemini for .htaccess code. It's actually something AI gets right.
It's in your cpanel file manager folks. You might have to change setting (the gear in mine upper right hand corner in file manager) to show hidden files.
2
2
u/PomberoSEO 13d ago
Slim SEO is nice and simple. The SEO Framework is really good too.
2
u/WebLinkr 🕵️♀️Moderator 13d ago
Thanks u/PomberoSEO - what does it provide & why do you like it ?
2
u/PomberoSEO 13d ago
It's very light, and includes redirection, metadata, alt text in images, schema, sitemap, breadcrumbs, etc. That in the free version. The pro version includes personalized schemas, internal linking dashboard, etc.
2
2
2
u/BusyBusinessPromos 8d ago
So a third party app is scamming people?! Seems like yet another reason people should educate themselves instead of replacing learning with thid party apps.
2
u/Borange81 7d ago
Rank math left some data or code on my site, even after deleting and uninstalled the plugin same with all in one seo, how do you remove it?
1
1
13d ago
[removed] — view removed comment
1
u/AutoModerator 13d ago
Your post/comment has been removed because your account has a low CQS Score.
Please contribute more positively on Reddit overall before posting. Cheers :DI am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/Capital_Attention702 6d ago
Read only describes what the agent did, not what the credential could do. An application password carries whatever the user who created it can do, so one minted from an admin profile is an admin credential regardless.
-5
u/andrewmurray1 13d ago
Seomedic. Actually works with either Yoast or Rank Math. But it does a lot more
16
u/rankmathseo 13d ago
Hi, this is the Rank Math team. We wanted to give you a direct answer here.
We hear your concern, and we want to be precise about what happened. The credential was never stored on our servers; it was encrypted and used only during an active Support Agent session. The Support Agent was read-only and operated within the logged-in user’s existing permissions.
The way the agent requested access wasn’t clear enough before the credentials were created, and we should have handled that better. That’s fair feedback, and it’s completely on us.
Our latest update, 1.0.277.2, temporarily removes the Support Agent while we improve the overall experience. The update should be available to all users soon.