The latest 90 reviews of mySites.guru - and what they said

Between the ninth of June and the nineteenth of August, ninety people left mySites.guru a five-star review.

The obvious objection first, because it is a fair one. We asked. In June we replaced the third-party review form we had been using with our own, and then we asked people to use it.

So yes, the volume came from asking. What nobody did was tell anyone what to write. There is no discount for leaving one, no prize draw, no template, no approval step, and no filter that quietly loses the unflattering ones. The form is open to anyone, right now, including people who left years ago.

We could of course have chosen not to publish an unfavourable one. In practice the question almost never arises, because people who are unhappy with us do not tend to write it on our own site. They put it on social media, or on Trustpilot, which is an ironically named place to go when you have decided not to say it to someone’s face. That is entirely their right. We would still rather hear it directly, because a complaint we can read is a complaint we can fix, and quite a lot of this product exists because somebody did exactly that.

We already have a post pulling out the recurring themes from the reviews as a whole. This is a different exercise: rather than pick the six most flattering quotes and call it a testimonial page, we read all ninety from this summer and counted what people actually talked about. The result was not what we expected.

The most mentioned thing in the product is a person

Here is what appears in the ninety reviews, counted by hand:

Every row links somewhere. The eight that map to a review topic open the reviews page filtered to it, and the rest go to the thing being talked about. On the filtered ones, expect a longer list than the percentage suggests: the percentages above count how many of this summer’s ninety reviews use the word, while the filter groups every review we have ever received by subject, which is a broader test over a bigger pool.

Read that top row again. In reviews of a piece of software, the single most mentioned thing is not a feature. It is the name of the person who answers the emails.

We did not set out to build a product with a person at the centre of it, and if you asked a product consultant they would probably tell you it is a liability. It is certainly not something you can put on a comparison table. But thirty-two of ninety people chose to name him, unprompted, when they were writing about a site management platform.

The second thing worth noticing is what is low on that list. Backups get 6%. Price gets 6%. These are the things a feature comparison would lead with, and they are close to the bottom of what people bother to mention when writing freely.

What people are actually buying is the end of manual checking

Time comes up in 31% of reviews, and it is almost always the same shape of story: a number of sites that has quietly grown past the point where a human can keep up. That is the whole argument for centralised management, and it is not one anybody believes until they have lived it.

Twenty-five is a modest number by the standards of this summer’s reviews. The counts people volunteered run from 20 sites up to well over 600.

The threshold where this stops being a nice-to-have seems to sit somewhere around twenty sites. Below that you can just about hold it in your head. Above it, something is always out of date and you will not find out which until it matters. The tools people name most often in this context are bulk extension updates, scheduled audits and backups, and the vulnerable extension alerts that tell you which of your sites is running something with a CVE against it.

Twenty-one percent of them mention being hacked

This is the number that would worry us if we were reading it about someone else’s product, so it deserves explaining. A large share of people find the service because they have just been hacked, and a fresh compromise is what they write about when they sit down to leave a review. If that is you right now, start with how to find hacked files and backdoors rather than with this post.

That one is worth pausing on because it names the actual attack. The JCE editor compromise ran through the Joomla world this summer, and it is the reason a dedicated check now finds the rogue editor profiles and the webshells the attack drops. Herman’s site was cleaned through fix.mysites.guru, which is the separate fixed-fee service for when a site is already compromised and you want somebody else to deal with it.

Mike is describing the thing that changed in June, when confirmed hacked files were split away from heuristic suspect content so that a real compromise is no longer buried in a list of files that turned out to be legitimate.

The reviews name features we have never marketed

Reading ninety reviews in a row surfaces something a roadmap never will: which parts of the product people actually notice.

Tagging came up, which we have never once written a marketing page about. Neither, for that matter, have we written much about tracking PHP versions across every site, and that turns up in the same review.

So did the audit results themselves, and the fact that sites stay permanently monitored between them, from somebody two weeks into using the product:

And the thing that generates the most email of anything we do, which is telling people about a vulnerability before their vendor does:

Those notifications are not a feed we resell. A good number of them come from vulnerabilities we found and disclosed ourselves: nineteen across seventeen Joomla extensions in one month alone, five of them rated the maximum CVSS 10.0.

If you have Joomla or WordPress sites and none of this is familiar

One sentence turned up, in one form or another, in a surprising number of these reviews. It is the reason this post exists.

Tomasz closes that review by calling it “one of those tools that, once you start using it, you wonder how you ever managed without it.” We are quoting it because it describes a specific and avoidable situation: running ten or fifty or two hundred sites on trust and a calendar reminder, then discovering the gaps only when one of them is defaced.

If you manage more than a handful of Joomla or WordPress sites and you cannot currently answer, in under a minute, which of them is running an extension with a known vulnerability, which has not been backed up this week, and which is silently on an unsupported PHP version, then you are the person these ninety reviews are describing before they found the tool.

The free audit answers those three questions for one site without a card. If your site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually same day, and it is screened before anyone commits so you are not charged in the very rare case that it cannot be fixed.

Read them yourself, or add one

All 268 reviews are on the reviews page, oldest to newest, every one under a real name. WP Mayor reviewed the service independently and scored it 4.6 out of 5, which is worth more than anything we publish about ourselves because we had no say in it.

And if you use mySites.guru, the form is here. Nobody will ask you first.

Further reading

• WordPress Plugin Directory for checking what a plugin is and who maintains it
• CVE Program for looking up a specific vulnerability identifier
• CISA Known Exploited Vulnerabilities Catalog for which flaws are actually being used in attacks