Not long ago, I installed the Google Site Kit WordPress plugin, as it is an official Google WordPress plugin. When you install the plugin, it gives you an easier way to view data from Google Analytics, Google Search Console, Google AdSense, and Google PageSpeed Insights. You can view this data for the entire site or you can view it per page or per post. It doesn’t really do anything special except make it easier for you to view the data. You can see it directly in the WordPress dashboard rather than having to go to each of those sites separately: Google Analytics, Google Search Console, Google AdSense, and Google PageSpeed Insights. Well, there’s a problem with the plugin: an attacker can gain access to your Google Search Console for the site, and presumably with access they could do some harm.
In this case, they have to be an authenticated user of the WordPress site. If they’re a WordPress user of the site, they could potentially get access to the Google Search Console if they didn’t already have that access.
Wordfence has discovered a vulnerability in the Google Site Kit WordPress Plugin. They recommend updating the plugin as soon as possible. Logging into a WordPress site (such as this one) where I had Google Site Kit installed, there is an update for the plugin. However, rather than updating it I chose to simply deactivate the plugin and then delete it.
Here’s what they found:
“In order to establish the first connection with Site Kit and Google Search Console, the plugin generates a proxySetupURL that is used to redirect a site’s administrator to Google OAuth and run the site owner verification process through a proxy.” They went on to explain that “Due to the lack of capability checks on the admin_enqueue_scripts action, the proxySetupURL was displayed as part of the HTML source code of admin pages to any authenticated user accessing the /wp-admin dashboard.” They have to be an authenticated user of the WordPress site in order to see the code. That is my understanding.
Do You Need Google Site Kit?
I really haven’t seen any additional benefits from having the Google Site Kit WordPress plugin installed, as it does not give me any more functionality in my blog. It’s not helpful for users at all, just an add-on to the WordPress dashboard. If I need the data, then I can just go log into Google Analytics, Google Search Console, Google AdSense, or Google PageSpeed Insights. Also, adding more plugins that aren’t really necessary can help speed up the overall performance of the site, as it doesn’t have to load if the plugin isn’t installed. I’m personally a big fan of removing all plugins that are not needed, as it will help the site load faster, and the site is less vulnerable to security issues (as we can see with this Google Site Kit plugin).
My recommendation? Only install Google Site Kit if you absolutely can’t live without it. And here’s a hint: you don’t really need it.