SSRF is an attack that tricks your website’s server into making requests for the attacker, for example to private systems that are closed to the outside. The request seems to come from your own server, so it can reach places that would refuse the attacker directly.
What is SSRF?
Server-side request forgery (SSRF) is a type of vulnerability. The request comes from your server and not from the attacker, so it carries your server’s position in the network and sometimes its trust.
Many features make a server fetch something from an address: importing an image from a link, showing a preview of a URL, checking a webhook or loading a feed. If the address comes from the visitor and the code does not check it, the visitor can point the server somewhere else. That could be another site, a service on the same machine or a system inside your hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. network that is hidden from the internet.
What the attacker gets depends on what sits behind the server. A common target on cloud hosting is the internal address where a machine can read information about itself. Internal admin panels and databases that trust requests from the same network are another.
Why it is hard to spot
An SSRF flaw does not look like an attack on your site. The visible page may work normally. The problem is in what the server does behind the scenes, and that shows up in server logs rather than on the page. This is also why it is usually fixed by the maker through an update and not by a site owner’s settings alone.
What it means for a PHP or WordPress site
PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. can fetch addresses in several ways, including its cURL support (see cURLcURL is a tool that lets software, such as PHP, fetch information from other websites and services, for example to check for updates or send an order.), and WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. and its plugins use those functions for imports, embeds, updates and remote images. A pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. that accepts a URL from a visitor and fetches it without checks is a candidate for this kind of vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data..
The more features that fetch remote content, the larger the attack surfaceThe attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server.. A simple brochure site with a few pages and a contact form fetches almost nothing, while a site stacked with import tools, previews and integrations fetches a lot. You decide which of those are worth having.
A concrete example
Imagine a plugin that shows a preview card when you paste a link into a form. The visitor types an address, the server fetches it and shows the title. If the code does not check the address, the visitor can type the address of an internal service instead, and the plugin will happily show what it returns. Real fixes check the address against an allowed list, block internal ranges and keep fetch tools out of reach of visitors who are not logged in.
When to act
Update plugins and PHP whenever the maker publishes a security fixA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem., and read the notes: when a changelog mentions SSRF or “request forgery”, treat it as a reason to update within days. Remove plugins that you do not use, and question the ones that fetch remote content for features you never touch. If you want a site where no PHP or database runs when a page is viewed, see our WordPress to static site approach.
If you suspect that a flaw like this has been used, such as strange outgoing traffic or unknown files, ask us to fix your WordPress website.
Frequently asked questions
What does SSRF stand for?
Server-side request forgery. The attacker forges a request that your server sends, instead of one that comes from the attacker's own browser.
Why is SSRF dangerous?
Because your server often sits inside a network that outsiders cannot reach. If an attacker can steer where the server sends requests, they can ask internal systems questions that were never meant for the internet.
Is SSRF the same as cross-site scripting?
No. Cross-site scriptingCross-site scripting (XSS) is an attack that sneaks a harmful script into one of your pages, so it runs in your visitors' browsers as if you had placed it. runs a script in a visitor's browser. SSRF abuses the server itself to make outgoing requests.
How do I reduce SSRF risk on a WordPress site?
Keep core, plugins and PHP up to date, remove plugins that fetch addresses for no good reason, and ask your host to limit which internal addresses the server may contact.