According to the latest statistical data, the number of WordPress-based websites in the United States is over 9.6 million. WordPress is the most popular open-source platform in the world, boasting a share of over 50%. It powers numerous types of websites, starting from blogs and job boards and ending with business directories and Q&A websites.
Such tremendous popularity, though, comes at a cost. Cybercriminals of all kinds try to break into WordPress-powered websites and, unfortunately, succeed far too often. The WPScan Vulnerability Database currently lists over 16,700 WordPress core, plugin, and theme vulnerabilities—enough for any hacker to feel hopeful.
The WordPress Security Team
That said, the WordPress Security Team is very strong. It includes 50 top professionals who constantly monitor the WordPress security shield and eliminate any weak spots in it. Watch this video to learn more about the Security Team’s working process.
Over the years, WordPress has become more stable and secure. However, making the system’s core less vulnerable to attacks is only part of the solution. The Security Team’s duties don’t include checking the themes or plugins available at wordpress.org. Anyone who’s willing and has enough time can review those. As a result, security breaches through plugins and themes are quite frequent.
The Most Common Threats to a WP Site from Hackers
- Installing malicious software. Cybercriminals implant their code into a WordPress site’s files and use it to collect confidential data secretly.
- Cross-site scripting. A hacker tricks a WordPress site user into loading pages with JavaScript code. The code steals private data from the site user’s browser and sends it to the hacker over the Internet.
- Injecting SQL code. Once a criminal breaks into a WP site’s database, they can inject SQL code for creating a new user. Then, they can log in at any time and use the site’s files in any way they want without the owner suspecting anything.
- Including PHP files. PHP is the programming language that allows WordPress to do all the great stuff it does. A hacker can find a way to upload their PHP scripts into a WP site’s directories and use those for their criminal purposes. This is the most common method of taking control of the crucial WP file wp-config.php
- Brute force attacks. These mean bombarding the login screen with millions of nickname/password combinations in order to stumble upon the right credentials. What’s sad — this savage approach often yields positive results for the hacker.
While cybercriminals’ tricks may seem too clever for a layman to counteract, you can prevent many of them by applying 8 simple techniques we’ve described below. No knowledge of coding is required.
Essential Tips on Protecting a WordPress Site from Intrusion
1. Avoid Using a Weak Password
Let’s start with the essential measures to avoid brute force attacks. We can’t stress enough the importance of a good, hard-to-guess password. A password that only includes 6 random digits or characters is the surest way to losing your valuable data sooner rather than later. With powerful modern technologies, any hacker will be able to crack a password like that in no time.
A strong password means a well-mixed combination of digits, letters in lower and upper case, and special characters. View Google’s recommendations, for example.
Make your password unique and as unrelated to your life as possible. Avoid including your apartment number, spouse’s name, child’s birthday, or any similar information. Many people prefer coining a lengthy phrase instead of an arbitrary array of characters or numbers to make a hacker’s task more difficult.
Does coming up with a strong password seem an excessively challenging task? Then, use one of the numerous password generators like this one. Find it hard to remember passwords? Then, take advantage of this free tool to store them securely.
Finally, a password is not something carved in stone. Depending on how sensitive your data is, consider changing your password weekly or monthly.
2. Bring the Number of Login Attempts to a Minimum
Another way to protect your site against brute force attacks is to allow users to make just a few login attempts in a row. By default, WordPress doesn’t restrict users in the number of times they may try to sign in. Hackers adore this feature, as they can enter a multitude of username/password pairs into the login form in the hope of breaking inside.
Leaving one login attempt is not enough. Sometimes users forget to press the Shift key when necessary or enter a hyphen instead of an underscore. So give your users a chance to try to log in three-four times. If they fail, block them for a certain period.
How can you achieve that? Install the Limit Login Attempts Reloaded plugin. Then, go to Settings, select the plugin, and change the values in the fields under the Lockout category. You can increase the lockout time if more unsuccessful attempts are made after the first time a possible hacker has been blocked.
3. Select a Hosting Provider with a Strong Security Mechanism
When it comes to hosting, any business faces a big dilemma: pay less but get fewer features and weaker security, or pay more and get more features and stronger protection. If your budget allows it, we highly recommend spending more money on hosting that offers several security layers.
Otherwise, you’re running a risk of losing your data or letting crooks redirect your traffic to other sites. High-quality hosting companies perform daily scans for malware and monitor any attempts to gain unauthorized access to the hosted sites.
4. Implement an SSL Certificate
Transmitting data from a server to a browser over the Internet without an SSL (Secure Socket Layer) Certificate is like leaving your personal diary in a public place for everyone to read. An SSL certificate, on the other hand, allows you to encrypt all your data, making it impossible for cybercriminals to decipher.
There are two ways you can get an SSL certificate:
- Purchase it from a provider.
- Use the free Let’s Encrypt SSL certificate offered by your hosting company.
The paid option is preferable if you have enough financial resources. To get a better insight into the difference between a paid and free SSL certificates, read this post.
Installing an SSL certificate not only makes your WP site more secure but also improves its search engine visibility. Google considers ‘https://’ at the beginning of a URL an important factor and ranks the site higher.
5. Make Regular Backups of Your Site
Hackers are very inventive. Whatever measures you take to protect your WordPress site, there’s always a potential crack in the armor through which a criminal can get inside. So, it’s advisable to have a working copy of the website safely stored in a place where no one can get hold of it, like an external hard drive.
How often do you need to make backups? It depends on the scale of your business activities. For small and medium-sized companies, a monthly backup is probably sufficient. The sensitivity of information is also important in this respect.
There are some excellent backup plugins that make copying a site’s files easy and fast. One of them is BackWPup. It’s simple in operation and comes with a series of training videos to get you up to speed. You can plan and schedule backup jobs and push backup archives to an external storage service if you don’t want to store them on the same server.
6. Keep Everything Up to Date
Have a look at the long list of WordPress versions that have been released since 2003. Every new version added something to the core functionality of the CMS including security patches.
That’s the reason why updating the WordPress core as well as its plugins and themes is so important. It helps you avoid dangerous security breaches. In the same video about the WordPress Security team, Aaron Campbell says that the Team postpones the announcements about new security improvements closer to release dates so that hackers couldn’t use that information to their advantage.
While WordPress automatically performs minor updates, dealing with major ones is the user’s responsibility. So, keep track of the WordPress versions and update plugins and themes. To do this, go to the Plugins page and click the Update Now link next to a specific plugin if this link is available.
7. Monitor Your Website for Malware with a Security Plugin
Finally, installing a security plugin to monitor your website for any malicious software installation is a must. A person who’s not versed in coding may not even understand that a hacker has infected their WordPress site with bad code. A plugin, on the other hand, is capable of analyzing the files and detecting any code injected by hackers.
In our opinion, one of the best plugins for this purpose is iThemes Security. It has been installed on more than 900,000 sites and performs a wide range of functions. It blocks bad users, monitors the site and reports suspicious changes to the file system and database, hides common security vulnerabilities (e.g., changes the URLs for WordPress dashboard areas, including login and admin), regularly updates the WP database, and does other useful things.
Conclusion
The security of a WordPress website is not something to be taken lightly. Cybercriminals are always searching for new loopholes and trying to exploit them. The techniques we’ve listed above are essential for the health and safety of your site.
To make your WP site even more secure, tweaking its code is necessary. That job should be left to professionals. The Site Slinger’s highly skilled and experienced WP developers can help you with many WP-related tasks such as PSD to WordPress conversion. Tell us what you need and we’ll get it done.