- Feb 28, 2019
- 7,418
- 7,853
WordPress is the most popular CMS for blogs. It is also the most sought-after CMS for beginners, so hackers and spammers constantly attack WordPress sites. This guide will give you tips to be safe and secure.
Backup and Restore
WordPress offers convenient ways to backup and restore your site. There are several backup plugins like BackupBuddy, UpdraftPlus, VaultPress, etc. I use UpdraftPlus free version that offers backup to Google Drive and easy restoration. I'd highly recommend you to keep an external backup even if you think it's not necessary. Make it a habit to follow the best practices.
Cyber Attacks
Hackers find one way or another to find vulnerabilities and exploit them. Website security is not as easy as plug-and-play. You should constantly monitor your website, update themes & plugins, track the frequent attacks, and avoid common mistakes. Like anti-virus and anti-malware software for computers and phones, there are several security plugins available for WordPress. I recommend Wordfence plugin as it includes real-time malware scanning. It blocks cyberattacks, black-listed IP addresses, and the most common obfuscated codes. The free version is good enough for regular users.
The following are the most common attacks:
1. Brute force
It is the most commonly used attack to log in to your admin dashboard through guesses. The attacker uses the most common username-password combinations to find the right one. You can avoid most of these attacks simply by avoiding common usernames and passwords. The majority of the WordPress sites have "admin" as a username, so this is an easy guess and the most targeted username. Use a different username and complex passwords that are long and difficult to guess to be safe from most attacks. In addition to using secure passwords, you should also consider installing two-factor authentication on your WordPress site. Wordfence has a rate-limiting feature that blocks IPs after a few failed login attempts.
2. SQL Injection Attacks
The hacker may gain admin access by injecting malicious SQL queries or statements to manipulate your MySQL database. It is one of the most common WordPress attacks. The hackers usually carry out such attacks through input fields available on your sites like a contact form or search box. The vulnerabilities in themes and plugins are a weak link for such attacks. So, you should only install themes and plugins from a reliable and trusted developer. You should keep your MySQL database secure with a complex password and keep up with software updates. Change the default WordPress database name as a safety measure.
3. Cross-Site Scripting
It is also known as an XSS attack. It is carried out by uploading JavaScript code to collect data from your site or redirect users to another site. The hackers may attack through phishing methods such as newsletter subscriptions and forum posts. If you use Wordfence, you should frequently monitor the recently modified files section to see any changes. Some WordPress XSS plugins also prevent code injections.
4. DDoS Attacks
A Distributed Denial of Service (DDoS) attack crashes a web server by sending a large volume of requests. They are highly organized attacks and target both small and large websites. Some hosting providers offer basic DDoS protection. Cloudflare's free plan also provides basic DDoS protection. A Website Application Firewall can identify suspicious requests and prevent them from accessing your website. Several security plugins like Wordfence offer a firewall.
5. Malware
Cybercriminals scan websites for vulnerabilities to upload malware. You can avoid malware by regularly updating your themes and plugins. There are plugins available to scan and identify malware and malicious code on your site. Also, be careful while installing nulled themes and plugins.
WordPress Core Vulnerabilities
WordPress Core is generally secure. The developers fix known vulnerabilities in subsequent updates. Most of the attacks target outdated versions with vulnerabilities. So, you should always keep your installation up to date. The Site Health (Dashboard > Tools) is also an important indicator of security issues.
Nulled Themes and Plugins
It's better to avoid installing nulled themes and plugins when you have an alternative. You need multiple stages of protection if you install them. First of all, download themes and plugins through reliable sites. Always avoid searching for a random plugin on Google and downloading from the site that appears on top. You need to identify trustworthy websites that provide relatively safe nulled plugins. Find a reliable uploader on the site. It's better to avoid newbies or suspicious members.
After you download, scan all files through Virus Total. Most of the themes and plugins come clean, but some might have a few detections. You should avoid if there are too many detections. The security plugins like Wordfence detect vulnerabilities in themes and plugins. If there are any detections for malware or spoofed codes, you should immediately remove those themes/plugins.
Spoofed Codes
While the guide covers everything to avoid malware and spoofed codes, there is still a chance that the hackers found a way to hide them in the code. So, manually inspect the themes and plugins for spoofed codes. You can use Notepad++ or some other text editor to search for these codes.
Open Notepad++, click on Search > Find in Files, and search for "wp_vcd" and "base64" in the folder. These 2 are common methods used by cybercriminals. wp_vcd is a common WordPress malware backdoor. base64 is a way to obfuscating scripts. They are used to send information to the attacker's server.
These are the basic security measures required to keep your WordPress site safe and secure. But, there could still be some vulnerabilities. Moreover, the hackers keep finding new methods to attack sites. So, you should constantly backup your site and keep an eye on security recommendations for your site.
Backup and Restore
WordPress offers convenient ways to backup and restore your site. There are several backup plugins like BackupBuddy, UpdraftPlus, VaultPress, etc. I use UpdraftPlus free version that offers backup to Google Drive and easy restoration. I'd highly recommend you to keep an external backup even if you think it's not necessary. Make it a habit to follow the best practices.
Cyber Attacks
Hackers find one way or another to find vulnerabilities and exploit them. Website security is not as easy as plug-and-play. You should constantly monitor your website, update themes & plugins, track the frequent attacks, and avoid common mistakes. Like anti-virus and anti-malware software for computers and phones, there are several security plugins available for WordPress. I recommend Wordfence plugin as it includes real-time malware scanning. It blocks cyberattacks, black-listed IP addresses, and the most common obfuscated codes. The free version is good enough for regular users.
The plugin may not be 100% accurate. There are several alternatives available, and it's better to have at least one security plugin.
The following are the most common attacks:
1. Brute force
It is the most commonly used attack to log in to your admin dashboard through guesses. The attacker uses the most common username-password combinations to find the right one. You can avoid most of these attacks simply by avoiding common usernames and passwords. The majority of the WordPress sites have "admin" as a username, so this is an easy guess and the most targeted username. Use a different username and complex passwords that are long and difficult to guess to be safe from most attacks. In addition to using secure passwords, you should also consider installing two-factor authentication on your WordPress site. Wordfence has a rate-limiting feature that blocks IPs after a few failed login attempts.
2. SQL Injection Attacks
The hacker may gain admin access by injecting malicious SQL queries or statements to manipulate your MySQL database. It is one of the most common WordPress attacks. The hackers usually carry out such attacks through input fields available on your sites like a contact form or search box. The vulnerabilities in themes and plugins are a weak link for such attacks. So, you should only install themes and plugins from a reliable and trusted developer. You should keep your MySQL database secure with a complex password and keep up with software updates. Change the default WordPress database name as a safety measure.
3. Cross-Site Scripting
It is also known as an XSS attack. It is carried out by uploading JavaScript code to collect data from your site or redirect users to another site. The hackers may attack through phishing methods such as newsletter subscriptions and forum posts. If you use Wordfence, you should frequently monitor the recently modified files section to see any changes. Some WordPress XSS plugins also prevent code injections.
4. DDoS Attacks
A Distributed Denial of Service (DDoS) attack crashes a web server by sending a large volume of requests. They are highly organized attacks and target both small and large websites. Some hosting providers offer basic DDoS protection. Cloudflare's free plan also provides basic DDoS protection. A Website Application Firewall can identify suspicious requests and prevent them from accessing your website. Several security plugins like Wordfence offer a firewall.
5. Malware
Cybercriminals scan websites for vulnerabilities to upload malware. You can avoid malware by regularly updating your themes and plugins. There are plugins available to scan and identify malware and malicious code on your site. Also, be careful while installing nulled themes and plugins.
WordPress Core Vulnerabilities
WordPress Core is generally secure. The developers fix known vulnerabilities in subsequent updates. Most of the attacks target outdated versions with vulnerabilities. So, you should always keep your installation up to date. The Site Health (Dashboard > Tools) is also an important indicator of security issues.
Nulled Themes and Plugins
It's better to avoid installing nulled themes and plugins when you have an alternative. You need multiple stages of protection if you install them. First of all, download themes and plugins through reliable sites. Always avoid searching for a random plugin on Google and downloading from the site that appears on top. You need to identify trustworthy websites that provide relatively safe nulled plugins. Find a reliable uploader on the site. It's better to avoid newbies or suspicious members.
After you download, scan all files through Virus Total. Most of the themes and plugins come clean, but some might have a few detections. You should avoid if there are too many detections. The security plugins like Wordfence detect vulnerabilities in themes and plugins. If there are any detections for malware or spoofed codes, you should immediately remove those themes/plugins.
Spoofed Codes
While the guide covers everything to avoid malware and spoofed codes, there is still a chance that the hackers found a way to hide them in the code. So, manually inspect the themes and plugins for spoofed codes. You can use Notepad++ or some other text editor to search for these codes.
Open Notepad++, click on Search > Find in Files, and search for "wp_vcd" and "base64" in the folder. These 2 are common methods used by cybercriminals. wp_vcd is a common WordPress malware backdoor. base64 is a way to obfuscating scripts. They are used to send information to the attacker's server.
These are the basic security measures required to keep your WordPress site safe and secure. But, there could still be some vulnerabilities. Moreover, the hackers keep finding new methods to attack sites. So, you should constantly backup your site and keep an eye on security recommendations for your site.
