How to fully secure my store from Hackers and Malwares

I had a pretty bad experience with my previous hosting-2 of my sites were fully ruined by the malwares and hackers. I contacted the hosting support, they said its fully infected and my business was severely affected by this issue. I had a backup but somehow, they messed up my sites.

As a result, I am extremely cautious and want to secure my newly built digital store completely from malwares and hackers.

How do I do that?

Some of them suggested "keep upto date your plugins and wordpress theme". Problem here is that if I update them, chances are one of the plugin may stop functioning and something go wrong with the site. Then I have to hire a programmer to fix the issue.

How to fix this issue?

And what safety measures should I take?

I have recently started my 1st digital store based on wordpress and woocommerce.

How do you usually secure your site?



Waiting for your valuable suggestions

Thanks

You cant "fully" but at least, you'll make hacker's life harder.

suggestion:
* Hire someone to do it for you.
* Find a trustable hosting service.

Get a solution where they manage the wordpress security for you. Also look at solution providers like cloud flare that have web application firewalls.

I suggest you can purchase a DDoS protection or Cloudflare to protect your website from attack by hackers.
It will more secure your website.

if they use a zero day even if you have everything updated
it doesn't help much
and if they infect you and the same thing when you log in they will have access data to compromise the server
so if they are really motivated sooner or later
security is just an illusion unfortunately

franz119 said:

You cant "fully" but at least, you'll make hacker's life harder.

suggestion:
* Hire someone to do it for you.
* Find a trustable hosting service.

Click to expand...

Is there anyone in the BST provide such service?

jamie3000 said:

Get a solution where they manage the wordpress security for you. Also look at solution providers like cloud flare that have web application firewalls.

Click to expand...

Can you point me to the right direction?

Exa-Kent said:

I suggest you can purchase a DDoS protection or Cloudflare to protect your website from attack by hackers.
It will more secure your website.

Click to expand...

May I know how much does it cost?

sharkwhite00 said:

if they use a zero day even if you have everything updated
it doesn't help much
and if they infect you and the same thing when you log in they will have access data to compromise the server
so if they are really motivated sooner or later
security is just an illusion unfortunately

Click to expand...

So you mean no one is secure including amazon and google?

Don't ever install "free" or cracked plugins, a lot of websites crack premium plugins to inject shady scripts on your site.

qualityservice said:

Is there anyone in the BST provide such service?



Can you point me to the right direction?



May I know how much does it cost?



So you mean no one is secure including amazon and google?

Click to expand...

I'm not sure on the cost of DDoS protection or Cloudflare. You may have a look on Cloudflare official website. I go visit their website just now, just wondering they have offer free DDoS protection software for website. Can try first because it's free. Secure your website first more important.

Good luck bro.

Exa-Kent said:

I'm not sure on the cost of DDoS protection or Cloudflare. You may have a look on Cloudflare official website. I go visit their website just now, just wondering they have offer free DDoS protection software for website. Can try first because it's free. Secure your website first more important.

Good luck bro.

Click to expand...

Okay thanks buddy. So by free software you mean the visitor will see the DDOS security check page before they see the website?(similar to when we open BHW). am I right?

This really depends on how much you value that site. And yes, even "google" and "amazon" is not safe.

If you really need this protection, then hire someone with reputation (google more about this if you want).

qualityservice said:

Okay thanks buddy. So by free software you mean the visitor will see the DDOS security check page before they see the website?(similar to when we open BHW). am I right?

Click to expand...

Most welcome buddy!
So far I not sure on this because I didn't use free Cloudflare before this.
You can let me know also after you use it. I suggest for you because last time my friend recommend their protection for website more secure.

rafark said:

Don't ever install "free" or cracked plugins, a lot of websites crack premium plugins to inject shady scripts on your site.

Click to expand...

This is the cause of most issues, skimping on buying and also combining with the worlds cheapest hosting.

Wordpress is unsafe.

nuff said.

With all the respect, using such platforms like WordPress your website will never be secured.

Wordpress Security:

• Install Wordfence
• Enable 2 factor authentication
• Block shady countries with wordfence (china, russia, vietnam etc)
• Try not to use public wifi/hotspots
• Install cloudflare
• Dont use nulled plugins
• Dont use "shady" plugins
• Delete plugins from your server if you dont use it (dont just deactivate)
• Use good passwords for EVERYTHING (email, FTP, wordpress.. Everything!)
• Hide your /wp-admin/ there are plugins for this

If you make sure you do these steps correctly, you are good to go and the chance you will be hacked is minimum.

terrier2018 said:

Wordpress is unsafe.

Click to expand...

35:13 said:

With all the respect, using such platforms like WordPress your website will never be secured.

Click to expand...

Wordpress is actually pretty safe compared to other CMS, but what makes it unsafe is its popularity which makes it a very lucrative place to dig for vulnerabilities for hackers.

Regarding updating wordpress & wordpress plugins: Can't you just set up a test environment where you can see if updates break anything?

You might not like what I am about to suggest you. Don't use wordpress! There are many other cmses that are not that bad. I am not saying WordPress is bad. It is super useful for rapid application development. Still, just too many applications use wp these days. Use a different one e.g. drupal, which is also based on php; or go wild and use another language altogether like python (google python cms, you will find multiple projects). You wouldn't regret it if you take the extra mile.

People saying wordpress ain't safe should also suggest its alternative.... Dumbass....It is enough secure considering its PHP based.

Soory m8 but recent wordpress vulnerability is public you have to keep updating or face the consequences as its very difficult to remove a shell from host once placed.

I suggest you to shift to shopify if you can't handle all coding stuff.

Mochino said:

Wordpress Security:

• Install Wordfence
• Enable 2 factor authentication
• Block shady countries with wordfence (china, russia, vietnam etc)
• Try not to use public wifi/hotspots
• Install cloudflare
• Dont use nulled plugins
• Dont use "shady" plugins
• Delete plugins from your server if you dont use it (dont just deactivate)
• Use good passwords for EVERYTHING (email, FTP, wordpress.. Everything!)
• Hide your /wp-admin/ there are plugins for this

If you make sure you do these steps correctly, you are good to go and the chance you will be hacked is minimum.

Click to expand...

This is a great list! There is no way to 100% secure your site, but this will get you a lot closer. I'd also like to add that after you hide your wp-admin page, have wordfence auto block anyone who goes to it. I get a good 20-30 attempts a day of people trying to access that page. Regularly update your plugins. I have Wordfence send me emails daily of anything that needs updating. Most updates won't break stuff, but if you're that concerned about it follow this practice which is widely used in the corporate world: 1) Setup a test server. 2) Install updates to the test server and fully test all (or just the critical) program functionality. 3) Wait a few days to see if there are complaints about patches breaking things (a must for Windows OS patches). 4) If all is good, deploy to production. WP Staging is a good plugin-for a staging environment w/o having to invest in a second server.

Also review your logs and look for attacks or suspicious activity and block the IP (I block the whole range, usually 16-32k IPs). Be careful though, one time the IP range wordfence gave me to block WAS THE ENTIRE INTERNET! That would not be good. LOL!

Also for the "Use good passwords for EVERYTHING" line, I'd suggest using good and DIFFERENT passwords for each service.

Don't be afraid to block IPs, people, referrers or countries. I use multiple methods to block countries. China can send me a few thousand recon scans a month usually, so they're fun to watch get blocked.

On top of all that, practice good OpSec. The best passwords in the world won't do you any good if you open a malicious file on your computer or fall for a fake login site.

qualityservice said:

Is there anyone in the BST provide such service?
So you mean no one is secure including amazon and google?

Click to expand...

That's correct mate. Even a system that never touches the internet can be hacked, remember Stuxnet. Amazon and Google have their issues, but they have LOTS of money to throw at defense, so the likelihood of a successful attack is low.