Increasing hacking, malware, and ransomware attacks are making WordPress security more important than ever before
Keep WordPress updated
Recently, a severe vulnerability was found in the ‘All in One SEO’ WordPress plugin, allowing hackers to gain administrator access and take over control of websites using the plugin. The vulnerability has since been patched, and your website is safe if you have updated the plugin to the latest version, but this is a perfect example of how important it is to keep your WordPress software up to date.
Keeping your WordPress software and all plugins updated to their latest versions is a crucial part of website security, to minimize the chances of exploitable vulnerabilities that enable hackers to take over control of your website. Use only high-quality plugins that are regularly updated on your website.
If you are using our hosting or maintenance plans, all your WordPress software and plugins are automatically updated to their latest versions. And to further ensure the security of your website, we use only a minimum amount of plugins so you are not exposed to any unnecessary risks.
Website security
WordPress security is about more than keeping the core WordPress software and plugins up to date. The WordPress application runs on a software stack on a web server, which obviously also needs to be secure. This stack includes software such as Apache / Nginx, MySQL, PHP, and more. Good hosting companies will keep this software stack upgraded and secured, and may even have extra security features for added protection. Besides keeping the software stack secure, other aspects of WordPress security include:
Brute force login protection
Brute force is the most common type of hacker attack on WordPress websites. These attacks are performed by hackers who try to gain unauthorized access to the website by guessing the password of administrator accounts. The attempts are usually automated by bots (programs) that try many password combinations over a short period of time. For this reason, they are relatively easy to spot and can be prevented by locking out the offenders from any further login attempts.
Bot protection
Bots are small programs designed to automatically perform some functions on the Internet. Many bots are malicious scripts written and shared between hackers with nefarious goals. Bots can take many forms, including brute force attacks, spam posting, vulnerable code probing, and denial-of-service attacks. Besides being a security risk, these bots also use up important website resources such as bandwidth and CPU power, which can leave the website slow and unresponsive. For this reason, it is best to filter out any bots at the network or server level, before they reach your WordPress application.
Spam filtering
WordPress websites are often the victims of spam. There are two main ways that WordPress websites get spammed: 1) through comments on blog posts, and 2) through contact forms. You certainly don’t want lots of spam comments publicly viewable on your blog posts as this looks very unprofessional. Spam posts can be anything from benign advertising to links to dangerous malware or ransomware.
Furthermore, having your email inbox filled up with spam messages is very annoying. Fortunately, most spam comments and messages can be avoided by using spam filters or other mechanisms such as CAPTCHA that prevent automated bots from posting on your website.
If you are hosting your website at OptimizeWP you already have all of these security features implemented and don’t need to worry. We take website security extremely seriously.
SSL encryption and data protection
SSL encryption is what makes the communication between a website and its visitors secure and unreadable to outside parties. We recommend having an SSL certificate installed on every website, and if you are running an ecommerce store, this is an absolute must, both for customer trust and legal reasons.
Customers and/or visitors who trust you with their personal information given through an order or contact form have a right to privacy. This includes personal information such as name, email, address, phone number, and credit card information. Several regulations, such as the GDPR and CCSA have been put in place by governments to keep their citizens’ information private and safe. If you do not protect your users’ personal information, you may be liable to legal action against you.
Furthermore, insecure websites without proper encryption are negatively ranked by Google. This means Google down-prioritizes your website on search results, leading to fewer visitors and fewer sales.
We automatically install SSL encryption on all websites on our hosting plans. If you have any doubt about whether your website is secure, please contact us immediately. We are happy to audit your existing website and fix any security vulnerabilities you may have.
Backup, backup, backup
There’s a saying that “real men don’t do backups – but they do cry”. After all, this is only natural after losing all your data! Data loss can occur from many causes, including a defective hard drive, ransomware or malware, your website getting hacked, or someone accidentally deleting the wrong data.
We cannot emphasize enough the importance of keeping up-to-date backups of your website data. If you are using one of our hosting plans at OptimizeWP, you already have automatic daily backups of your site data and can sleep peacefully at night without worrying about data loss.