English
Deutschland
Österreich
Schweiz
Why can my WordPress be affected as well?
Many WordPress users are under the misconception that their hosting won't be attacked because they don't have important data on their website. However, most hostings are not directly attacked by a hacker. The majority of attacks are carried out by so-called bots. These bots are programs that automatically search the internet for WordPress websites and exploit various security vulnerabilities to subsequently gain access to WordPress.
Why is WordPress hosting an interesting target for attackers?
Malware in WordPress to redirect traffic to advertising pages
In this case, malware embeds itself within WordPress to subsequently redirect some or all visitors of the website to another website in order to display advertising. This variant of malware often remains undetected for a longer period, as not necessarily every page visit redirects to the advertising site, thus the malware does not immediately become apparent.
Malware in WordPress to install phishing pages
The phishing email, which deceives a mail recipient into thinking it comes from a bank or a supplier, requires a website that looks as if it is from the said bank upon being accessed. In some infected WordPress hostings, such subpages are placed to then capture the victims' login data. The attacker can then use this information to log into the bank or obtain other sensitive information.
Malware in WordPress to send spam via email
Sending spam via email is unfortunately still lucrative, and some malware sends spam from or through the hijacked WordPress.
Sleeper Malware "for later"
Another form of malware goes into a sleep mode after infecting WordPress, to be ready for later requests by the attacker. Depending on the type, WordPress can then become a tool for a Denial of Service attack or something else on command. More information about such Denial of Service attacks can be found on Wikipedia.
Malware that encrypts WordPress and then demands a ransom
A particular form of malware is ransomware. This encrypts files and sometimes the database after penetrating WordPress. The attacker offers to decrypt the data for a ransom, usually in the form of Bitcoin. However, having a backup of the data means you are well-prepared and can usually avoid paying the extortionist.
Data theft in WordPress and WooCommerce shops
Some shop solutions based on WordPress, like WooCommerce, contain sensitive customer data and are very interesting targets for attacks. This could be to use the data to find further access or to sell the data on the darknet or extort the shop owner. Especially with shop solutions, extra caution is necessary - also for liability and reputation reasons for the shop operator.
Attacks on WordPress to hack the server
In manual attacks, where one or more persons attack WordPress, it can also be a stepping stone to expand rights on the server and attack other services or users on the server. This is also called Privilege Escalation. Whether this is possible depends very much on the security quality of the hosting.
How do I best protect my WordPress against hackers and attacks?
Unfortunately, a big misconception - Inactive WordPress Plugins and Themes
An important point is to delete inactive plugins and themes. There is a widespread misconception that security vulnerabilities in inactive themes or plugins cannot be exploited. Therefore, it's crucial: Delete unnecessary and inactive themes and plugins.
Set WordPress, Plugins, and Themes to Automatic Updates
Some installations use automatic updates for the WordPress core system but not for plugins or themes. Sometimes the argument is that the site stopped working or was partially broken after previous failed updates. However, it's better to have a visual problem and be safe, rather than potentially catching malware because no automatic updates are active. A visual problem with the theme or plugin can be solved, but the effort to make an infected WordPress secure again is usually much higher.
Therefore, one of the simplest methods to increase the security of WordPress is to set all plugins and all themes to automatic updates. If a security problem occurs in one of the components and there is an update that fixes the problem, it will be automatically updated. Through these regular updates, it's ensured that your website is better protected against known threats.
Strong Passwords and Active User Management
Weak passwords are a common cause of security breaches. Use strong, preferably unique passwords for your WordPress users and administrators, your database, and your FTP access. Strong passwords are those that do not appear in pre-made dictionary lists and thus cannot be guessed by simply testing dictionary lists. Regularly check the user accounts of your website and remove accounts that are no longer needed. Limit the assignment of admin rights to a minimum. Check the users for unfamiliar names or suspicious email addresses.
Bots can automatically find out the names of users through WordPress User Enumeration. Once the usernames are known, attempts are made to log in using dictionaries with the most used passwords, and simple or known passwords, which are stored in a dictionary, then allow the login, and the WordPress can be infiltrated with malware if the user has corresponding rights.
You can check your password here at https://haveibeenpwned.com
PHP Interpreter on the Latest Version Possible
If your hosting allows it, set the highest or latest PHP version. The latest PHP interpreters include the latest security updates, while older PHP versions are partly no longer supplied with updates.
Security Plugins
There are numerous WordPress plugins designed to protect your website. Some popular security plugins include Wordfence, iThemes Security, and Sucuri Security. These plugins offer a range of features such as firewall protection, malware scanning, and monitoring suspicious activities. All these plugins affect the performance of WordPress due to the additional checks they perform. Combinations of different security plugins active at the same time can lead to an unusable WordPress, as they may block each other. It makes more sense to introduce the protection mechanisms described above and to have good hosting, where many attacks are filtered out and blocked by a firewall before reaching WordPress.
SSL Certificate
For completeness, we mention the SSL certificate. As modern browsers complain if a website is not SSL encrypted, this is becoming less of an issue. The SSL certificate is necessary to encrypt data transmission between the web server and your visitors' web browser. This protects sensitive data such as passwords and credit card information, for example, when eavesdropping on internet traffic in the same LAN or Wi-Fi. Many hosting providers offer free SSL certificates through Let's Encrypt.
Backups
Regular backups of your website are essential. In case of an attack or a technical failure, you can quickly restore your website. There are various WordPress backup plugins that enable automatic backups, such as UpdraftPlus and BackupBuddy. Ensure your backups are stored in a secure location and not directly on your web server. It's important to understand that even backup plugins negatively affect the performance of WordPress. A hosting that is reliably backed up by the provider and restored in an emergency does not have these performance losses.
Hosting Provider
Choosing a secure hosting provider is crucial for the security of your website. A good hosting provider offers not only regular server updates and security monitoring but also support in case of a security incident. Learn about your hosting provider's security practices and check reviews from other users.
Monitoring and Response
Even with the best security measures, no website is 100% secure. Monitoring tools can help detect suspicious activities early. An incident response plan helps you react quickly and effectively if your website is compromised. This plan should include steps for investigating and remedying the security incident, restoring the website, and communicating with users.
Conclusion
WordPress security is a complex field that requires constant attention and adjustments. Implementing the security measures and best practices discussed here is a crucial step in securing your website. Remember, the security of your WordPress site not only protects your content and reputation but also ensures the safety of your visitors.
At peaknetworks, we offer WordPress Hosting and Managed WordPress Hosting. Both include 10 days of full backup of all files and databases with free restore, free Let's Encrypt SSL, a server-side firewall that also blocks brute force attacks, and 24/7 monitoring of the server. With the Managed WordPress Hosting, we control and manage WordPress for you, including the theme and plugins, ensuring your WordPress is always up to date.
