Articles

10 Reasons Your WordPress Site Will Get Hacked (and How to Stop It)

,

A hacked WordPress site is as damaging as having your home burgled. It can completely shatter your peace of mind and adversely impact your online business. 

Why do hackers target WordPress sites? The answer is relatively simple: WordPress is the single biggest platform for website creation these days, so there’s a larger base to attack; this attracts the attention of online criminals. 

So, how can a hack impact your website? 

Depending on the type of attack, your website could suffer any of the following:

  • It could be defaced completely;
  • It could load or operate very slowly on any device;
  • It could completely crash and malfunction;
  • It could display the dreadful “White Screen of Death”;
  • Its incoming visitors could be redirected to other suspicious websites;
  • It could lose all your valuable customer data.

This list is not exhaustive but you get the idea.

Now that we know how a successful hack can impact your website and online business, let us look at the top 10 reasons behind WP hacks and prevent them.

1. An Insecure Web Host 

Like any website, WordPress is hosted on a web host or server. Unfortunately, most site owners do not pay much attention to the web host they select and choose the cheapest they can find. For example, it is more affordable to host a website on a shared hosting plan — one that shares its server resources with many other websites like yours.

This can make your site vulnerable to hackers as a successful hack into any website on the shared server. A single hacked site can consume the overall server bandwidth and impact all the other sites’ performance.

The only way to fix this problem is to opt for a reliable host and a virtual or dedicated server.

Pro tip: If you’re already using a shared hosting plan, check with your hosts if they offer VPS hosting and make the switch.

2. Use of Weak Passwords

Weak passwords are the main reason behind successful brute force attacks that target your account. Even to this day, users continue to use weak and common passwords like “password” or “123456”; if you’re one of them, your website could land in trouble!

Guessing weak passwords allows hackers to enter the admin accounts where they can inflict the maximum damage.

How do you fix this problem? Simple, ensure all your account users (including admin users) configure strong passwords for their login credentials. With at least 8 characters, passwords must be a mix of upper- and lower-case alphabets, numbers, and symbols. 

For added safety, install a password management tool that can automatically generate and store strong passwords.

Pro tip: You can use a plugin to reset passwords for all your users.

3. An Outdated WP Version

Outdated software is among the most common reasons why websites get hacked. Despite being free to download, most site users defer updating their site to the latest version, for fears of updates causing their site to crash.

Hackers take advantage of any vulnerability or bug in an older version and cause issues like SQL Injections, WP-VCD Malware, SEO Spam & other major issues like website redirecting to another site.

How do you solve this problem? When you see a notification about an update on your dashboard, update your site as soon as possible.

Pro tip: If you are worried about updates crashing your live website, you can first test the updates on a staging site.

4. Outdated WP Plugins and Themes

Similar to the previous point, hackers also take advantage of outdated, unused, or abandoned plugins and themes installed on websites. With over 55,000 plugins and themes that are available, it is easy to install a plugin or theme, even from unsafe or untrusted websites. 

Plus, many users do not update their installed plugins/themes to the latest version or do not find the updated version. This makes it easier for hackers to do their job & infect sites.

How do you avoid this problem? As with the core WP version, update each of your installed plugins/themes on your site regularly. Take stock of all the unused ones and remove them or replace them with better alternatives.

You can update your plugins/themes from your hosting account.

Pro tip: We suggest setting aside time every week to run updates. Test them on a staging site and then update your site.

5. Common Admin Usernames 

In addition to weak passwords, users also create common usernames that are easy to guess. 

This includes common usernames for admin users like – “admin”, “admin1”, or “admin123”. Common admin usernames make it easier for hackers to get into admin accounts and control backend files in your WP installation.

How do you avoid this problem? If you are using any such usernames that are easy to guess, change them immediately to a unique username. The easiest way of doing it is through your hosting account’s user management tool, by deleting the previous admin user and creating a new admin user with a unique username.

As the first step, change the default username of your admin user and limit users who have administrator privileges.

Pro tip: WordPress has 6 different user roles with limited permissions. Only grant admin access to users who really need it.

6. Use of Nulled Plugins/Themes 

Coming back to the importance of plugins/themes, users have access to many websites that sell nulled or pirated copies of popular and paid plugins and themes. While these are free to use, they are often riddled with malware. They can compromise your website’s overall security and make it easier for hackers to exploit. 

Being a pirated copy, nulled plugins/themes do not have any available updates from its development team, hence will not have any security fixes.

How do you fix this problem? Simple, for a start, only download original plugins and themes from trusted websites and marketplaces.

Pro tip: If you don’t wish to pay for paid or premium plugins and themes, opt for a free version of the same tools that will have limited features but are still safer to use than the nulled version. 

7. Unprotected Access to wp-admin Folder

To take control of your site, hackers often try to break into and control your wp-admin folder in your installation. As the website owner, you must take measures to protect your wp-admin directory.

How can you protect your wp-admin folder? First, restrict the number of users having access to this critical folder. Additionally, apply for password protection as an added layer of security for access to the wp-admin folder. You can do this using the “Password Protection Directories” feature of the cPanel in your web host account.

Pro tip: Besides these fixes, you can also implement Two Factor Authentication (or 2FA) protection for all your admin accounts.

8. Non-SSL Website

You can easily migrate your HTTP website to HTTPS by installing an SSL certificate on your site. SSL (or Secure Socket Layer) is a secure mode of encrypting any data transmission between your web server and the client browser.

Without this encryption, hackers can intercept the data and steal it. Plus, a non-secure website can have many negative implications for your business – lower SEO ranking, loss of customer trust, or a drop in incoming traffic.

How do you fix this problem? You can quickly obtain an SSL certificate from your hosting company or SSL providers. It encrypts all data that is sent from and received by your website. 

Pro tip: You can get a free SSL certificate from places like Let’s Encrypt, but these provide limit protection that will only be sufficient for a starter site or small site.

9. No Firewall Protection

Lack of firewall protection is another common reason why hackers can bypass website security measures and infiltrate the backend resources. Firewalls are the last line of defence against hackers and work like the security alarm installed on your house. Firewalls monitor web requests coming from various IP addresses, including the suspicious (or bad) ones. 

They can identify and block requests that are known to be malicious in the past, thus preventing easy access for hackers to your website domain. Web application firewalls can thwart various attacks, including brute force attacks, XSS, and SQL injections.

Pro tip: A firewall provides much-needed security and is  your first line of defence. But it’s important to also have a malware scanner installed.

10. Lack of WordPress Hardening Measures

Typically, hackers target the most vulnerable areas or weaknesses within a WP installation, to illegally access or damage the website. The WordPress team has identified these vulnerable areas and has devised a list of 12 hardening measures recommended for every website.

A few of these include:

  • Disabling the File Editor;
  • Preventing PHP execution in untrusted folders;
  • Changing the security keys;
  • Disallowing plugin installations;
  • Automatic logout of inactive users;

How do you implement these hardening measures? While some steps are easy to understand, others require the technical expertise of how WordPress works. 

Pro tip: You can implement hardening measures on your own. However, some measures require technical expertise so in these cases, it’s much easier and safer to use a plugin.

 

Featured image via Pexels.

Source


Source de l’article sur Webdesignerdepot

/par

Grab Free SSL Certificates From ZeroSSL

Like it or not, we’re slowly edging towards a two-tier web: those sites that are secure, and…everything else.

There was a time on the web, when we didn’t have SSL certificates, and lots of people’s data got stolen. To address the problem, and regain users’ trust SSL certificates were introduced to secure sites handling sensitive data. And because they were initially a niche technology, you paid through the nose for them.

(An SSL certificate, for those that don’t know, is the difference between http:// and https://)

Then, thanks in part to privacy initiatives, and in part to high-profile data breaches, a few big players decided that all data should be protected. And the next thing you know, Google’s using SSL certificates as a ranking factor. And then suddenly browsers are warning people that non-SSL certified sites are insecure and they should “Get Out of Here!” And before long your hobby blog about cat-friendly board games is being billed hundreds of dollars a year just to be seen on the web.

Choosing whether to jump on the SSL bandwagon is simple: you have to have one. Finding an affordable SSL certificate, now that’s a challenge.

Most hosting companies will provide you with an SSL certificate as an add-on, and they’ll charge you anything up to $200 per year for it.

That’s why we’re blown away by ZeroSSL, because ZeroSSL is the first practical opportunity to grab an SSL certificate for your site, for free!

Get an SSL Certificate for Free

Now, it must be said that ZeroSSL isn’t the first place to offer a free SSL certificate. Plenty of hosts offer a “free” SSL certificate for the first year, when you pay for premium hosting. And there’s Let’s Encrypt which offers free certificates if you can work out how to access them.

ZeroSSL is just the first place to offer a genuinely free SSL certificate that you don’t need a post-grad degree in server engineering in order to use.

Get a Free SSL Certificate from ZeroSSL

Using ZeroSSL’s free-forever plan you can register three 90-day certificates entirely free. You’ll never need to pay for them, just renew every few months.

ZeroSSL also offers a variety of packages for simplifying your SSL management. The Basic package for example starts at $8/month and offers unlimited 90-day certificates, and even three 1-year certificates so you can renew annually and forget about them the rest of the time.

ZeroSSL also scales; if you need unlimited 1-year certificates — because you have, erm, unlimited websites? — that’s possible too.

Where ZeroSSL Excels

ZeroSSL offers a number of benefits over its competitors.

Firstly there’s the full-featured management console, that makes SSL management transparent. It sounds like a little thing, but with many other suppliers the first thing you know about your SSL certificate expiring is your site breaking.

ZeroSSL…makes managing your certificates…insanely easy.

ZeroSSL has an easy-to-use REST API, which can be used with the language of choice: PHP, Ruby, ASP, anything. It makes managing your certificates for multiple sites insanely easy.

Verifying SSL certificates can be confusing, and technically difficult. But ZeroSSL streamlines the process with automatic CSRs and one-step email validation (even for multiple domains) — considerably faster and easier than industry standard DNS validation. There’s even a one-click check to make sure your certificate is installed correctly.

Most importantly, ZeroSSL offers superb technical support on all of its paid plans. So if you’re one of the many people who started reading this post without fully understanding what an SSL certificate is, you can be confident that if you run into difficulties getting set up, there’s someone available 24/7 to dig you out of the hole.

Getting Started with ZeroSSL

If by now you’re planning to try ZeroSSL, the best place to start is the free-forever plan. ZeroSSL allows you to upgrade, downgrade, or cancel at any time, so it makes sense to start with the no-credit-card option and upscale if you need it.

Using ZeroSSL’s dashboard you can create a free 90-day SSL certificate in minutes, and the step-by-step installation instructions will guide you all the way through.

ZeroSSL’s 1-year certificates are the gold-standard of SSL protection

ZeroSSL auto-generates certificates in different formats depending on your choice of platform, to speed up installation.

You can register certificates for multiple domains — you will have to verify each domain individually, but it’s simple to setup. Premium plan users can even use wildcards, allowing you to secure a site with multiple sub-domains, from a single certificate.

ZeroSSL’s 1-year certificates are the gold-standard of SSL protection and are the option that most site owners will come to rely on.

If you’re running an agency and you’re responsible for maintaining multiple client sites, ZeroSSL is made for you. ZeroSSL’s dashboard gives you one central location to monitor the status of all of your SSL certificates, and you can set expiry reminders to notify you by email when a certificate is about to expire.

Automated SSL Renewal with ZeroSSL

If that sounds too much work, and you’d like to automate your SSL certificates, ZeroSSL has you covered.

ZeroSSL works with both its own dedicated ACME Certbot, and more than ten other third-party ACME clients to fully automate your SSL certificates absolutely free, on a rolling 90-day schedule.

If you really know what you’re doing, you might even consider the ZeroSSL’s REST API. It enables certificate creation, validation, renewal, and management using HTTPS Get calls and JSON responses. The API handles millions of requests per month using 256-bit bank-level HTTPS encryption. You can access the API for free, and the Pro plan offers unlimited access.

Go Get Certified

There are millions of sites that drop traffic every month because they lack an SSL certificate.

Whatever your site, it’s not a question of whether you need an SSL certificate, it’s how you can affordably manage to create, install, and monitor a certificate.

ZeroSSL solves all of the problems of SSL certificate management, and for the majority of users, its free-forever plan is all you’ll ever need.

Head over to zerossl.com today to boost your traffic with a free SSL certificate.

 

[– This is a sponsored post on behalf of ZeroSSL –]

Source


Source de l’article sur Webdesignerdepot

/par