Protecting your WordPress Website from Threats

Your website is probably run on WordPress. You are not alone if this is case. Millions of others also use this very user friendly CMS to keep their blogs and websites in order. This website is also run on WordPress and over the last 6 years, I have not only been a WP developer, I have been a strong advocate of it to others.

As great as it is, and I can go into a whole other article just raving about it, it is also no secret that there are some major security weaknesses in a WordPress site. If you have a website that generates more traffic than usual, chances are, you are at risk for an attack and unless you are a web security wizard (I for one, am not), then you can be looking at potential hours and even days trying to fix it.

One of the most common attacks is malware. Someone finds a way in and places links all over the place to get their individual hit count up. The next thing you know Google is putting up a red page warning to anyone that visits your website and your reputation as a web developer is now in question. This is embarrassing and very annoying and can cause a lot of panic and alarm to not only your clients who frequent the website but to their clients who visit the site as well.

This has been the case for me personally as I had this happen with one of my larger clients that happens to be a Fortune 500 company. One day everything is running smooth, the next our office is getting blown up by multiple members of their board with complaints all the way down the line questioning why there is an ad for Viagra on their non profit page. We were in the midst of trying to secure another large client when this hit the fan and had to spend the entire week not only uploading backups and securing the site (changing passwords/entry pages) but also playing damage control with their board. Needless to say, we lost the opportunity on the new business.

“Another popular attack is something that is known as a brute force attack. This attack is simply a program that attempts thousands of different username and password combinations until they successfully gain entry into your website. From there, it is anyone’s guess what they will do once they are in. Even if you set up your website to block certain IP addresses after a number of failed login attempts, they will simply change the IP address and try again. The easiest and simplest way to protect against this is have your username be something other than “admin” as well as have a password strength over 16. You can generate such passwords here. Another easy technique that will require a plugin if your not technically savvy enough to do so, is change and/or hide the name of your login page. Instead of having “wp-admin,” you can easily change this just about anything else. This alone should ward off the mass majority of these automated attacks that seek that page first.

Knowing first hand what these attacks can do to your reputation, I listed a couple free plugins that can go a long way in preventing them. They’re not perfect and they certainly can’t stop everything that comes at you but they can go a long in making it hard for someone to breach your website.

One of the best free security plugins that you can get for WordPress is the iThemes plugin (formerly known as WPSecurity). It not only helps you hide your admin login page like I mentioned above but it also helps helps with blocking out IP addresses with multiple failed attempts and a bunch of other cool features.

Another great plugin is the Anti-Malware and Brute Force Plugin by ELI. This effectively scans your whole website including your wp-content folder for malware and eliminates any malicious code.

Nothing will completely secure your website from hackers and malware as they will always be finding new ways in. The best thing you can do is make your website as less vulnerable as possible by keeping your plugins, themes and WordPress updated .