It often happens that websites are hacked. It is a lot of work to restore a website. You should protect your website but how do you protect your website from hackers? To protect your website from hackers, you can install WordFence, avoid bad usernames, update frequently, and take regular backups. In this article, we’ll go through everything you need to know.
Make sure to protect your website from hackers. If you have a business that is dependent on the website, then you can be hit very hard by a hacked website. In the worst case, you could lose their entire business.
Protect your website and prevent problems before hackers take over yours or damage parts of the website. There are both simple and more advanced measures you can take to stop attempts to get into the site’s code and destroy.
Protect the website with wordfence
A plugin to use in WordPress is e.g. WordFence. The plugin is constantly updated and stops your website from being hacked. It is free to download and use.
There are many reasons why hackers want to access your site. They may add malicious code to your site or add links to other websites. You need extra protection!
With WordFence, you can schedule scans and receive notifications by email in case something happens to your website. If you receive a security message, be sure to fix the problem to keep your website secure.
It’s important to update plugins, your theme, and WordPress. They are continuously updated to improve both security and functionality. Not updating exposes you to unnecessary risks. An updated website has an easier time escaping hacker attacks than one that uses older versions of themes, plugins and WordPress. Bugs and security holes in older versions are more well-known and exploited by hackers. But if you update regularly, you have at least done what you can to counteract them.
Admin as username
Do not select “admin” or “test” as the username for the administration pages on your WP website. It’s easy to guess. Use something that does not make it easier for the hacker.
Backup your website
Make a backup of both the layout and the database. You can e.g. use the WordPress Backup to Dropbox plugin. At many web hosts, you can buy the backup service.
In addition to protecting a website, it can also be good to take backups on it regularly. Should the accident still occur, there is actually a chance to find out what was on the website earlier!
The best plugins for WordPress and security
Today, a large part of the websites on the internet are run by WordPress. This means that you must try to keep it as safe as possible. Below we will go through security add-ons for WordPress that we like.
Loginizer – Brute force extension
Loginizer is a good addition to fight bruteforce attacks by blocking ip addresses after that particular ip address has made a number of attempts and failed to log in to the website via the WordPress control panel. You can easily add IP addresses to the secure list (white) that are always skipped or to the blacklist so they are always blocked.
All In One WP Security – All in One security add-on
All-in-One WP Security is a good security supplement as it basically has everything you need.
This add-on helps with most things like keeping track of secure usernames and passwords. And that they protect against brute force attacks, spam protection and firewalls. It also comes with a great introduction so that with the help of the add-on in a step by step intro helps to improve the security.
Sucuri Security – Scanning tool
If you need a security tool that scans your website for malware or other types of bad files, Sucury Security is the add-on you need! An effective security add-on for WordPress that simplifies scanning and overview of files. There is also a premium firewall available if you purchase the add-on and not just use the free features.
Keep in mind, however, that sometimes these programs warn of files that have been updated so you still need to review so that everything is correct.
Wordfence – Firewall and scanning for malware
A fairly popular security extension for WordPress is Wordfence. An add-on and program that scans the website and protects with a firewall. It blocks traffic that is perceived as spam and attempts to break into the website. A really good addition to the security on the website and in the premium version, you can have “real-time” tracking and blocking as well as many other premium functions.
The scanner examines e.g. the basic files in WordPress, themes and add-ons against malware as well as bad urls, backdoors, spam and virus-like code that can redirect traffic and urls to bad places on the internet.
Akismet Spam Protection – Protect your website from spam
If you have a website with many posts and articles, Akismet is a must. It protects by checking comments and other spam against its lists before they are let through and automatically removes spam posts on the site. In addition, there is also a cleaning function so you can easily remove lots of spam.
Ithemes Security
iThemes Security is an add-on that claims to have 30+ ways to secure your WP site, and that it can protect it from attacks. It strengthens user information by fixing common vulnerabilities and automated attacks.
The extension has both a free and premium version and contains the following:
- Two-step verification
- Brute force protection
- Monitors source files for changes
- Customer service (for premium users)
- Logs user activities
- Locks out users in case of too many login attempts
- View user roles and file permissions are password protected
Sucuri Security
This add-on is free in WordPress repositories and includes malware scanning, security activity auditing, blacklist monitoring, effective security hardening, file integrity monitoring and a firewall on the website. It is simply a security package that is intended to complement your security position.
The Sucuri extension monitors all activities on your website, such as e.g. when users log in or change something on your site. If someone infringes, you can see it in the activity logs to investigate what went wrong
BulletProof Security
Another popular WordPress extension that helps you secure your site is BulletProof Security. This extension offers a one-click security solution. It protects your website from RFI, XSS, CRLF, SQL injection and code injection hacking.
BulletProof Security has a wide range of great features and functions that protect your website, but here are the most important:
- A simple one-click installation
- A register of the number of login attempts
- File monitoring and quarantine of uploaded files
- Email notifications for a variety of user activities
- Notice when suspicious malicious activity affects your site
BulletProof Security is available in both free and paid versions, which in addition to the above also offers more advanced functions for your site’s security.
WordPress is the world’s most used tool for building websites. There are thousands of themes and extensions to WordPress which gives a great breadth of functionality and appearance.
Has your website been hacked?
If you have a website that has been hacked, you can today seek help from several providers and web agencies. Most can help to restore it but they usually need to scan files and go through extensions etc. which can take its time.
It is important that the website is on a good server running a newer version and that there is some form of protection on the server. Then you have a good security from the beginning which together with the add-ons above provides good protection against most types of attacks.
So if you are looking to run a website, website, web system or e-commerce then you should first choose a good server that has a good basic protection.
When you then have the website up and running, we think you should definitely review your extensions and install one or more of the extensions above. They help keep security high on your website!
Today, 26% of all the world’s websites are created in WordPress (WP). The popular blogging platforms support from regular blogs to complex business websites. Due to its popularity and breadth, many hackers and spammers are interested in breaking the security of WordPress sites.
Basic security
If you have secure passwords and updated software on your site, you already have a more secure site than the majority of all WordPress sites. It is also important that you have an antivirus program installed on the computer you connect to its site from, so that your password is not intercepted by any viruses present on the computer.
Use secure passwords
Hackers’ methods of cracking passwords are constantly becoming more sophisticated, which increases the requirements for password design. A good password should be long, unpredictable and not consist of familiar words.
When you change your password in WordPress, there is an indicator of how strong the password is. This can be a good guide when choosing a password.
A recommendation is also to periodically change the passwords on the page, as well as to delete users who are no longer used on the page.
Uninstall extensions / themes
Security holes in additions and themes account for the majority of entrances hackers use to access a WordPress site. One way to reduce this risk is to have as few themes and add-ons as possible installed on the site. Uninstalling extensions can also often make your WordPress page run faster as it has fewer features to load.
As for themes, there is no need to keep installations of themes you do not use. These only pose an unnecessary security risk as long as they are still installed. You uninstall themes in the admin panel under “Appearance”> “Themes”.
The same goes for disabled activations. These are uninstalled under “Add-ons” in the admin panel. Often you also have enabled add-ons that provide features that are not used. These can advantageously be deactivated and uninstalled.
For the add-ons that you actually want to keep and use, make sure it has reputable publishers who regularly release updates. This takes us on to the next point.
Keep the page updated
Security holes are regularly discovered in WordPress and the extensions and themes available. Usually, when this happens, developers are quick to release an update that closes this security hole. It is then up to you as the site owner to install these updates on your site. If this is not done, leave the door open for hackers to exploit these security holes to gain access to your site.
However, WordPress updates are mostly very simple and can be done manually from within the admin panel. Feel free to have a routine to log in and check the updates a few times a month.
You can also use extensions to automatically update the installations on the page. There are several such. An example is Simple Automatic Updates.
Note that there is a risk that things on the page will stop working as you update. However, it is always recommended to keep the page updated, as a potential intrusion on the page can be many times devastating.
Do not use “admin” as your username
If a hacker try to log in to your site, he needs to know both your username and password. If you use “admin”, or any other common username, the hacker already knows half of the information required to log in.
For the same reason, do not display your username on the page. In the profile settings in the admin panel, you can set it so that, for example, “First name Last name” is displayed instead of your username if, for example, you publish a post on the page.
Why is it important to make WordPress secure?
WordPress is one of the largest blog platforms, which means that it will also be a major target for hackers.
In addition to the risk of losing all your content if you are exposed to an intrusion, it also affects the traffic to your blog. It is common for perpetrators to post bad links from your site in the event of an intrusion, which leads the search engines to lower the value of your domain. With this, it will be difficult to rank high with your keywords again.
So let’s go through some simple steps you can take to secure your WordPress blog.
1. Keep WordPress, themes and extensions up to date
The first thing you should do is update WordPress if you have not already done so.
- Keep WordPress updated
- Make sure you have the latest version of WordPress
Occasionally, new versions of WordPress are released that may contain important updates that clog security holes. Therefore, make sure to update to the latest version as soon as possible as it increases the security of your blog.
There are hundreds of thousands of themes and add-ons for WordPress and it is very likely that you have installed one of these. Just like with WordPress, it is also very important that you keep these updated. I usually wait a couple of days until I see that the extension or themes are supported by the new version of WordPress.
Keeping WordPress, themes and plugins up to date is one of the best things you can do to increase the security of your blog.
2. Use strong passwords and usernames
A very simple and effective method to protect against intrusion is to use strong passwords and usernames. A username like admin is common and is therefore something that hackers try first. Instead, use a username that is less common – preferably with a mixture of small and large characters and numbers.
When it comes to passwords, the same principle applies as above to increase security. Today we have many digital accounts to keep track of and it will be easy to use the same password for most things. This is one of the biggest mistakes you can make. If a hacker accesses your password on, for example, Instagram and you have the same password on Facebook and Twitter; then the person suddenly gets access to all your social media.
Using strong passwords and usernames applies not only to WordPress but also everything around. It can e.g. be login details to your web host or FTP.
3. Choose a well-known and secure web host
A secure blog depends not only on WordPress but also on which web host you use. The web host is the server where your files and database are stored for your blog to be visible on the internet.
A good web host should:
- Monitor traffic for suspicious activity
- Keep software on the server up to date
- Have protection to stop certain types of attacks
If you currently use a lesser-known web host for your blog or are dissatisfied with security, you can move your WordPress installation.
4. Regular backups
One of the best things you can do is save regular backups of your blog in case of an intrusion. With a backup, you can quickly restore your blog after regaining control of your site.
There are many add-ons for WordPress to help you with backups; two examples are VaultPress. and UpdraftPlus.
How often you should save a backup depends on how often you publish new blog posts. A practice is to save a backup every time you have published new content on your blog.
Be sure to save your backups in a place that is safe from possible intrusion (ie not on the same server as your blog). One piece of advice is to save them to a cloud service such as Dropbox or OneDrive.
5. Use SSL for secure data traffic
Today, it is common for websites to use Secure Sockets Layer (SSL) for secure data transfer. In the past, SSL was basically just a must for websites that handled sensitive data such as bank card or personal information.
An SSL certificate encrypts the data sent between your website and your visitors, which leads to increased security for both you and your visitors. A secure and encrypted website is usually indicated by a padlock in your browser.
In addition to security, SSL is also a contributing factor to increasing your ranking on Google because the search engine values secure websites before unsafe ones.
To make your blog more secure, there are a number of different ways to enable SSL:
- Activate via your web host
- Activate via the free service Let’s Encrypt
- Manual installation via a company that offers certificates
Today, there is no reason not to use SSL to secure WordPress as it is often included in your web host or can be installed for free.
6. Increase security with plug-ins
There are many security aspects when it comes to your blog, including; monitoring of suspicious activity or file changes, virus scans, and security alerts.
A popular security add-on for WordPress is Sucuri which does just that for you. You can install it directly from the WordPress administration panel or manually from the official download page.
7. Have a general safety mindset
Last but not least, I would like to suggest having a general security mindset with how to use your computer. Make sure you have a good anti-virus program installed as well as a firewall (the built-in firewall in Windows works well).
Save your passwords securely and do not visit websites that may contain malicious code. To further protect yourself against malicious code, you can use an add-on such as NoScript or AdBlock in your browser.