Hacks on WordPress, reported last year, aren’t any less to be ignored and most of them are attributed to websites missing out on version upgrades. Core, plug-ins when not up-to-date or when insecure or when not rightly configured contributes to hacker attacks on the site. Don’t be surprised to know stats from the WPScan Vulnerability Database that says more than 50% of the vulnerabilities (1570 on 2407) are ‘just unique’ ones! How to improve the security for WordPress/ prevent hacks on WordPress? Read on.
- Stop using the default admin account because most hackers guess it! Make sure to provide a different username during WordPress installation or make it unique if you already have a weak username.
- Prevent comment spam by disabling comments after 30-60 days of the blog posted date. A huge number of WordPress sites get affected by comment spam and become irreversible losing a lot of information. To edit a WordPress post, disable “Allow comments” from the Discussion Meta Box. To disable comments for the entire site, get into Discussion settings and switch off the checkbox allowing people to add comments on new posts.
- Remove the login link by getting into Appearance within which Editor followed by Footer.php and removing the link here where you have defined the Copyright.
- Ensure WordPress is up-to-date because anyone can easily modify the source code, it being an open source tool. Every time vulnerability is reported, WordPress fixes it in its next version; no wonder you don’t update the version and then you get attacked! Getting the new features, higher speeds, better or newer compatibility with add-ons are other good things you crack by being updated.
- Make sure to report the security issues or bugs on WordPress immediately. To prevent the damage spreading across more and to release a quicker fix, every security issue is ought to be reported to the WordPress core development team immediately.
- Don’t leave the file permissions or write access open! Wp-admin/options.php should be owned by you and permissions set to 644.
- WordPress security plug-in is highly necessary. Don’t miss to have it and limit the attempts of login! Certain attacks simply try username/passwords repeatedly and gets in somehow. Limit login set up blocks the IP temporarily and stops consecutive login tries. Extra protection by captcha and redirection to home page on abnormal requests are to be taken care inclusively.
- 2 step authentication is powerful than just a single step. 2 factor auth plug-in restricts anyone from having access to the site without being able to access user’s mobile phone or mail box. Generating OTPs using apps like Google Authenticator is highly recommended. For slow mail servers, go with HOTP; for better servers choose TOTP which is the better one.
- Ensure the pc is not affected by any malware.
- Ensure the site is on a secure hosting of WordPress.
Having the right CMS/content management software/ content management platform for content update on the website, having a responsive web design or a responsive website is highly important in terms of making more conversions. But then if you lack in the basic security checkpoints, what’s the point in having all the other features; you become the hacker food quite effortlessly! If you believe you require an enhancement to the WordPress Security or any assistance with regards to ecommerce services, contact us at QeHTML right now!
Menu
