How WordPress Sites Get Hacked
- 1. How WordPress Sites Get Hacked (And What You Can Do About It)
- 2. How Many WP Sites Have Been Hacked? • In 2012, more than 170,000 WP sites hacked • In January 2017, 1.5 million WP sites hacked • WordPress silently patched the issue, an unauthenticated privilege escalation vulnerability in a REST API endpoint, with v4.7.2
- 3. Why Would Anyone Want To Hack Your WordPress Site? • Hacking attempts are a matter of opportunity • Most hacking attacks are automated • But what’s in it for them? • Drive-by-downloads • Redirections • System Resources
- 4. How Do WP Websites Get Hacked? • 41% get hacked through vulnerabilities in their hosting platform • 29% by means of an insecure theme • 22% via a vulnerable plugin • 8% because of weak passwords
- 5. How To Keep Your Site Safe 1. Choose a high quality hosting provider • Latest versions of PHP and MySQL • Perform regular scans for malware and daily backups • WordPress-optimized environment • Knowledgeable staff
- 6. How To Keep Your Site Safe 2. Perform Regular Backups • Duplicator • UpdraftPlus • WordPress Backup to Dropbox • BackupBuddy (paid) • VaultPress (paid) • CodeGuard (paid) • BlogVault (paid)
- 7. How To Keep Your Site Safe 3. Fortify Your Login • Force use of strong password • Store passwords securely (LastPass) • Don’t use admin • Limit login attempts • Employ two-step authentication • Hide your login page
- 8. How To Keep Your Site Safe 4. Keep WordPress up to date 5. Maintain Themes and Plugins 6. Reset Salts 7. Set a unique table prefix 8. Hide WordPress version number 9. Set correct file permissions 10. Turn off PHP Reporting
- 10. iThemes Security (free version) • One-click “Secure Site” • Ban Bad Users • Block IPs or User Agents • Hide Login and Admin • Away Mode • File Change Detection • Turn off File Editing • Reduce Comment Spam • Brute Force Protection • Strong Password Enforcement • Malware Scans
- 11. iThemes Security (paid version) • Two-Factor Authentication • User Action Logging • Password Expiration • WP Core File Comparison • Scheduled Malware Scans • Temporary Privilege Escalation • User Security Check • Google reCAPTCHA Integration • Settings Import & Export
- 12. WordFence • Web Application Firewall • Real-time Threat Defense Feed • Malware Scanner • Repair Files