How to NOT keep your WordPress site secure
WordPress is by far the most popular platform for building websites. WordPress offers such a wealth of options for a small business that it is almost a no-brainer to use WordPress. Because of its well deserved popularity, WordPress is also a prime target for hackers and cyber threats. To keep your WordPress site secure, it’s essential to avoid certain common mistakes that can leave your site vulnerable. In this article, we’ll discuss the top four things you should avoid for WordPress security.
Last month, we wrote a blog about the top things to do for WordPress security. While a lot of the topics covered in this list are the exact opposite of that other list, WordPress security is such an important topic that it deserves its own blog.
Using Weak Passwords
Possibly the most common mistakes that any website administrator makes on their site is using weak passwords. I know you have heard this before but I’ll say it again: “password123” IS NOT A STRONG PASSWORD! Having a simple password makes it far too easy for hackers to guess, therefore leaving your site vulnerable to unauthorized logins. To improve your WordPress and website security, use passwords that are at least 12 characters long and include a combination of lowercase letters, uppercase letters, numbers, and special characters.
The reason that it is so important to use a strong password is because of the brute force attack scripts that hackers will use to attempt to break into your site. With these brute force attacks, the script will be guessing username and password combinations at the rate of billions of times per second rate. If your password is simple “password123” and your username is your email or first name, the odds of that being cracked immediately skyrocket. With a strong password, the security plugins will be able to detect the brute force attack and keep the hackers out.
Neglecting Software Updates
WordPress regularly releases updates for its core software, themes, and plugins. In these updates, the developers will often include security patches to recently found vulnerabilities. If you opt to not run these WordPress updates your WordPress installation can leave your site and business susceptible to attacks. A beauty and a curse of WordPress is the open source nature of the system. With this, hackers can get access to the code very easily to find the vulnerabilities they need to sneak their way in. By running these updates, those ways get blocked and patched up.
It should be at least part of your weekly habit to regularly check for updates. When there are updates available, be sure to install any updates right away. With some content management systems (CMS), if you miss an update it can be tough to pick things up again and continue on. With other CMS options, if you miss an update to version 6.5.4, for example, upgrading to 6.5.5 might not be too easy. While with WordPress that is often a very easy upgrade to do, the security vulnerabilities make that a less than ideal solution to use.
Not Installing a Security Plugins
Among the many, many, many WordPress plugins are several phenomenal security plugins. While the basic “out of the box” WordPress is not the most ideal security platform, these security plugins can significantly elevate your site’s security. These plugins provide features such as firewall protection, malware scanning, login attempt monitoring, and more.
These security plugins are in a way similar to setting guards outside of a castle. The guards detect anything suspicious and provide that first line of defense to the castle. Without those guards out front, an enemy could much more easily approach and storm a castle. The same is true for your website. By having a security plugin, there is no guarantee that hackers will never get in. What it does provide though is a very strong line of defense. These plugins can also alert you to issues happening on the site in real time (such as a brute force attack) and buy you some very valuable time before things go bad.
Not Backing Up Your Site Regularly
If you do partake in any of the above weak security measures, regular backups can be a last line of defense to get your site back up and running quickly. In a worst case scenerio where there is a data loss in case of a security breach, server crash, or website malfunction, these backups can be put in place within minutes. Failing to backup your site regularly can result in permanent loss of valuable data and content. Set up automatic backups or create a backup schedule to ensure that you can restore your site quickly if needed.
Ideally, these backups should be stored in a place that is easily accessible. At Full Scope Creative, all of the WordPress backups we manage are stored on an external hard drive that we can quickly and easily get to. If your hosting is done outside of the office with serves such as Amazon, be sure to keep that login information readily available so that the backups can be put to use immediately.
Prioritize WordPress security
If your business truly prioritizes WordPress security, you’ll be sure to avoid the common pitfalls of using weak passwords, neglecting software updates, ignoring security plugins, and not backing up your site regularly. By implementing these best practices, you can significantly reduce the risk of security incidents and protect your WordPress site from potential threats.