Why Add Security Monitoring
WordPress is one of the most popular web platforms on the Internet today. With millions of web page views every month, it’s simply too popular for hackers to resist. They work hard to find vulnerabilities in WordPress, servers, plugins, and in themes. Most of your security measures will be effective (even the basic security measures). But to minimize potential loss and downtime in the event of a breach, consider subscribing to a security monitoring sevice that will immediately alert you to any threats.
In the same way a building security monitoring service reduces threats and gives you peace of mind, website monitoring companies like Sucuri will monitor your WordPress website 24/7. But Sucuri also goes one step further. If your website is infected by a hacker, they will fix the damage and restore your website.
In this article, I want to outline some of the more common types of security vulnerabilities that WordPress faces. Even a brief introduction to these vulnerabilities is enough to demonstrate how impossible it is to manage these threats on your own.
In addition to adding a security monitoring and repair service like Sucuri, I will suggest a few preventative measures you can take.
Pharma Hack: An oxymoron?
It sounds healthy…but it’s not! A hacker who gains access via a “backdoor” (a vulnerability in a file or database) can inject website URLs (often links to pharmaceutical sites selling popular drugs like Viagra) into your website to make search engines rank their sites higher.
One big problem with this type of hack is that the URLs are not visible to most visitors (unless you are a search engine like Google). And they can be difficult to find. Furthermore, they can be difficult to clean thoroughly. Often the problem recurs.
Fixing the problem involves a tedious process of cleaning your computers and checking your web hosting server, changing passwords and sensitive file information, restoring a clean backup, and getting back on good terms with search engines.
Best preventative measures for Pharma Hacks
Keep WordPress, plugins, and themes up to date.
Brute Force Attacks
Like a safe-cracker testing various combinations until the lock is opened, brute-force attacks are usually performed by custom hardware and software systems which perform complex algorithms to “guess” thousands of name/password combinations. The easier the username and/or password, the faster these systems can get in.
Worst-case scenario: they guess your password, login as an Administrator, and lock you out.
Best-case scenario: (not that this is much better!) the huge number of requests on your web server causes it to slow down, which may result in your hosting provider shutting down your site temporarily.
Either case (or anywhere in between) is a disruption to your business.
Best preventative measures for Brute Force Attacks
Enforce strong passwords for every user. Add WordPress login security like two-factor authentication and limiting login attempts.
Denial of Service (DoS) or Distributed Denial of Service attacks (DDoS)
I once noticed a website I manage that seemed to be a bit slow. When I logged in to check things out, it got worse.
Eventually I received an error message that the site could not be accessed due to too many resources being used. Further investigation revealed that a hacker was attempting a “denial of service” attack by targeting a specific file.
Fortunately, the attacker was not able to get into the site to cause damage (because I keep the files up-to-date). But the activity was enough to shut the website down temporarily.
I found the attacker’s IP address and banned it from the website. The problem was that it was not just a single IP address (DoS); the hacker used multiple IP addresses distributed across multiple networks (DDoS). It took some time and some targeted blocking, but eventually they went away. Very annoying and time-consuming.
Best preventative measure for DoS or DDoS attacks
Limit login attempts. If the attacks persist or slow your website too much, consider purchasing a web application firewall (Sucuri also offers this service).
SQL Injection
If the word “injection” conjures up frightening images of rolling up your sleeve at the doctor’s office, your fears are appropriate for SQL injections.
In this type of attack, hackers who are able to gain access to your MySQL database (used by your WordPress website) “inject” their own information into your database.
Why would they do this? Well, hackers who gain access to an SQL database can inject their own code in order to perform functions for their own benefit. SQL (Structured Query Language) is simply the code language used to communicate messages to your database (where critical website information is stored).
What can be injected? Things like new Admin accounts or links to other websites. Not good. They might not affect the function of your website, but they can affect the performance. And slow performance can affect your ability to serve your customers and find new ones.
Best preventative measures for SQL Injections
Keep WordPress, plugins, and themes up to date. Enforce strong passwords for every user. Change all passwords (including MySQL database) frequently. Limit login attempts.
Remote File Inclusion
As the name implies, a hacker who gains access to your website can include their own files which can then execute code to distribute malware or perform some other malicious intent. Under such an attack, a hacker can potentially deface your website and include their own images and text. They could also steal sensitive information. Probably the most famous RFI attack on WordPress came in 2011 when a vulnerability was exploited in the TimThumb plugin.
Best preventative measure against remote file inclusions
Keep WordPress, plugins, and themes up to date.
One final word of advice. As scary as all this can sound, don’t panic. If you are following standard security measures, you are generally safe from the most common threats. And if you have a security monitoring service covering your back, any damage done to your website will not be permanent.
Sources
WordPress Security White paper
Malware Monitoring, Security Scanning and Incident Detection
Learning about WordPress Security
About Steady Digital
We provide a WordPress maintenance plan to ease concerns like:
- Is my website performing at peak performance so visitors get the best experience possible?
- Do I have regular backups of my website in case something happens to my web server?
- What if my website gets hacked?
- How can I get up-to-date, professional training so I can use my website better?
- Who can I trust to do the updates that are beyond my technical or creative abilities?
Tired of trying to maintain your own website? A WordPress maintenance plan might be the solution for you.
* Denotes affiliate link. If you a make a purchase through these link, I may receive a commission. You will not pay more by clicking these links; the partner company pays the commission for recommending them to you.
