This video was brought to you by 10Web, an automated WordPress platform designed for
agencies. Automate hosting, speed optimization, migration, site-building, and management, and
skyrocket your agency growth. Sign up for a 14-day free trial, and experience through automation.
People don't want to be insecure, and neither do websites. So let's discuss what you can
do to make your WordPress website secure. First of all, is this goal even achievable?
Aren't WordPress websites easy to hack by default? Well, that, my friends, is a common misconception
that stems from the fact that WordPress is the most popular CMS out there. And if there are
so many WordPress websites out there the chance of some of them being hacked is of course high.
So next time somebody tells you some stats about WordPress-related security breaches you know what
to tell them: the market share of WordPress is at least 45%. And a WordPress website can be quite
secure if you do everything in your power to protect it from common vulnerabilities.
As the old maxim goes: you have to know your enemy well. And hacker attacks are not typically very
inventive. No offense to any hacker watching this video, but most of them are pretty repetitive and
fall into 7 typical categories. So let's go over each one of them and get to know their mechanisms.
Malware or malicious software is the third most common WordPress vulnerability. It's when hackers
use spyware, trojans, viruses, and phishing to get unauthorized access to your website.
One recent example of cybercriminals using malware to get ransom is Covidlock. Using
people's fears and the general uncertainty around the virus the hackers installed
malware on many users' computers promising to give them more information about Covid.
And what happened then is that that malware locked them out of their Android devices and returned
access only after they paid $100 of ransom. Backdoors is the second most common WordPress
vulnerability. this is when hackers exploit the back doors of a website
to try to find an alternative way to access it and this usually happens
when a user ever needs reparation services. The next one is Pharma hacks. And Pharma hacks
are all about big pharma controlling the government and your website in particular.
Just kidding! this is all about adding a bunch of viagra links to your website.
So this happens when WordPress documents get injected with a bunch of code
and the hacked website then starts to display links to another website.
This hack is usually done to bump up the linked website in Google
search and thus boost their conversions. What can I say... go hard to go home, guys
Usually, if something isn't working out we try a different approach, instead of doing
the same thing over and over again, right? But computers are a lot faster than us
and in their case sometimes it does pay off to keep trying and trying and trying,
and that's how brute force attacks work. Brute force attacks are the most straightforward
way to hack a website. So if a 2-factor authentication isn't on on that website hackers
can write a code that will try out different login password combinations until it gains access to it.
Then there are malicious redirects. This is when a hacker adds a piece of script
into a website's code that redirects the visitor to another website, and that website
will usually either try to scam the oblivious visitor or infect their computer with malware.
Cross-site scripting or XSS. This is a very common form of attack where hackers inject
client-side script into the code of trusted websites to exploit the permissions they have.
Here's how it works. First, a perpetrator discovers a website having a vulnerability
and enables script injection. Then the perpetrator injects the website with the
malicious script that steals each visitor's session cookies. So every time a website
visitor opens the website the malicious script is activated and the visitor's
session cookie is sent to the perpetrator. Another pretty common type is denial of service
attacks. This is when an artificially generated surge in traffic directed at a specific website
overwhelms the server and the website crashes. A great example of this was in 2008 when
CNN commentator Jack Cafferty claimed that Chinese products were quote-unquote "junk" and the Chinese
were "basically the same bunch of goons and thugs they've been for the last 50 years".
Needless to say, this upset and offended a lot of people in China and not only in China.
And in response to this, a huge DDoS attack was launched at cnn.com, and this wasn't fun for CNN.
Now, knowing all of this, what can you do to protect your WordPress website from
these vulnerabilities. Here are the six steps you can take to turn your website
into a cyber-resilient and uberprotected monster. Look we can discuss all the additional precautions
you can take and stuff but high-quality hosting with super-secure network is the cornerstone
of your website security. And no matter what additional steps you take shared hosting security
level will always leave you wanting more. Imagine sharing a room with Al Capone's
whole gang or a chemist trying to make mice immortal using some explosives.
Would you feel safe? And with so many great hosting options available at a very affordable
price nowadays you really have no excuse. A fantastic option security-wise is 10Web - the
first and only provider of automated WordPress hosting. And what does it entail? First and
foremost, it entails extremely secure and reliable hosting, based on Google Cloud for just $10
per website. Our hosting's new-gen infrastructure will strongly protect your website and your site
will get a 90+ page speed score for both mobile and desktop automatically. On top of that,
your website will enjoy real-time backups and 10 automatically generated backup points,
so if anything happens, you can just restore your website to an earlier version with a click.
10Web also takes care of possible DoS attacks by limiting login attempts automatically it also
includes the option to schedule regular security scans that will reveal malware and unauthorized
changes to the website. 10Web also includes a free SSL certificate with all of its plans,
so you can ensure the safe transfer of data. And because site migration is free and automatic too
you can see 10Web hosting in action if you sign up for a free
14-day trial now - no credit card required. The link is in the description below.
So the next step is keeping everything from WordPress core to themes and plugins updated.
Old versions of WordPress are susceptible to known vulnerabilities, and hackers love to exploit that.
They know what gets fixed every time, which also means that they know what needs fixing,
and there's nothing more inviting for a hacker than old code.
So the rules are the following: delete the themes and plugins you're not using anymore,
never download premium themes and plugins for free,and always keep them up to date.
10Web takes care of the step for you by letting you automate
all the updates of WordPress core themes and plugins you can schedule monthly weekly or
daily updates. So it's one less thing to worry about, unless you're a hacker, of course.
Step 3 is passwords. You know you have to use different and complex passwords for every software
and website you're using. There is no way around this. So don't become an easy target for hackers.
Use strong password generators - I put one in the description, by the way - and store your
passwords in online vaults like Bitwarden. But if you're really set on making your own password
make sure it's more than 7 characters, not a vocabulary word, and includes both upper- and
lowercase letters. And please, please, please! No 123 passwords. You might as well have a "welcome,
hacker" sign on your website. The number 1 way to let a hacker know that you don't care about your
website security is leaving the login to your WordPress admin as "admin" or "administrator".
You're literally lessening their workload because now they just need to come up with a password.
So definitely come up with a unique username, and turn on 2-factor authentication just to be sure.
Also, it's good practice to change the URL to your WordPress admin
to something unique because the standard /wp-admin is really vulnerable.
Step number 5 is about activating security plugins now if you're a 10Web user, our platform already
includes a premium security service that adds a good layer of security by default.
But just to be extra safe we highly recommend our clients download and
activate WordFence. This way you will be aware of any malicious code and no malware will pass.
And last but not least, you must regularly back up your website just in case you know it's life,
things happen, your website might get hacked. And this way you will have a restore point with
all of the essential data from your website that will take your website to its earlier version in
just a few minutes. And here as well, 10Web backs up the hosted websites automatically,
so there's no need for any additional backup plugins. Plus you can schedule the backup
frequency that your website requires, be it real-time, daily, weekly, or monthly backups.
But if your hosting provider doesn't do that for you you can always use third-party plugins
and I've linked a couple of them below. Now if you're still with me and are interested
in more technical details like if you need to know the actual code, you can copy-paste
we have an article written just for you so you know where to find it.
Now, what security measures do you take? Do you have any questions about WordPress
security? Let us know in the comments down below and we'll answer all of them
and as always like and subscribe for more content about rocking WordPress. See you next time!
This video was brought to you by 10Web an automated WordPress platform designed for
agencies. Automate hosting, speed optimization, migration site-building, and management,
and skyrocket your agency growth. Sign up for a 14-day free trial and experience true automation.