Securing WordPress – without panic.

How WordPress sites are really attacked

Hardly anyone sits in front of your site looking for a specific hole. Attacks run automatically: programs scan millions of websites and try known vulnerabilities and common passwords. In turn this means: if you close the known holes and do not use weak passwords, you drop out of the net.

The most common entry points are outdated plugins and themes, guessable passwords or passwords leaked elsewhere, and extensions from dubious sources.

Updates: the most important measure

When a vulnerability becomes known in a plugin, an update usually appears within days – and from exactly that moment automated attacks look for sites that do not have it yet.

• WordPress installs small security updates of the core by itself. For plugins you can switch on automatic updates per plugin.
• Large updates (new major version, page builder, shop) are better tried first. With us you create a test copy of your website in the customer center for that.
• Replace a plugin that has not received an update in years. Nobody closes holes there anymore.

Protect logins

• Long, unique passwords for every account, easiest with a password manager.
• Two-factor sign-in for all administrators – a free plugin is enough, after that a stolen password alone no longer does it.
• Hand out roles sparingly. Someone who only writes posts does not need an administrator account.
• Delete old accounts, for example of the agency that built the site years ago.

Choose extensions carefully

Install plugins and themes from the official directory at wordpress.org or directly from the vendor. Stay away from “free” copies of paid extensions (often called “nulled”): they are the easiest way for malware to get into a website.

A look before installing pays off: when was the last update, how many installations are there, does the developer answer questions? And delete what you no longer use – even deactivated, it sits on the server.

Backups: plan B

No measure protects completely. What counts in an emergency is a clean state from the day before yesterday. A good backup lives at least once outside the server, goes back several days and is tested – a backup that cannot be restored is not one.

With us every web space is backed up daily, on the server and additionally off-site. We keep 7 daily and 4 weekly versions, and we restore a version for you free of charge. Before a larger update you can additionally create your own backup in the hosting panel.

What the server has to contribute

Some of it is not in your hands but the provider's: an encrypted connection (HTTPS), a current PHP version, promptly installed security updates of the operating system and a protection that blocks addresses with too many failed sign-in attempts. Ask your provider about it – with us all of that is standard.

Your site was hacked – what now?

1. Stay calm and do not delete anything – you need the state to find the cause.
2. Change all passwords: WordPress accounts, database, FTP, customer center.
3. Restore a state from before the infection. That is why backups go back several days.
4. Close the hole before the site goes back online – otherwise it will be infected again within hours. Usually that means: update everything, remove suspicious plugins.

You do not have to do this alone. Get in touch, we help with the clean-up.