WordPress Security and Hardening

Bellingham WP’s WordPress Security and Hardening service has been developed to keep your website safe and secure from intrusion. This is accomplished through the implementation of several security practices aimed specifically at removing known (and plausible) sources of vulnerability.

If you recognize the importance of keeping your business asset secure, get in touch with us. In addition to answering your questions, we will review your website’s current WordPress security situation.

WordPress Security: Software Updates

All of the security in the world cannot save your website from out-of-date, vulnerable code. There are entire online databases which categorically list known WordPress software vulnerabilities, by version, for plugins, themes, and WordPress Core files. With the exception of some poorly supported themes and plugins, there is an army of developers working to keep your website safe and secure by identifying these vulnerabilities and patching the security holes.

However, for you to benefit from these security patches you must perform updates to your website’s WordPress software on a regular basis. This is why we always recommend Bellingham WP’s managed WordPress hosting services, which include regular WordPress software updates, scheduled daily and monthly backups which are stored off server for up to 12 months, and WordPress hosting.

While accessing WordPress is a commonly attempted point of intrusion, a typical hosting account has several of its own access points which can be exploited. FTP and cPanel are more common, to highlight a few. FTP is an acronym which stands for File Transfer Protocol. It is the most common way for a website’s files to be interacted with. If a hacker gains access to FTP they can, with great ease, install any number of malicious files or methods of back door access. With FTP access the hacker would also be able to access the file which contains username and password access information for your WordPress database. To sum up what this means succinctly, YIKES! The other point mentioned, cPanel (short for Control Panel), could be expressed as the brain of your hosting account. With cPanel access a hacker will be able to access and modify your domain’s email accounts, your WordPress website’s database, and your FTP accounts. That’s right, instead of needing to discover FTP credentials, with cPanel access a hacker can simply create their own FTP access account to login to your server.

WordPress Security: Login Hardening

By default, a WordPress installation creates an administrative user with the username ‘admin.’ For hackers, this is great news. It gives them an excellent starting point when attempting to gain access to your website with brute-force hacking techniques. A non-hardened WordPress installation requires only two pieces of information for someone to login, a username and password. If you fail to change the Admin username to something different, potential hackers have half of their hacking job taken care of for them.

Changed your default username from admin to something else? Good work. Did you disable user enumeration or otherwise obfuscate the usernames for administrative accounts? No? Then you’re just as vulnerable as you were before. My point in saying this is that there are many levels which must be addressed in order to secure a WordPress installation.

          Call +1-857-342-2365 for help and support of Hardening WordPress.