How to secure your WordPress website from being hacked?

A hosting company in Israel was hacked last week. The entire server was comprised of WordPress (WP) websites that were down. To be protected from future attacks (cases in which the server is up and running, but your site has been hacked and is no longer ‘live’), you should consider examining the:

1. Application-side,
2. Client-side, and
3. Server-side.

So, let's start by providing you the detailed information:

1. Application-side:

   1. Update your WP version to the most recent version.
   2. Update your plugins.
   3. Review the theme’s files and search for any fishy code pieces.
   4. Block the internal API access.
   5. XML-RPC should be blocked for external users.
   6. Install security plugins: WP Engine, Wordfence Security, and Jetpack.
   7. Change your admin URL (wp-admin must be changed).
   8. The ability to change the website’s code from within WordPress should be blocked — code should be edited only from the server’s files.
   9. Admin’s passwords must be changed to stronger passwords: abc123 is not an option; new passwords should be set to something like SJO9Y&QQ6MZd#yM.
   10. To discover any issues, scan your website weekly with WP Scan and WordFence.
   11. SQL injection defense.
   12. Make sure your website is HTTPS protected.

2. Let’s Go! Get started with Omnis today

   Name
   

   Phone
   

   Company name
   

   Care to chat? Message us on WhatsApp

   Client-side:

   1. Perform client-side security scans to avoid damaging information in the user’s fields.
   2. Avoid building SQL queries with user input.
   3. Prevent the importation of external files.
   4. Protect client-side from XSS attacks through input validation, string output, and encoding.

3. Server-side:

   1. Make sure all server-side sections are handled by the hosting company.
   2. Install an SSL certificate on the server-side.
   3. Enable the recovery of information, files, and databases from at least 3 days prior.
   4. Allow traffic to be routed to a ‘mirror’ site when your site is down or has been hacked.
   5. Ensure spam- and virus-filtering systems and the application firewall mechanism are installed successfully.

In case you would like your website or application to be prepared for the next attack, contact us today in order to secure your web systems.