Questo contenuto è disponibile in Italiano
WordPress is by far the most popular content management system (CMS).
Worldwide, more than 40 percent of all websites are based on WordPress.
However, this popularity also has its downsides: it makes the CMS an attractive target for cyber attacks. In addition, the great strengths of WordPress (its flexibility and modular structure) mean that this CMS tends to be insecure if you abandon it without applying concrete and effective security measures such as constant monitoring of newly discovered vulnerabilities,updating with theme, plugin and WordPress core patches, use of firewalls and spam filters, the reviewing the version of PHP installed on your server or the use of advanced HTTP Security Headers (read our guide here!).
Above all, rely on a reliable certified WordPress hosting service that guarantees you prompt and qualified support service: we rely on Kinsta, try it!
How are WordPress sites hacked?
- Access to siteadministration by unauthorized person or bots.
- Damage to one or more parts of the site, such as deleting images or changing text.
- Malicious use of the site, e.g., to send spam, make banned material visible that could lead to banning of your domain or theft of information from the database!
Prevention is key; restoring a breached site takes much longer
than securing it.
First, update the WordPress core...
Among all the hacked WordPress sites, Sucuri found that 39.3 percent of them were running outdated WordPress core software at the time of the incident.
Fortunately, the WordPress security team continuously checks the platform code for critical vulnerabilities, and these are fixed immediately as soon as they are discovered.
WordPress developers generally work very reliably and quickly, especially when it comes to critical errors.
Only a fraction of all WordPress security vulnerabilities are therefore due to errors in the core.
So if you always work with thelatest version of WordPress and update it in a timely manner, you can protect yourself quite reliably from hackers exploiting security vulnerabilities in outdated versions of WordPress.
Be careful if you want to upgrade your WordPress yourself, better prepare a backup first!
Are there vulnerabilities among your plugins or in your theme?
In a Wordfence survey of owners of compromised websites, more than 60 percent of those who knew how the hacker got into the site attributed the incident to a theme or plugin vulnerability, and similarly, in Sucuri’s 2016 report, just 3 plugins were the cause of more than 15 percent of the breaches that were recorded(do you know the continuing vulnerabilities of the well-known Elementor composer, the Avada and Hello theme, or the Woocommerce plugin?).
All the vulnerabilities in these plugins, at the time of the hack, had long since been fixed by the developers, but the site owners had not yet updated leaving themselves exposed to the threat!
Therefore, it is important to constantly update your plugins and rely on certified hosting that notifies you of known threats among plugins and themes, or use monitoring services such as WP Remote(all websites under WP-Help maintenance contract are protected on this platform).
Take a look atPathstack’s constantly updated vulnerabilityarchive to realize how WordPress plugin vulnerabilities are not to be underestimated (warning, contains technicalities!).
It’s also a good strategy, when choosing a plugin or theme, to also consider the frequency of updates and how closely they are followed by their developers!
Best to avoid outdated and underused tools.
Updates on your own: tips
Often sites do not give problems after a plugin update, but when it comes to major releases (e.g., 1.5.6 to 2.0.0) or particularly important tools, it is possible that frontends will find unintended changes or some features no longer operate.
In the worst cases, fatal errors can be generated that render the site unusable.
Ecci some best practices in this regard:
- The best way to prepare for an update is to test the changes in a staging environment, updating the site in production only when you are certain it will work properly.
- If updating the plugin while staging shows anomalies, you can isolate the problem by analyzing the server logs.
- Sometimes an update may make the plugin incompatible with other tools: in these cases it may also come in handy to act by exclusion (disabling plugins or changing the theme).
- If provided, it may be useful to contact theplugin’s support.
This does not exclude the fact that sometimes it may be necessary to replace the plugin. - It is always advisable to make a backup copy before upgrading so that it can be restored if necessary.
Is your site secure?
Request a free analysis from our specialized WordPress technicians-they are ready to secure your site!
Questo contenuto è disponibile in Italiano