How to avoid WordPress website hacking?

8 years ago

I've used Wordfence for a couple of years and like it. They also send helpful emails to help keep me up to date with cyber attacks...

Thanks

{{ DiscussionBoard.errors[10790233].message }}

Tanzil Ahmad

8 years ago

Originally Posted by stefy christina

Website design is a unique and creative field, website designer has to do lot of research to create a unique website, because every time customer wants to see unique and customized websites. Static websites are tough to edit or modify any changes so most of the web designers or web developer goes to Content Management System.

Design a template and put it in any CMS system, it is a easy way to make the work in less and future changes also takes less time. For this situation WordPress is the best suitable option. But hacking is the serious problem here. Even premium themes also getting hacked. How to avoid or overcome this WordPress Hacking issue as a web designer or a developer?

As we are software and IT company i will recommend you use PHP to get rid from hacking problem. if you need we can help you on making a unique design and development on your desire choice.

Thanks from
bdtask

Thanks

{{ DiscussionBoard.errors[10790735].message }}

alibd654

8 years ago

You need to follow following things:
01. Use wordpress plugin called "All In One Security Plugin",
02. You might change your WPlogin url , Like www.yourdomain.com/wp-admin to www.yourdomain.com/custom
03. You captcha plugin.

Thanks

Signature

Pixel Perfect Web Developer

{{ DiscussionBoard.errors[10791575].message }}

3wCorner

8 years ago

Use better security plugin or other security plugin.
Use strong passwords and login authentications(e.g. sms codes).

Thanks

{{ DiscussionBoard.errors[10793501].message }}

riztechpro

8 years ago

Yes using a captcha and using some security plugins like Wordfenc and All in one security is the best option to avoid being hacked. So hosting providers also provide security check.

Thanks

Signature

HIGH END DESIGN/DEVELOPMENT SERVICES
www.riztechpro.com

{{ DiscussionBoard.errors[10793854].message }}

imnathanjames

8 years ago

Wordfence works like a charm for me.
It's free for the basic account but the paid version has raised in price, think it's now $8.50 a month.

You get emails when someone tries to log in, and on the paid version you can block by country etc.

Very good plugin!

Thanks

Signature

My mission to escape the factory grind http://imnathanjames.com

{{ DiscussionBoard.errors[10803733].message }}

ohnoeedidntt

8 years ago

If you're gonna pay for the security, your web host might offer an affordable solution. There are also some great free plugins out there

Thanks

{{ DiscussionBoard.errors[10803824].message }}

CyberDav

8 years ago

Use the wordfence plugin and set a custom admin login url.

Thanks

Signature

CyberLite Web design and Web development | WarriorForum Thread

{{ DiscussionBoard.errors[10804599].message }}

vikash_kumar

8 years ago

This issue with all kind of sites and not specifically WordPress. On any plateform there are few fundamental aspects which needs to be taken care. Like:

1) Timely offsite backup (On Some other server like Amazon S3)
2) Frequent updates of Core, Plugins and themes
3) Some tweaks in the default nature of the software. e.g. change of Login URL
4) Avoid simple username like "admin"
5) Avoid simple passwords.

These simple tweaks makes it difficult to make it into the site and the hackers don't like hard work as we do.

Hope it helps.

Vikash

Thanks
1 reply

Signature

WordPress Expert Help - WordPress Fix, Migration, Customization, SEO & Many More Things

{{ DiscussionBoard.errors[10805220].message }}

stefy christina

8 years ago

Originally Posted by vikash_kumar

This issue with all kind of sites and not specifically WordPress. On any plateform there are few fundamental aspects which needs to be taken care. Like:

1) Timely offsite backup (On Some other server like Amazon S3)
2) Frequent updates of Core, Plugins and themes
3) Some tweaks in the default nature of the software. e.g. change of Login URL
4) Avoid simple username like "admin"
5) Avoid simple passwords.

These simple tweaks makes it difficult to make it into the site and the hackers don't like hard work as we do.

Hope it helps.

Vikash

You suggested very valuable points which are the key players in keeping our WordPress website safe. Yes we should take backup of website on regular intervals if not it will create main issue.

Thanks

Signature

Salesforce online training | Salesforce training in India

{{ DiscussionBoard.errors[10810848].message }}

AlfredX

8 years ago

Wordfence + Jetpack all the way!
Also, limit your login attempts!

Thanks

{{ DiscussionBoard.errors[10805253].message }}

NKM Dony

8 years ago

1. At first Use STRONG password like: XyL08#$Yal$nY&21
2. Use security plugin
3. Use capture plugin

Thanks

{{ DiscussionBoard.errors[10806009].message }}

mnbv10

8 years ago

[DELETED]

{{ DiscussionBoard.errors[10806394].message }}

stefy christina

8 years ago

Originally Posted by wolff33

I've used Wordfence for a couple of years and like it. They also send helpful emails to help keep me up to date with cyber attacks...

Originally Posted by 3wCorner

Use better security plugin or other security plugin.
Use strong passwords and login authentications(e.g. sms codes).

Originally Posted by riztechpro

Yes using a captcha and using some security plugins like Wordfenc and All in one security is the best option to avoid being hacked. So hosting providers also provide security check.

Originally Posted by CyberDav

Use the wordfence plugin and set a custom admin login url.

Originally Posted by AlfredX

Wordfence + Jetpack all the way!
Also, limit your login attempts!

Originally Posted by mnbv10

add new plugin - duplicator or updrawf plus for backup

We have used WordFence Free version and paid version too.
In paid version or premium wordfence plugin they are offering services to single website only means single licence which is bit expensive. They are also getting hacked and not solved the issue properly.

We used security ninja premium version too, no result. They are asking to purchase add-on plugin also which are costly and not serving the need.

Thanks

Signature

Salesforce online training | Salesforce training in India

{{ DiscussionBoard.errors[10810845].message }}

ddev

8 years ago

Loginizer can help you to stop brute force attacks.

Thanks

Signature

GrandZ Review 2022

VidVoicer

Free Affiliate Funnels Review

{{ DiscussionBoard.errors[10806556].message }}

pxljobs

8 years ago

In the following way you can prevent word press site update the word press version,check word press is hacked,change admin user login name,secure the word press file permission,back up the website.

Thanks

{{ DiscussionBoard.errors[10869824].message }}

Patrick

8 years ago

DO NOT USE A SECURITY PLUGIN.

Keep in mind, the folks making those so called "security plugins" try to show you that they are doing serious work, but instead they are mesmerizing you to buy their pro version. I don't know why so many people are recommending it, they probably think that "security" means using a plugin and problem is solved, but its the other way round.

Here are the simple steps to ensure your WordPress website is never hacked.

1) Make sure you keep your WordPress core, themes, plugins updated.

2) Remove all the themes and plugin you don't use ( yes even the twentyten to sixteen themes or whatever you have in the backend). Keep only the plugins and themes that you need.

3) Create a strong password and write it down somewhere, like as a note in your mobile phone or wherever you think its secure and you won't lose it.

4) Never make a password involving dictionary words.

5) You "can" install a limit login attempts plugin, but that's your choice, optional, not REALLY needed.

6) Change the username of the admin login from admin to something else, there are many ways to change it, either through plugin or database (I would recommend database way).

7) Make a backup every WEEK. Keep a weekly reminder on your mobile phone that you have to create a backup today. Download those backups to your local hard drive. Remove the ones which are old. Atleast keep the last 4 backups just for being on the safe side.

If you follow the above steps, you won't need any plugin or some so called "security force".

One more point..

8) Make sure you are using a reliable host, I have seen a lot of clients coming to me saying that their WordPress got hacked, and when they asked their hosting provider about it, they recommended him to "upgrade", a clear sign that they are trying to fish out more money from them.

For more info about security read this https://codex.wordpress.org/Hardening_WordPress

[ 2 ] Thanks
1 reply

Signature

Freelance WordPress Developer | Free WordPress Themes | Free WordPress Plugins | Free WordPress Support

{{ DiscussionBoard.errors[10870411].message }}

stefy christina

7 years ago

Originally Posted by Patrick

DO NOT USE A SECURITY PLUGIN.

Keep in mind, the folks making those so called "security plugins" try to show you that they are doing serious work, but instead they are mesmerizing you to buy their pro version. I don't know why so many people are recommending it, they probably think that "security" means using a plugin and problem is solved, but its the other way round.

Here are the simple steps to ensure your WordPress website is never hacked.

1) Make sure you keep your WordPress core, themes, plugins updated.

2) Remove all the themes and plugin you don't use ( yes even the twentyten to sixteen themes or whatever you have in the backend). Keep only the plugins and themes that you need.

3) Create a strong password and write it down somewhere, like as a note in your mobile phone or wherever you think its secure and you won't lose it.

4) Never make a password involving dictionary words.

5) You "can" install a limit login attempts plugin, but that's your choice, optional, not REALLY needed.

6) Change the username of the admin login from admin to something else, there are many ways to change it, either through plugin or database (I would recommend database way).

7) Make a backup every WEEK. Keep a weekly reminder on your mobile phone that you have to create a backup today. Download those backups to your local hard drive. Remove the ones which are old. Atleast keep the last 4 backups just for being on the safe side.

If you follow the above steps, you won't need any plugin or some so called "security force".

One more point..

8) Make sure you are using a reliable host, I have seen a lot of clients coming to me saying that their WordPress got hacked, and when they asked their hosting provider about it, they recommended him to "upgrade", a clear sign that they are trying to fish out more money from them.

For more info about security read this https://codex.wordpress.org/Hardening_WordPress

I do agree with you that we have to be careful with security plugins and i have purchased tried almost all major security plugins which are available in themeforest as premium version. We bought them for high price and no such effect was appeared. May be they are stealing our data. So we will aware of this fact.

Thanks
1 reply

Signature

Salesforce online training | Salesforce training in India

{{ DiscussionBoard.errors[10910817].message }}

katefeesh

7 years ago

Originally Posted by stefy christina

I do agree with you that we have to be careful with security plugins and i have purchased tried almost all major security plugins which are available in themeforest as premium version. We bought them for high price and no such effect was appeared. May be they are stealing our data. So we will aware of this fact.

Agree with Patrick and Christina. Though I wouldn't go as far as to say don't use security plugins, I think security plugins are harmful to the community because of the false sense of security they give. People only figure this out after they get hacked right through the mishmash of 'security' plugins and have to rebuild their sites again. Even the pro versions. I usually recommend web application firewalls because they filter traffic at the level of deep packet inspection. Most WAFs filter by pattern-matching and the more advanced ones use logic-based detection. Does anyone know how exactly plugins like WordFence filter traffic?

Thanks

{{ DiscussionBoard.errors[10942403].message }}

Claire Anderson

7 years ago

A WordPress survey report was launched a few months ago that almost 16000 websites were hacked in 2016 and the main reason was that most of these websites were using outdated plugins.

You can check this article for more detail:
5,769 hacked WordPress websites in 2016 and their security solution

Hackers steal the sensitive user data from the websites and sometimes they add malicious code in the website. Every website needs to strengthen their security, to block the hackers attack, otherwise you might start distributing virus to other users.