There are many reasons a website can be hacked from outdated software to weak passwords, here is everything you need to know so you can harden your WordPress site against attacks and keep your data secure.

WordPress is the world’s most popular content management system (CMS), powering over 40% of all websites across the internet.

While WordPress is easy to use and incredibly flexible for it’s users, it’s definitely not immune to hacking attempts. The WordPress CMS is constantly being probed and attacked by bots and automated scripts at all hours of the day so the risk is real.

WordPress sites are a prime target for hackers due to their popularity and the widespread use of vulnerable plugins and themes. If you website has already been hacked, you need to engage a developer who can repair a hacked or infected WordPress website.

1. Outdated Software

One of the top reasons WordPress sites get hacked is running outdated plugins and WordPress core software.

When new security vulnerabilities are discovered, software companies release updates to patch them.

However, if you don’t update your WordPress core, plugins, and themes, you leave your site vulnerable to attacks and exploits from bots and hackers.

Prevention

• Regularly update WordPress core, plugins, and themes.
• Enable automatic minor updates for WordPress core, plugins, and themes.
• Use a plugin like Wordfence to scan for vulnerabilities and outdated software.

2. Weak Passwords

Another common reason WordPress sites get hacked is passwords.

A weak password can be defined as a short, common, a system default, or something that could be rapidly guessed by executing a brute force attack using a subset of all possible passwords.

This could include things like words in the dictionary, proper names, words based on the user name or common variations on these themes.

If you’re using a password like “123456”, “abc123” or “password,” it’s only a matter of time before a hacker gains access to your site.

Prevention

• Use a strong password with a mix of uppercase and lowercase letters, numbers, and symbols.
• Use a password manager like LastPass or 1Password to generate and store strong passwords.
• Set up two-factor authentication (2FA) to add an extra layer of security. This will prevent 99.9% of brute force password hacks from ocurring.

3. ‘admin’ as your WordPress Username

Using the default ‘admin’ as your WordPress username is not recommended.

If your administrator username is ‘admin’, then you should immediately change that to a different username.

Unfortunately changing your username is not as easy as modifying your first name, last name or email address.

You will need to create a new user with administrative access permissions and then delete your old ‘admin’ user.

Prevention

• Create a new administrative user account which does not use ‘admin’ as the username.
• Delete the old ‘admin’ user and when prompted you should allocate all the old users posts to your new user account.
• Use a strong password for your account and consider setting up TwoFactor authentication.

4. Unprotected Access to WordPress Administration Login (wp-admin)

The WordPress admin area is where you manage your website, add new content, and configure settings. It’s also the area most commonly targeted by hackers.

Leaving it unprotected allows them to try different approaches to crack your website, including brute force attacks and password guessing.

To make it difficult for hackers to access your WordPress admin area, you need to add layers of authentication to your admin directory.

Prevention

• Change the URL of your “/wp-admin” area to something else like “/access” or “/management”.
• Password Protect Your WordPress Admin Area. You can do this by using a plugin like “Password Protected” or “WPS Hide Login“.
• Enforce Strong Passwords. You can do this by using a plugin like “Password Policy Manager.”
• Add Two-Factor Authentication. You can do this by using a plugin like “Google Authenticator“

5. Vulnerable Plugins and WordPress Themes

Plugins and themes are a great way to add style and functionality and customize your WordPress site.

However, some plugins and themes are poorly coded and have security vulnerabilities that can be discovered and then exploited by hackers.

Prevention

• Only use plugins and themes from reputable sources.
• Regularly update plugins and themes as their updates become available.
• Remove any unused plugins and themes, as well as their data.
• Use a plugin like Plugin Security Scanner or WordFence to regularly scan for vulnerabilities.
• Engage a local web designer/developer who can perform regular monthly WordPress website maintenance for you.

6. Insecure Web Hosting

Your web hosting provider plays a crucial role in the security of your WordPress site.

If your hosting provider has lax security protocols or doesn’t keep their software up to date, your site may be at risk.

When your website is on a cheap shared hosting environment, this can also lead to issues. If another website on your shared hosting server becomes compromised, this another risk that can lead to your site being hacked as well.

Prevention

• Choose a reputable web hosting provider with a solid track record of tight security and great customer service.
• Use a hosting provider that offers automatic updates for software like PHP and MySQL.
• Use a hosting provider that offers built-in security features like firewalls and malware scanning.
• Use a service such as CloudFlare or Sucuri to add extra layers of protection to your WordPress site.

7. Lack of Reliable Data Backups

If your WordPress site is hacked, it can be a nightmare to recover if you don’t have any back-ups of your website.

When you have a business website, it’s essential to take and maintain regular backups of your site.

If your site is hacked, a good backup schedule give you the opportunity to restore from a clean backup before the site was compromised. This way, you can potentially get your site up and running again fairly quickly.

A good backup principle is the rule of 3 which simply means:

• Have at least three copies of your data.
• Store the copies on at least two different media types. Example:  1 set of back ups on your web host and another set of back ups locally on your computer.
• Keep at least one of those copies offsite – this could be on another server, in Google Drive or another cloud based storage platform or locally on your PC.

Prevention

• Investigate if your webhost can take automated backups for you.
• Use a backup plugin like UpdraftPlus or BackupBuddy to schedule regular backups of your WordPress website.
• Store your backups offsite in a secure location like Google Drive or Dropbox.
• Use a website managment tool like ManageWP to complete automated backups of your website and then store them off-site.

Closing Thoughts

Keeping your WordPress site safe and secure is essential for protecting your content, your users and their data.

If your website represents a business entity, your reputation is everything. You need to ensure that your site remains a safe, reputable and trusted resource for your audience.

By following some of the tips outlined in this article, you can harden your WordPress website security to minimise the risk of your site being hacked.

Don’t wait until it’s too late, take action now to protect your business and secure your WordPress site against bots, hackers and malware.