Your hardworking WordPress marketing website could be pulling a similar, digitally devastating stunt. If not properly secured, a website can be hijacked to show content to search engines and visitors that peddles a hacker’s scammy offerings instead of yours. A hacked website can push malware, phishing scams, Casino links, ED pills, and/or one-way tickets to a spam network.
This post will show you how to avoid the scenario above. Below you will find a full guide to WordPress security. We’ll cover everything from the basics to more advanced topics.
If you want a long read or are looking for something to treat insomnia, read the whole post top to bottom. Or to find the specific topic you’re interested in, here is a table of contents:
- WordPress Security Basics
- Why Security Matters
- Must-Do Basics
- Strong Credentials
- 2FA
- Managing User Roles And Permissions
- Keeping WordPress up-to-date
- Secure Hosting
WordPress Security Basics
Why Security Matters
Reputation is everything in marketing, and that is why security is so important. Your website is your brand. If visitor or search engines are bombarded with sketchy ads or redirects, their trust evaporates instantly. The good news is that following security basics and best practices is relatively simple and greatly reduces the chances of your site getting hacked and hocking gnomes… or worse. The monthly spend for proper security is just a fraction of the investment needed to set up a website and the recurring ad spend tied to it.
In addition to a hit to your reputation, a leak of customer or lead data can lead to fines and legal troubles. The number of security breaches is on the rise. The US Government Accountability Office reported a total of more than 2 million cybersecurity incidents in 2021, compared to slightly over four hundred thousand in 2016.
A hacked site bleeds cash from multiple wounds. While you fix your site, there’ll be a loss from downtime during which the site generates no leads or sales. Fixing the breach can be technical, time-consuming, and expensive. SEO spam happens quickly but takes a long time to recover from. If your site suddenly ranks for various types of “discount pills” instead of your actual keywords, your organic traffic and lead flow can nose dive, and the road back will be slow.
A secure site allows the creation of a stable and performant site. Hacks and hack attempts can bog down your server resources, leading to a sluggish site. Slow pages frustrate users, and unavailable content is like closing your shop during peak hours.
Search engines have to protect their own reputations. They will not funnel traffic to dangerous sources. If a search engine detects that your site was or is hacked, expect your SEO rankings to plummet. If you don’t fix things quickly, you’ll be flagged with a “This site may be hacked” warning in search results, which is the digital equivalent of a biohazard sign. Recovering your rankings can take many months, undoing years of hard work.
Must-Do Basics For Website Security
We’ll start with the simplest things you can do to increase the security of your marketing website.
TLDR:
- Strong credentials
- 2FA
- Manage user roles and permissions
- Update, update, update!
- Secure hosting
Let’s dive into the four basics of security in greater detail.
Strong Credentials
First, make sure only authorized people can log in to your site and change its content. The way to do this is to have everyone use unique and complex passwords for the website and all accounts associated with it.
If you have a website with a login, many bots and hackers are going to try to guess your username and password. In 2021, Malarebytes Labs, a leading security research and development firm, tracked the login attempts to a honeypot. A honeypot is a decoy set up to capture the actions of hackers. This honeypot showed that only 6% of passwords guessed by hackers were longer than 10 characters, and none of the passwords contained spaces. So, if you create a long and complex password, chances are that it will not get guessed even if there are many attempts to guess it.
Credentials have two components, a username and a password. If you stay away from obvious usernames like “admin,” you’ll make it much harder to guess your credentials. Go with something like, “Garden Gnome”.
Now, who’s going to be the baddy to tell all the WP Admin users to create complex passwords? Is this what you got your MBA for (don’t worry, I don’t have an MBA either)? Probably not, so you should know that many security plugins can make sure that all site users have a complex password. We’ll cover WordPress security plugins later in this post.
Two-Factor Authentication
In addition to strong credentials, a security measure known as two-factor authentication will add another layer of security. Two-factor authentication requires both the use of something you know and something you have. You know your password, and, by using a 2FA app that shows token sequences on your phone, you can prove that you are also in possession of your phone. Each security layer makes it exponentially harder to hack your account. If you don’t believe me that 2FA is a good idea, listen to the Federal Trade Commission.
User Roles and Permissions
Who gets the keys to your digital kingdom? Not everyone needs access to the royal treasury (or the button that deletes your blog). Properly managing users, their roles, and their permissions is required to have your website function smoothly. Just like you wouldn’t give a complete stranger the keys to your house, only let people you trust have admin access to your website.
Intuitively, you probably understand one of the essentials of security called the Principle of Least Privilege (PoLP). PoLP states that you should give people enough access to do what they need to do, but don’t give them any more. For example, you might allow many guests into your house for a dinner party, but you would not give any of them access to the contents of your safe that is inside the house. Your guests need to be able to dine at your dinner table, but they do not need to look into your safe. PoLP.
WordPress has roles to make it easier to enforce the PoLP. Let’s start from the most restricted type of user and move toward the least restricted. When you create a new WordPress user, always create the least privileged role possible for the things that user must do on your website.
- Subscriber (aka The Casual Visitor): Subscribers can only log in, manage their own profiles, and leave comments (if your site allows commenting). This role is usually reserved for membership sites or to allow users to manage their individual preferences.
- Contributor (The “Needs an Okay” Creator): Contributors can write and edit their own posts, but cannot publish them. This role is great for guest bloggers, new team members, or anyone who might want to send off hot takes that are a little too hot.
- Author (The Dedicated Creator): Authors can write, publish, and edit their own posts. They cannot touch anyone else’s, and they can’t mess with site settings, plugins, or themes. This role is ideal for regular content writers and hired bloggers.
- Editor (The Content Chief): Editors can publish and manage content. This content includes pages and posts written by others. Editors can also manage taxonomies, terms, comments, and other users with lower permissions. This is a powerful role that’d be ideal for someone overseeing your content strategy or overall content management.
- Administrator (Big Boss): This role has all the keys. Admins can add/remove users, change themes, manage plugins, edit any content, and even delete the whole site. Have as few administrators as possible, and don’t name any of them Admin or Administrator.
You can also create custom roles, should the need arise. Whether you’re using built-in or custom roles, make sure you remember the Principle of Least Privilege. Don’t give anyone a more powerful role than they need. Here is a list of user management best practices:
- Be a privilege miser: Remember the PoLP. For each user, consider the least privileged role they can use to do their job effectively. Don’t make everyone an admin because it’s easier for you. That’ll end up being easier for hackers, should any of those accounts become compromised.
- Keep admin accounts to a minimum: consider using a lower-level account for daily tasks. The fewer admin accounts and the less time spent in them, the smaller the window of opportunity for something to go wrong.
- Conduct regular user audits: Set a calendar reminder for a quarterly user audit. Review each user and ask yourself:
- Is this person still active? Do they still work there?
- Has this person’s required level of access changed?
- Could this person’s role be downgraded?
- Remove users when they leave: When an employee, contractor, or agency partner finishes their work or leaves, revoke their access immediately. Don’t wait until the end of the day or week.
- Don’t allow shared accounts: Each user should have their own unique login. Shared accounts make it impossible to track who did what and when.
If you think of your website as a house, you’ve now got your visitors under control. You know who you’re letting in and which rooms each of them is allowed to enter. Now we have to make sure the house doesn’t fall down around you. You have to keep your site regularly updated, or it’s going to deteriorate.
The Importance of Security Updates
Just like a house requires regular maintenance, so does a website. The most important, frequently recurring upkeep you should do for your website is to regularly update it. When we talk update updates, there are three areas that require updating:
- WordPress Core: This is the engine that makes your site run. Updates to WordPress Core often include critical security patches, bug fixes, and new functionalities.
- Themes: Your theme controls the look and feel of your website. Themes often have updates to ensure compatibility with the latest WordPress versions, to fix any vulnerabilities, and to release new features.
- Plugins: Plugins extend the functionality of your site in a myriad of ways, from contact forms to SEO tools. Out-of-date plugins are one of the most common ways hackers are able to get into sites, so keeping plugins current is essential.
I’ll let you in on a secret. Most hackers are not very skilled. The vast majority of hackers use known vulnerabilities, most with available patches, to exploit websites. This means that all you have to do is keep your website patched and updated to dramatically reduce the possibility of your site getting hacked. In addition to security patches, updates often include performance updates and new features. Don’t miss out!
How to Do Security Updates
How you do the updates is just as important as doing them regularly. It’s no good if you take down your site while trying to complete the updates. At Solid Digital, we offer WordPress updates as a service. It’s no secret how we do the updates, so I’ll share our process with you.
Firstly, some hosts, like WP Engine, offer automated updates. In our experience, too many things go wrong with automated updates. The most common problem is that not all plugins end up getting updated. The second most common problem is that a part of the site breaks after the update and the break is not caught by the automated checks. Due to these reasons, I suggest you do the updates manually. In addition to having better technical outcomes with manual updates, there’s also a benefit to mucking with your site one or more times a month. The more you work with your site, the better you’ll get at taking care of your site.
When you update your website, follow these steps:
- Back up your site just in case
- Run the updates on staging (core, themes, and plugins)
- Rebuild CSS, clear all caches
- Check the staging site from multiple browsers and mobile devices.
- If everything goes well, run the updates on production; if not, debug
- After running the updates on production, rebuild CSS, clear all caches, etc.
- Check the production site from multiple browsers and mobile devices. It’s a good idea to use a fresh browser, such as BrowserStack
The host you use can make WordPress updates easier or harder.
WordPress Hosting
Picking a good hosting provider will make your site both more secure and easier to manage. Make sure it’s easy to create backups and restore them. Ideally, backups should be happening automatically. Also, make sure that multiple environments are available for you to use. Of course, you want a production environment, but having one or two staging environments is a must for testing things out and to help with running WordPress updates. Also, don’t forget about support. When things go wrong, it can be invaluable to have a helpful support team member to talk to. In my experience, WP Engine is a great option.
Wrapping Up
We’ve covered how to lay the foundation for keeping your site secure. Doing these basics will get you most of the way there. In future posts, I’ll cover more best practices, mitigating common threats, and even more maintenance suggestions. Until then, make sure your website isn’t doing a side-hustle selling for Gnroman’s Gnome Emporium. Stay secure!
