Will my website be secure? I don’t want my website to get hacked.
This is a question new clients ask me and they are right to be concerned. Security breaches are regularly in the news. This article provides simple steps for a secure website.
I follow security best practices. This includes using strong passwords, installing an SSL certificate, secure hosting, and firewall protection with a WordPress security plugin. While I am not a security expert, I do follow website security news and implement new practices promtly.
Everyone needs to know how to stay safe and secure on the web. As a website owner, you can show your website visitors their information is safe through an SSL certificate. Adding information about your security measures to a privacy policy page is another way to show your website visitors that you take security seriously.
Here are the detailed steps I take to make sure you have a secure website:
1. Strong and unique passwords
Data breaches are frequently in the news and there is a good chance that your email address has been exposed. This is the new normal and is why unique passwords for each account are important. I used to try and memorize passwords or write them down, but the more secure they are, the more difficult it becomes! I highly recommend using a password manager. You will have one master password to remember. Password managers make it easy to generate strong passwords. Using a strong and unique password for your WordPress and hosting accounts will help to keep them secure.
The following table shows just how easy a brute-force attack is. Secure passwords now need to be 16-18 characters long!
Check out the reduction in brute force attack time on passwords since last year. Looks like 16-18 characters should be the absolute minimum. pic.twitter.com/8JX0YMwaMs
— Ezra Bowman (@ezrabowman) April 10, 2022
If I haven’t convinced you yet, watch this video:
Overview of why you should stop memorizing your passwords (video) — 3 minutes
Video Transcript
The average person has 27 unique web logins.
To create an account on a site, you have to register with a username and password.
And most people pick passwords that are easy to remember.
Actually, a lot of us end up using the same password for all of our websites—which is understandable, but risky. There are many different ways that hackers can get your password. They can use programs that try to guess it by randomly cycling through different combinations, hack the website itself, or phish—by sending fake emails that look like they’re from a website or company, but actually aren’t.
All of this spells bad news for people that reuse the same password, because you’re putting yourself at much higher risk for hackers being able to get into your emails, your photos, and even your bank info.
Last year, Yahoo made headlines when it was the victim of a massive cyber attack, with sensitive information stolen from 1 billion accounts. So, if you had a Yahoo account and used that same password for other sites, you were vulnerable to all those other accounts being hacked too.
Every time there’s a big hack like this, experts tell us to stop using the same password for every website. In fact, they say we should stop memorizing our passwords altogether—recommending that we use something called a password manager instead.
I know, I know—it already sounds complicated. But trust me, it’s really not, and it will help make all of your accounts much more secure.
We currently think of passwords as things that we memorize and store inside our heads. But since we’re really bad at remembering random things, there’s a limit to how complex your password can be—and how many different ones you’ll be able to remember. As a result, most people have really simple passwords, and many use the same one across all their logins.
This sucks, because if a hacker gets access to your one password, they then have access to all of your different accounts. And if your password is uncomplicated, it’s astonishingly easy for hackers to guess it. For instance, if you use a password like, well, “password”—which is actually the eighth most commonly used one—it would take a hacker mere milliseconds to guess it.
But if you use a password manager to generate a 15-digit series of random upper- and lowercase letters and numbers, that time jumps up to 609 million years.
The biggest thing we need to do is stop keeping our passwords inside our heads. Instead, we need to put them somewhere else and lock them up—like a virtual safe. This is what the password manager does. It’s basically an app that keeps all of your passwords secure inside of a safe that only you can unlock.
This way, you only need to remember one password. And once you unlock the safe, you can see all of your many different passwords in one place. Since it’s an app, you can access your passwords from any device you’ve installed it on. And since you don’t need to remember all your passwords anymore, you can make them really long and complicated.
So, what happens if your password manager gets hacked? They would have access to all your individual passwords then, right? Not necessarily. The password manager encrypts your data. So if a hacker looks inside your safe, all they’ll see is scrambled passwords.
LastPass was hacked in 2015 and users had to change their master passwords. But the individual passwords inside were safe because of this encryption.
It may seem like it would be annoying to have to retrieve your password for every single website. But, actually, most password managers have browser plugins that automatically fill your info in for you. So in many cases, it’s actually easier.
And besides, it’s better than the alternative: becoming one of the millions of Americans that get hacked every year.
2. Add another layer of security with 2FA
Multifactor authentication, or 2FA, adds extra security by requiring a second login step. The extra layer of security may be a text message, a code from an authenticator app, or a push notification to your smartphone. 2FA is available for WordPress and your hosting account.
What is Two-Factor Authentication (video) — 2 minutes
Video Transcript
You might think your password is a tough wall to crack when it comes to your apps and identity.
But passwords are a pretty laughable method of authentication. Whether from sheer brute force or simple phishing, scammers can scoop them up pretty easily.
What you really need is a second way to verify yourself. That’s why many internet services—a number of which have felt the pinch of being hacked—offer two-factor authentication.
It’s sometimes called 2FA or two-step verification. But what exactly is two-factor authentication?
There are three generally recognized factors for authentication:
- Something you know, such as a password.
- Something you have, such as a hardware token or cellphone.
- Something you are, such as your fingerprint.
Two-factor means the system is using two of these options. In most cases, the extra authentication is simply a numeric code—a few digits sent to your phone—which can only be used once.
You can get that code via text message or a specialized smartphone app called an authenticator. Once linked to your accounts, the app displays a constantly rotating set of codes you can use whenever needed.
The arguable leader in this area is Google Authenticator, which is free on Android and iOS. Other authenticators include Duo Mobile, SaaSPass, and LastPass Authenticator, which all do the same thing on mobile and some desktop platforms. Meanwhile, the majority of popular password managers also have 2FA by default.
You can also go to twofactorauth.org to find a list of services that support 2FA.
As you panic over how hard this all sounds, remember this: being secure isn’t easy! The bad guys count on you being lax in protecting yourself in order to grab your information.
Implementing 2FA means it takes a little longer to log in each time on a new device—but it’s worth it in the long run to avoid some serious theft, be it of your identity, data, or money.
3. How WordPress is secure
WordPress has a dedicated security team. They work to identify and resolve security issues in the core software. In addition, they recommend and document security best practices for third-party plugins and theme authors.
The Open Web Application Security Project (OWASP) has a Top Ten list of the most critical security risks to all web applications. The WordPress security team works to strengthen core software against these risks. Download the WordPress security white paper for a deep dive.
WordPress plugin and theme security
A plugin or theme undergoes a review process before inclusion on the WordPress.org website. They must pass a set of security guidelines before inclusion in the directory. If a plugin vulnerability is found, the WordPress security team works to fix and release a secure version.
WordPress user accounts
There are five levels of user accounts for WordPress. Here is a summary of the roles:
- Super Admin – The highest level of access. This role is an administrator of a network of websites
- Administrator – The highest level of access for a single website.
- Editor – Allows for publishing and managing all posts
- Author – Allows for publishing and managing your posts
- Contributor – Can write and manage their posts but can’t publish them
- Subscriber – Can manage their profile and read content
Limiting the number of users with administrator capabilities keeps a website more secure.
Change the default “admin” username for WordPress
WordPress websites start with an administrator account. The default username is “admin.” Automated bots commit a large percentage of WordPress hack attempts. They often use the admin username with a brute force attack to guess the password. To avoid this type of attack, choose a different username.
Regular WordPress maintenance
Major updates to WordPress come out frequently and include new features and changes to the underlying code. Minor updates are released when they are needed to fix bugs and patch security problems.
WordPress themes and plugins also release updates that contain new features, bug fixes, and improved security. These should be updated as they are released for the most secure website. Plugins that are old or abandoned should be removed from the website.
4. Use a security plugin
My favorite security plugin is Wordfence and I install it on all websites I build. It provides the following security measures:
Firewall protection
A Web Application Firewall (WAF) identifies and blocks malicious traffic. A malware scanner blocks requests that include malicious code or content. Login security limits login attempts and requires strong passwords.
Security detection
A scanner checks core files, themes, and plugins for malware, bad URLs, malicious redirects, and code injections. It also checks your site for known security vulnerabilities and abandoned plugins. Content safety checks ensure that your files, posts, and comments don’t contain dangerous URLs or suspicious content. In addition, the scanner will repair or delete corrupt files.
Threat intelligence
The Wordfence plugin has the newest firewall rules, malware signatures, and malicious IP addresses needed to keep your website safe. The plugin protects over 3 million WordPress websites! This gives them access to information about how hackers compromise sites, where attacks originate from, and the malicious code they leave behind.
5. Website hosting company security
Another way to protect your WordPress website is right where it is hosted. Good website hosts prioritize best practices for security. My preferred hosting company, Siteground, has a page of information about how they secure your website:
- Servers with the latest version of PHP
- Intrusion detection and prevention systems
- Protection against common attacks on shared servers
- Up-to-date databases with the latest software and security patches
- Continual monitoring for vulnerabilities
- Firewall protection for the server
- Encourage 2FA to log into the hosting account
HTTPS and SSL certificates
I install an SSL certificate on all websites. This enables websites to use hypertext transfer protocol secure (HTTPS). SSL certificates are installed in the hosting account. This allows for an encrypted connection, also called Transport Layer Security (TLS), from the browser to the website. TLS keeps online interactions private even though they travel across the public internet. Secure websites will show a lock in the address bar. I gave a talk about migrating websites to HTTPS at a Boston WordPress Meetup.
How SSL certificates work
SSL certificates verify the authenticity of websites. When a user visits a secure website, their browser downloads the SSL certificate to verify it. If it is verified, a secure connection will be established. If the SSL certificate is not valid or expired, the browser will display a warning.
6. Website Backups
If your website becomes infected with malware or hacked, you may need to restore it from a backup. Daily backups give you the ability to go back to a point before the website became infected to restore a healthy website. Once the backup has been deployed updates can be made to secure the website from future attacks.
Website backups can be scheduled from your hosting account. Backups can also be run and stored through a third party. I schedule backups and monitor security with ManageWP, a WordPress website management dashboard.
Wrap up
In summary, a secure website can be achieved with this 6 step guide, which includes these benefits:
- Prevents a hack and blacklisting of your website
- Avoids downtime due to malware or an outdated SSL certificate
- Shows your visitors that you value their privacy
- Better search engine results
Every website I design and build follows this 6 step guide for a secure website. If you have a question about website security, please contact me.
