What Are the Biggest Security Concerns of a WordPress Website?

WordPress is by far the most popular CMS around. A content management system (CMS) is a platform used to build and host responsive websites that can be easily updated.

Unfortunately, WordPress is also the most attacked CMS. Over 500 WordPress websites are hacked each day. It’s estimated that 97% of those attacks are automated. They happen so fast, that an entire site can be taken over and turned into a phishing site in a matter of seconds.

Security is not always the first thing business owners think about when building a website or having their website designed. They are often thinking about things like look and feel, if it can convert visitors to leads and if it represents their products and services well.

Websites have become virtual storefronts and companies rely on them to get customers just as much as the old corner drug store relied on its brick-and-mortar building. 

If a website is breached, it can have serious business repercussions, including:

• Loss of potential business
• Current customers lose trust
• Customer data may be compromised
• It can take weeks to get the site back
• SEO rankings can take a nosedive
  Lost productivity costs while cleaning up the mess
• Your emails can begin getting blocked as malicious

A WordPress website needs to be managed properly and this includes having steps taken to keep it secure. Here are some of the main security considerations you need to address to prevent a devastating breach.

Outdated Theme 

The theme is the main “wrapper” for your website. It enables the look and feel and the features your site has available. Themes are often updated by the theme creator, and these updates need to be installed.

Outdated themes can have code vulnerabilities that allow hackers to breach the backend of your site and overwrite files. Theme updates can be tricky, because they control the entire look of your site, so you want to ensure you have someone doing these that understands how to install and test them correctly.

Outdated Plugins

While your website theme governs the look and capabilities of your site, plugins run many of the back-end features. Need to have a contact form? There’s a plugin for that. Want to calculate shipping costs in your shopping cart? There are plugins for both the cart and the shipping calculation.

There are roughly more than 58,000 plugins listed in the WordPress directory. Most WP sites will have multiple plugins – it’s not uncommon for a site to have 15 or more. All these plugins need to be updated.

Plugins are often the source of a WordPress site hack because the site owner did not install a plugin update. Like themes, these updates come often, and if you don’t have someone managing updates regularly, they can be easy to miss.

Outdated Core Software (WordPress version, PHP version, etc.)

Another type of update that needs to be done regularly for WordPress sites is the update of core software technologies. These are the “bones” of most sites and include the WordPress software and other core technologies like PHP and MySQL. 

Approximately 61% of WordPress sites are running an outdated version of PHP. 

It’s easy to overlook an update to some of the core software because they’re not often evident to someone not well-versed in WP administration. Outdated core software can also be easily breached should it contain a vulnerability.

Unused Themes & Plugins

When you first sign up for WordPress, it will include several default themes. Once you choose a theme (either one of those or a different one) remove the ones you’re not using.

Keeping old themes and plugins in your WordPress system is a recipe for a breach. People often forget about these and never update them or think that deactivating them is good enough. But they should be completely removed to avoid unnecessary risk.

Bot Attacks on Forms

It’s not unusual to begin seeing weird contact form entries once you put up a WordPress site. Bots often bombard sites and send through automated form hits that take up resources and time.

Things like adding a captcha on forms can help alleviate this. You also should have security added to the site to address automated bots.

Weak Administrator Passwords

Password breaches are a common factor in WordPress hacks. Having a weak password for any WordPress administrator account can leave your site as a sitting duck for hackers.

It’s best to implement two-factor authentication for your WordPress logins. This significantly reduces the risk of a cybercriminal taking over your site.

Also, beware of a phishing tactic that’s often used to get your password. The unsuspecting website owner gets an email that appears to be from their website hosting company about some issue that will cause the site to be taken down. If they click the link in the email, they’re taken to a spoofed login page.

Within seconds of entering the WordPress login, the site is hacked and usually transformed into a phishing site in seconds. Even if the password is changed a minute later, it’s usually too late.

Need Help Securing Your WordPress Site?

Unbound Digital can help your Johnson City, Tennessee business with WordPress site design and security.

Contact us today to schedule a consultation. Call 423-467-7777 or reach us online.