Five common mistakes that make your WordPress site vulnerable to hackers
How secure is WordPress?
Every single user ponders upon this and it is one of the hot topics of discussion among all internet freaks. WordPress is undoubtedly the most popular Content Management System in this universe, and it being super-secured is so hard to imagine. In fact, it’s the same case for any Open Source project. It provides access to every single file to one and all. The irony is that this fact does not make WordPress any less secure either!
WordPress is tremendously secure in its own way.
Power to you.
WordPress is tremendously secure in its own way. The entire power lies in your hands; you have the vault, its keys, security systems and everything in your hand. Now it’s your responsibility to ensure that the vault is locked properly and the security systems are operational. In this article, we are enlisting the most obvious reasons due to which WordPress sites gets hacked.
1. Weak Passwords
If your password is ‘123456’ or ‘qwerty’, then your site must have already been hacked! It’s a child’s play for potential hackers to guess that! Using a weak password is the biggest security vulnerabilities that you can easily avoid. Your WordPress account password should be strong enough, and it should be framed using a random combination of characters, symbols or numbers.
Just try not to be a smart ass by using an easy-to-remember mixed password. You wouldn’t believe it, 1q2w3e4r, 3rjs1la7qe and 1q2w3e4r5t are among the top 25 used passwords that are highly prone to hacking. Therefore, try to make your password super-strong and challenging to guess. In addition, your WordPress password should be unique and be used for that site only, and avoid using it anywhere else. Always use a highly random password for WordPress that is tough to crack even after using an automated script.
How to fix it?
- Login to your WordPress site
- Click on ‘Edit My Profile‘
- Scroll all the way down to ‘Account Management’
- Click on ‘Generate Password’ button
- Finally, click on the ‘Update Profile’ button
In addition to that, your WordPress password should be unique and be used for that site only, and avoid using it anywhere else. Always use a highly random password for WordPress that is tough to crack even after using an automated script. You may use a trustable password manager app like LastPass, 1Password or Keeper to store your passwords securely.
2.Weak Usernames, Of course!
The worst possible username for your WordPress site is indisputably ‘admin’, followed by your site’s name and your own name! If your username is ‘admin’, then the hacker is already halfway into hacking your website. On the other hand, if you have a complex username, then it will make any potential hacker initially confused to a greater extent. They don’t have to be as complex as passwords, however, make them not-so-easy to guess.
Bad Usernames
- admin
- administrator
- Your own name
- Your site’s title
How to fix it?
Well, here is a bummer. WordPress does not allow you to change the username once it’s set. You will have to create a new administrator account with the desired username and delete the old account.
- Add a new user with ‘Administrator’ role
- Login as the new user
- Delete the old user account
Do not forget to assign the ownership of all the existing posts and pages to the new user while you deleting the old user.
Easier method
The easiest way to change the username is by using the plugin Username Changer. Once the plugin is installed, you can change your username just like you change your password.
Changing username using the Username Changer plugin
Once you have changed the username you can delete the plugin unless you want all your site members to have the ability to change their username as they wish.
3. Not Updating WordPress, Plugins or Themes
Running outdated versions of WordPress, plugins and themes makes your WordPress website susceptible to brute attacks. The version updates often include patches for security issues, so it’s important to always run the latest version of all software installed on your WordPress website. The most convenient way is by keeping auto-update feature on.
Updates are out frequently and emerge in your WordPress dashboard as soon as they’re available. Make it a practice to run a backup prior to running all available updates every time you login to your WordPress site. The task of Updating is vital for WordPress security, how much so ever tedious and inconvenient it may seem.
If you handle more than one WordPress website, then a tool like iThemes Sync or ManageWP can aid you by providing you with one dashboard to manage multiple WordPress sites.
4. Using Plugins and Themes from Untrustworthy Sources
Poorly-written, insecure, or outdated code keeps your website at risk and makes it simple for the attackers to exploit it. Since plugins and themes are potential sources of security vulnerabilities, so it is better to download and install WordPress plugins and themes from credible and authentic sources only, like the WordPress.org repository, or from premium companies that have been in business for a while. Also, avoid bootleg or torrented “free” versions of premium themes and plugins, as these files may have been altered to contain malware.
5. Using Poor-Quality or Shared Hosting
Since the server where your WordPress website resides is a target for attackers, using poor-quality or shared hosting can make your site more vulnerable to being compromised. Though all hosts take precautions to secure their servers, not all are as vigilant enough to implement the latest security measures that safeguard the websites on the server-level.
Shared hosting act as a threat to website’s security as it stores multiple websites on a single server. If one website is hacked, attackers may also gain access to other websites and their data. Using a virtual private server (VPS) is expensive, however, it assures that your website is stored on its own server.
Conclusion
Clearly, WordPress gives the power to you and the breach in security is from your side, so you need to act smartly in order to safeguard your website against hackers. If you work upon theses five things, then surely your website will be much more secure and less prone to brute attacks.