The post How to Make Your WordPress Website Greener appeared first on Freelance Web Designer Leeds, Rob Russell | A-XDigital.

After Manchester United was hacked and clubs fear losing millions of pounds if their turnstiles are disabled or valuable transfer data stolen as criminals scale up attacks in the pandemic

• The Whites are the latest club to beef up security in face of cyber attacks
• 11 Premier League clubs have attended a cyber security session this year
• Manchester United fell victim to an attack in November last year
• Criminals target transfer deals and try to insert ransomware into networks 

Leeds United are tightening their cyber defences in the face of a growing threat  from sophisticated criminals, who can extract millions of pounds from the biggest clubs.

English clubs are increasingly concerned about the threat from hackers, who see sport as a ‘highly attractive’ and ‘high-value’ target.

In the last year, Manchester United was attacked, an EFL club was hit with a £5m demand and the biggest single loss to a sports organisation from cyber crime was £4m, according to he UK National Cyber Security Centre (NCSC) – part of GCHQ.

Leeds United are making sure their cyber defence is super-tight after clubs were targeted

The Whites have commissioned a specialist company to secure emails systems and files

The cyber criminals are aiming to cash in on big money deals, exploit lucrative match days, or even hold valuable transfer or fan data to ransom.

As well as United, Liverpool and Lazio have all fallen victim to hacks in recent years. But more are have suffered in silence or fought off the online raiders and clubs’ vulnerability is even greater now with thousands of staff working from home on laptops and remote serves.

Over 40 clubs attended a security conference organised by the NCSC, including 11 from the Premier League, in January, to learn more about how to protect themselves.

And the the watchdog says cyber-criminals see sport as a juicy target with seven out of 10 clubs experiencing an attack once a year, and three out of ten suffering at least five raids.

Manchester United’s hackers demanded cash to release their grip on the club’s systems

“We know that sports clubs and organisations are facing significant challenges managing the impact of the coronavirus pandemic,’ said Sarah Lyons, NCSC Deputy Director for Economy and Society ahead of the conference.

‘But that doesn’t stop the UK sports industry being a highly attractive target for cyber criminals – and it’s important that organisations are aware of this threat,’

Leeds have commissioned Barracuda Networks to beef up their security, focusing on securing the club’s email systems and defending against ransomware, which was believed to have affected some of Manchester United’s systems in November.

“Even in a normal year, Premier League clubs are a hot target for opportunistic cyber attackers, who are looking to disrupt servers or steal data, usually in an attempt to hold the club to ransom, or to sell sensitive data illegally for financial gain,’ said Chris Ross, a manager at Barracuda Networks.

Specialist firm, Barracuda, says it is working with Leeds on emails and back up files

“However, with hundreds if not thousands of staff members now working remotely, the threat facing Premier League clubs, and indeed all organisations, is more pressing than ever.’

There are two common types of attacks, email impersonation and ransomware, Ross’ colleague, Steve Peake explained.

‘The sporting world is targeted in a quite sophisticated way and the reason for that is there is a lot of information publicly available,’ Peake told Sportsmail.

‘We know football clubs time tables. We know when the transfer windows are and that is helpful because an attacker can pretend to be more credible.

‘In the transfer window there is a lot of speculation about where players may be moving to, so someone can potentially craft an attack to appear as though they are a party [to the transfer].’

Audacious as it sounds, these tactics, known as ‘impersonation’ attacks, do work if the criminals use hi-tech software to closely replicate emails and obtain detailed knowledge of the deal.

Lazio fell victim to email impersonation while completing a transfer with Feyenoord  in 2018

Italian giants, Lazio, fell for an email scam and paid £1.75m (€2m) to fraudsters in 2018.

According to Italian newspaper, Il Tempo, the Serie A club were completing the last instalment of a transfer fee for defender Stefan de Vrij, whom they had signed from Dutch club Feyenoord.

Lazio received an email that appeared to be from the Eredivisie outfit asking for the final payment of the deal along with bank account details.

The Italian side paid the money, but Feyenoord never received the fee and said they had not sent the email. The cash was traced to a Dutch bank account apparently set up by the fraudsters.

Last year, the National Cyber Security Centre said an EFL was asked for £5m by hackers

Closer to home, the NCSC reported last year that an email account of a Premier League football club’s managing director was hacked during a transfer negotiation, which led to the club attempting to pay £1m into a bank account set up by criminals.

The transaction was only halted because the club’s own bank identified the destination account as fraudulent.

In this case, inside information was obtained when the MD had inadvertently entered their details into a fake Office 365 login page, which allowed to hackers to monitor his correspondence.

Email is a potential weak point for any organisation. Liverpool was also hacked in 2018, resulting in a serious data breach for around 150 supporters, according to the Liverpool Echo.

The post Leeds United reveal they are tightening their cyber defences appeared first on Freelance Web Designer Leeds, Rob Russell | A-XDigital.

The post How Much Does It Really Cost to Build a WordPress Website? appeared first on Freelance Web Designer Leeds, Rob Russell | A-XDigital.

Here are just three very important reasons why:

1. Security

WordPress and other plugins can contain security vulnerabilities. Hackers and other malicious parties are adept at exploiting weak spots in software, apps and plugins. They also rely on people not bothering to update their plugins, along with themes, PHP and WordPress itself. In fact, research by WPBeginner found that a huge 83% of hacked WordPress blogs in 2012 had not been updated.

Updates are the only way to stay one step ahead of the hackers and reduce security risks. The plugin developers release updates which contain patches and fixes to resolve known issues and to strengthen your site against attacks.

If you don’t keep up with plugin updates, you leave your site open to attack.

2. A bug-free website

Not only do outdated plugins cause security issues, they can also make your website buggy. This can mean a bad experience for users who visit the site, who may encounter problems with slow loading, broken features, dead ends and other annoying bugs. It can also be very frustrating for you, as your plugins stop working as well as they used to.

3. Extra features

Updates don’t just contain patches and fixes for security vulnerabilities. They often come with added features and functionality too, many of which could be great for your website. If you don’t update, you can’t take advantage of them.

Remember – updating plugins is easier than fixing a hacked website

If you still can’t seem to find the time to update your WordPress Plugins, bear this very important point in mind. Updating is like taking out an insurance policy, it’s a preventative measure that can save you a lot of time, frustration and expense later on. If your website is hacked, it could take days or even weeks to fix. You can’t even imagine at this stage what it will take to get the problem sorted, and how many potential customers could be turned away during this downtime?

Anyone who runs a website should put updating plugins at the very top of their list of priorities. It may not seem important when that notification pops up, but it is so easy to do and can save you from serious problems later on. There is even a handy guide available to help you keep WordPress secure, so there’s no excuse not to get those plugin upgrades sorted.

The post Stay up to date appeared first on Freelance Web Designer Leeds, Rob Russell | A-XDigital.

A newbie WordPress user can also resolve these issues merely by following the steps mentioned in this article.

So, check-out the most common WordPress Bugs of all-time and methods to resolve them:

1. White Screen of Death:

A WordPress white screen of death (WSOD) is quite often generate by PHP code bugs or memory limit exhaustion.

How to fix White Screen of Death?

Some of the common steps to resolve WSOD issue:

• Disable Plugins and Themes

One of the most demanding and normal approaches to fix the WordPress white screen of death is to just to disable plugins and themes. If you are able access your admin account, then go to “Plugins” and “Deactivate” all the plugins from the bulk actions menu.

On the off chance that you can’t get to your admin you can FTP into your server and rename your plugin folder to something like plugins_1. By then check your site again. In case it works, than you should test each plugin one by one. Rename your plugin folder back to “plugins” and a short time later rename each plugin within it, one by one, until the point that you find it.

Same case goes with Themes, if you can access your admin account than replace your theme with WordPress default themes like twenty seventeen or twenty fifteen. Afterwards check your site again if it pop back again then there is some issue within your theme.

If you are not able to access admin then the process is same as Plugins, then rename your wp-content/theme folder. WordPress will then return to the most recent default theme, in the event that you don’t have some other themes, you can download Twenty Seventeen from the WordPress store and upload it to your folder. Then check your site again, if it works then there might be some issues in your WordPress theme or may be some bad updates.

• Resolve Syntax Errors
• Switch on Debugging
• Increasing Memory Limits
• Check File Permission Issues
• Check for Failed Auto-Update

2. Images not uploading

What do you call a website that doesn’t have pictures in it? – A Big No Maybe.

There can be a situation with your WordPress Website where it stops accepting any more pictures. This can happen due to two major reasons.

First, you might be running short of memory. And secondly, it could be a classic case of Faulty File Permissions. This happens due to hacking or installation of some corrupted plugin.

How to Fix?

• Launch your FTP client go through to Uploads Folder within wp-content
• Right Click on the Folder and Select Permissions
• Give permission “744” by typing it into the “Numeric Value” space
• Tick Boxes named “Apply to Directories Only” and “Recurse into Subdirectories” options
• Hit OK
• For Files, Give numeric value “644” in the “Numeric Value” space
• Select “Apply to Files” and “Recurse into Subdirectories” option
• Press OK and wait till everything comes to a still

3. Establishing Database Connection Error

The phrase itself says that database connection is broken. Don’t panic, just follow the steps mentioned below to solve the issue.

How to fix Database connection error?

• Analyse the wp-config.php file by getting to it through FTP. Ensure that the following data is right: Database name, Database username, Database password, and Database host.
• In the event if valuesare correct, then manually reset your MySQL password.
• Still if your issue is not resolved than contact your Hosting, because server might be down.

4. 404 Not Found Error

Leaving your users with 404 is crime. Although, this is one of the most common bug that can happen to your site but yes this can be avoided. We can say that if content is in the server but is not being accessible then the server returns 404 error. And the most important reason of 404 error is Permalink setting.

How to fix 404 Error?

By reconfiguring permalinks through the setting options, we can manually rewrite the rules to overwrite default permalink settings.

5. Connection Timed Out

The reasons behind this bug lies in the usage of heavy plugins, exhausted PHP memory limit, and error in theme functions.

How to fix this error?

• By extending PHP memory Limit.
• By de-activating plugins which are causing issues.
• By uploading default wordpress theme to cross verify whether your theme is creating issue or not.

6. 500 Internal Server Error

Internal server error in WordPress is the most common Bug caused by plugins or theme functions. Some other possible reasons for internal server error in WordPress that we are aware of are: corrupted .htaccess file and PHP memory limit.

How to fix this error?

• Extend the PHP memory limit.
• Edit the .htaccess file.
• De-activate all the plugins.
• Replacing wp-admin & wp-includes folders:

Replace your wp-admin and wp-includes folder with recent copies from a WordPress install. After saving upload them, and then refresh your website on browser and analyse if the error is resolved or not.

Consider hiring a Professional Website Designing Company in case you get stuck with advanced SEO Bugs or while working with an international-standard website that requires attention to details.

The post Bug Fixes appeared first on Freelance Web Designer Leeds, Rob Russell | A-XDigital.

Google defines bounce rate as:

“A bounce is a single-page session on your site. In Analytics, a bounce is calculated specifically as a session that triggers only a single request to the Analytics server, such as when a user opens a single page on your site and then exits without triggering any other requests to the Analytics server during that session.”

This is all well and good, but speeding up your WordPress website can be difficult. There are lots of popular caching plugins all promising amazing results, while many of them will just break your website.

Well, we’ve saved you the hard work and have given you a simple, easy to follow guide for speeding up your WordPress website the easy way, so you can get your site loading quickly in under 2 seconds.

Load time vs page speed score

First things first, stop looking at your page speed score, it’s useless!

Every page speed grader has different criteria for scoring a website, usually from 1-100. None of this actually matters. Some of the stuff page speed tests advise will break your website, other stuff is just not possible.

What actually matters is how long your site takes to load. This all Google and your users care about.

How to measure WordPress load time

If you’re looking to speed up your WordPress website, the first thing you need to do is figure out how fast your site is.

There are a number of free tools you can use to do this, but not all free tools are created equal.

Pingdom – Winner

Pingdom have a free page speed tool that provides a simple page speed score for your website, but more importantly, an accurate load time measurement.

Out of the big three page speed tools, I have found Pingdom to be the most reliable. Pingdom provides a reliable score for your website including the load time which is the only metric that matters.

Our website scores between 1.3-1.7 seconds on average in Pingdom, which is pretty good. It’s not quite a 1 second load, but we are constantly growing and expanding our website, and maintaining the speed of your website is an ongoing task.

I recently reduced our site load time from between 4-5 seconds by following the steps laid out later in this guide.

GT Metrix

The second most popular WordPress site speed tool, is GT Metrix. This tool is less accurate than Pingdom but is useful for getting detail on where you could make improvements to your WordPress site.

As you can see, GT Metrix suggests our site load time is 12 seconds, which doesn’t really make sense and after testing our site load time across multiple devices and browsers, is not accurate.

Google Page Speed Insights

This used to be a really useful tool, but they changed it recently and it is now useless as far as I’m concerned.

After plugging in our website, I was very confused. Check out the below results.

20 second time to interactive? You can see why I question the accuracy of this test. The only reason I would recommend using this tool, is that you might be able to get some easy to implement speed improvements by looking at the opportunity section below your score.

Turns out I’m not the only one who feels this way about Google’s Page Speed Insights, read why Google Page Speed doesn’t matter.

How to speed up your WordPress site

Now on to the fun part, speeding up your WordPress website. Just a note, if your score is already around 1-2 seconds, you will likely see small improvements and not huge decreases in load time.

To achieve scores of 1 seconds and below, you would need to be using a custom theme without any page builders and minimum plugins.

Install WP Rocket

WP Rocket is a WordPress caching and optimisation tool and is the best of its kind on the market. We’ll be using WP Rocket to apply optimisations to speed up your WordPress site. You can purchase the plugin from the WP Rocket website, then install it on your site.

Back up your site

Before you carry out any caching or optimisation on your website, you should perform a full backup. You can do this using your cPanel, or a tool like ManageWP.

If your live site receives substantial traffic or live customers for ecommerce, I would recommend carrying out your speed optimisation on a Staging environment before trying it on live.

Speed optimisations can be tried and tested safely on Staging, without impacting your live visitors negatively. You’ll need to disable password protect used on your Staging environment briefly for the page speed tools to be able to score your site (make sure to re-enable it after so that your Staging site is not inadvertently indexed by Google, or discovered in error).

Record a baseline score

Although I’m sure you already may have whilst reading this guide, perform page speed tests across Pingdom, GT Metrix and Google Page Speed Insights (or just Pingdom) and record the scores before you start optimising so that you can track your improvements.

Measuring progress

As you follow the below steps, to measure your progress you will need to periodically run Pingdom page speed tests and test your website regularly to make sure nothing has broken.

To do this, open your website in an incognito window in Google Chrome and check your site after enabling each option within WP Rocket. Alternatively, I found that clearing the cache and cookies on my phone and viewing my website in an incognito window after every fix was the most accurate way of testing that my site was not breaking.

You may also need to regularly clear the WP Rocket Cache and OP Cache which can be done from WP Rocket > Dashboard. If you have a server cache, that may also need to be flushed.

Enable mobile cache

We will progress through WP Rocket step by step testing and enabling settings to measure the performance on your site.

The first step is to enable Mobile Cache and if your site uses HTTPS, turn on caching for HTTPS.

File optimization

Optimising the files on your website can yield significant improvements for load time. To start with, implement the below actions and then test your site.

You’ll notice that we haven’t combined or minified Javascript files. The reason for this, is that it with our current site configuration, things started to break across the site. That does not mean that you cannot test it on your site, just make sure you have backed up before you do so.

We recommend that you thoroughly test any setting related to combining files, whether it be CSS or Javascript, before it is pushed live or signed off as working.

Sometimes, it appears as though no breakage has occurred, but you could still be viewing an old cached version of your site. Be certain before you push anything caching and optimisation related live by flushing all caches multiple times, and having someone else check your site in an incognito browser just to ensure you aren’t viewing anything cached by your internet network.

Media

For media rich WordPress sites, this section can be an important part of the optimisation process.

Lazy Loading of images and iframes does what you might expect. It allows the images on your website to load in the background, while the rest of the page loads quickly for the user.

This might not necessarily show the greatest gain in a page speed test, but it is a huge improvement for useability on media rich sites, as it doesn’t create a super slow loading experience when viewing galleries, media rich homepages, or pages that contain high resolution imagery.

The more complex your site, the more care you need to take when applying caching and optimisation settings. For a most simple websites, you should ideally be able to apply all or most settings in the Media section.

Disabling WordPress embeds is a quick win for any WordPress website. It prevents others from embedding content on your site, as a result eliminating any Javascript requests associated with this.

Add-ons

Scripts like Google Analytics and the Facebook Pixel should be loaded locally to further speed up your WordPress site.

Tick these two check boxes to shave a small amount off your page load (every little helps) by loading your Google Analytics script locally from your server rather than having to load it externally via a third party script.

Image optimisation

Now that we have optimised the files of our website, it’s time to look at our images. Large high quality images usually have a relatively large file size and can prevent your WordPress website from loading quickly.

To optimise your images, install Imagify on your WordPress site and follow the instructions to create an account. Once you have an account, grab your API key and plug it in by accessing the Imagify plugin in your WordPress dasboard.

Once Imagify is connected to the account you just created, all that you need to do is use the Bulk Optimizer, which will compress all of the images on your website.

You will probably need to upgrade to the paid Imagify Lite plan, which is $5 per month, to optimise all of the images on your website.

This is well worth it and a tiny investment for the page speed improvements it can yield across your site. If you regularly upload new imagery to your website, it might be worth keeping the Lite plan active and running the Bulk Optimizer once a month, if not just upgrading for one month should be enough and you could just downgrade your plan after.

Disable intensive plugins

Not all plugins are created equal. Some will slow your WordPress website down and suck up all the resources your website needs to run effectively.

For example, Contact Form 7 is an intensive plugin and will affect your load time. Finding an alternative like WP Forms would save you some load speed, or even better Elementor’s built in new form module would save you an extra plugin.

You can use GT Metrix Y Slow results to see which plugin files are CPU intensive and slowing down your website, you could also do some Googling for CPU intensive WordPress plugins and check that you aren’t using any on your site.

As well as disabling intensive plugins you should also look for where you can disable and remove plugins across your website, or perhaps substitute a plugin for some custom code, to reduce the amount of scripts that have to be loaded on your website.

Use a CDN

Please note that using a CDN requires changing your nameservers. This can break emails and existing connections to your domain. Please check with your developer or host before doing this.

Content delivery networks speed up your WordPress site in a number of ways. They serve your website to visitors from data centers that are local to them (someone in France goes through a French data center and doesn’t have to wait for a server in the UK to respond).

Cloudflare, which is the CDN we would recommend, also offers another layer of caching and some other free tools to shave off precious load time seconds.

You can easily activate the right Cloudflare settings by going to Add-Ons in WP Rocket and connecting Cloudflare to WP Rocket.

Load Google Fonts locally

Something you can do for ‘extra credit’ is to load any Google Fonts locally, from your server, instead of by loading 3rd party scripts from Google to render them.

There’s a nifty little tool called Google Webfonts Helper, which allows you to download the source files for any Google Font, so that they can be embedded on your website and applied using @font-face.

Click on the font you want to download, specify the sizes and weights then download the font in a zip file. You can even customize the folder prefix for where the fonts will be stored on your site, so that the CSS for embedding the fonts on your site has the right file path and saves you manually entering this across potentially dozens of lines of CSS.

Always be optimising!

Improving your WordPress site speed is an ongoing process and as your site grows it will require continuous optimisation.

New plugins will be added, and they could cause conflicts with your caching setup, or could slow your site load speed down considerably.

If you are adding new images and pages to your website, make sure to compress the images and check the load speed of these pages.

Remember to focus your efforts on load time and ignore those pesky page speed scores, as how quickly your site loads is all that matters!

The post Speed up your site appeared first on Freelance Web Designer Leeds, Rob Russell | A-XDigital.

Security in WordPress is taken very seriously, but as with any other system there are potential security issues that may arise if some basic security precautions aren’t taken. This article will go through some common forms of vulnerabilities, and the things you can do to help keep your WordPress installation secure.

This article is not the ultimate quick fix to your security concerns. If you have specific security concerns or doubts, you should discuss them with people whom you trust to have sufficient knowledge of computer security and WordPress.

What is Security? # What is Security?

Fundamentally, security is not about perfectly secure systems. Such a thing might well be impractical, or impossible to find and/or maintain. What security is though is risk reduction, not risk elimination. It’s about employing all the appropriate controls available to you, within reason, that allow you to improve your overall posture reducing the odds of making yourself a target, subsequently getting hacked.

Website Hosts

Often, a good place to start when it comes to website security is your hosting environment. Today, there are a number of options available to you, and while hosts offer security to a certain level, it’s important to understand where their responsibility ends and yours begins. Here is a good article explaining the complicated dynamic between web hosts and the security of your website. A secure server protects the privacy, integrity, and availability of the resources under the server administrator’s control.

Qualities of a trusted web host might include:

• Readily discusses your security concerns and which security features and processes they offer with their hosting.
• Provides the most recent stable versions of all server software.
• Provides reliable methods for backup and recovery.

Decide which security you need on your server by determining the software and data that needs to be secured. The rest of this guide will help you with this.

Website Applications

It’s easy to look at web hosts and pass the responsibility of security to them, but there is a tremendous amount of security that lies on the website owner as well. Web hosts are often responsible for the infrastructure on which your website sits, they are not responsible for the application you choose to install.

To understand where and why this is important you must understand how websites get hacked, Rarely is it attributed to the infrastructure, and most often attributed to the application itself (i.e., the environment you are responsible for).

Top ↑

Security Themes # Security Themes

Keep in mind some general ideas while considering security for each aspect of your system:

Limiting access

Making smart choices that reduce possible entry points available to a malicious person.

Containment

Your system should be configured to minimize the amount of damage that can be done in the event that it is compromised.

Preparation and knowledge

Keeping backups and knowing the state of your WordPress installation at regular intervals. Having a plan to backup and recover your installation in the case of catastrophe can help you get back online faster in the case of a problem.

Trusted Sources

Do not get plugins/themes from untrusted sources. Restrict yourself to the WordPress.org repository or well known companies. Trying to get plugins/themes from the outside may lead to issues.

Top ↑

Vulnerabilities on Your Computer # Vulnerabilities on Your Computer

Make sure the computers you use are free of spyware, malware, and virus infections. No amount of security in WordPress or on your web server will make the slightest difference if there is a keylogger on your computer.

Always keep your operating system and the software on it, especially your web browser, up to date to protect you from security vulnerabilities. If you are browsing untrusted sites, we also recommend using tools like no-script (or disabling javascript/flash/java) in your browser.

Top ↑

Vulnerabilities in WordPress # Vulnerabilities in WordPress

Like many modern software packages, WordPress is updated regularly to address new security issues that may arise. Improving software security is always an ongoing concern, and to that end you should always keep up to date with the latest version of WordPress. Older versions of WordPress are not maintained with security updates.

Updating WordPress # Updating WordPress

Main article: Updating WordPress.

The latest version of WordPress is always available from the main WordPress website at https://wordpress.org. Official releases are not available from other sites — never download or install WordPress from any website other than https://wordpress.org.

Since version 3.7, WordPress has featured automatic updates. Use this functionality to ease the process of keeping up to date. You can also use the WordPress Dashboard to keep informed about updates. Read the entry in the Dashboard or the WordPress Developer Blog to determine what steps you must take to update and remain secure.

If a vulnerability is discovered in WordPress and a new version is released to address the issue, the information required to exploit the vulnerability is almost certainly in the public domain. This makes old versions more open to attack, and is one of the primary reasons you should always keep WordPress up to date.

If you are an administrator in charge of more than one WordPress installation, consider using Subversion to make management easier.

Top ↑

Reporting Security Issues # Reporting Security Issues

If you think you have found a security flaw in WordPress, you can help by reporting the issue. See the Security FAQ for information on how to report security issues.

If you think you have found a bug, report it. See Submitting Bugs for how to do this. You might have uncovered a vulnerability, or a bug that could lead to one.

Top ↑

Web Server Vulnerabilities # Web Server Vulnerabilities

The web server running WordPress, and the software on it, can have vulnerabilities. Therefore, make sure you are running secure, stable versions of your web server and the software on it, or make sure you are using a trusted host that takes care of these things for you.

If you’re on a shared server (one that hosts other websites besides your own) and a website on the same server is compromised, your website can potentially be compromised too even if you follow everything in this guide. Be sure to ask your web host what security precautions they take.

Top ↑

Network Vulnerabilities # Network Vulnerabilities

The network on both ends — the WordPress server side and the client network side — should be trusted. That means updating firewall rules on your home router and being careful about what networks you work from. An Internet cafe where you are sending passwords over an unencrypted connection, wireless or otherwise, is not a trusted network.

Your web host should be making sure that their network is not compromised by attackers, and you should do the same. Network vulnerabilities can allow passwords and other sensitive information to be intercepted.

Top ↑

Passwords # Passwords

Many potential vulnerabilities can be avoided with good security habits. A strong password is an important aspect of this.

The goal with your password is to make it hard for other people to guess and hard for a brute force attack to succeed. Many automatic password generators are available that can be used to create secure passwords.

WordPress also features a password strength meter which is shown when changing your password in WordPress. Use this when changing your password to ensure its strength is adequate.

Things to avoid when choosing a password:

• Any permutation of your own real name, username, company name, or name of your website.
• A word from a dictionary, in any language.
• A short password.
• Any numeric-only or alphabetic-only password (a mixture of both is best).

A strong password is necessary not just to protect your blog content. A hacker who gains access to your administrator account is able to install malicious scripts that can potentially compromise your entire server.

In addition to using a strong password, it’s a good idea to enable two-step authentication as an additional security measure.

Top ↑

FTP # FTP

When connecting to your server you should use SFTP encryption if your web host provides it. If you are unsure if your web host provides SFTP or not, just ask them.

Using SFTP is the same as FTP, except your password and other data is encrypted as it is transmitted between your computer and your website. This means your password is never sent in the clear and cannot be intercepted by an attacker.

Top ↑

File Permissions # File Permissions

Some neat features of WordPress come from allowing various files to be writable by the web server. However, allowing write access to your files is potentially dangerous, particularly in a shared hosting environment.

It is best to lock down your file permissions as much as possible and to loosen those restrictions on the occasions that you need to allow write access, or to create specific folders with less restrictions for the purpose of doing things like uploading files.

Here is one possible permission scheme.

All files should be owned by your user account, and should be writable by you. Any file that needs write access from WordPress should be writable by the web server, if your hosting set up requires it, that may mean those files need to be group-owned by the user account used by the web server process.

/

The root WordPress directory: all files should be writable only by your user account, except .htaccess if you want WordPress to automatically generate rewrite rules for you.

/wp-admin/

The WordPress administration area: all files should be writable only by your user account.

/wp-includes/

The bulk of WordPress application logic: all files should be writable only by your user account.

/wp-content/

User-supplied content: intended to be writable by your user account and the web server process.

Within /wp-content/ you will find:

/wp-content/themes/

Theme files. If you want to use the built-in theme editor, all files need to be writable by the web server process. If you do not want to use the built-in theme editor, all files can be writable only by your user account.

/wp-content/plugins/

Plugin files: all files should be writable only by your user account.

Other directories that may be present with /wp-content/ should be documented by whichever plugin or theme requires them. Permissions may vary.

Top ↑

Changing file permissions # Changing file permissions

If you have shell access to your server, you can change file permissions recursively with the following command:

For Directories:

find /path/to/your/wordpress/install/ -type d -exec chmod 755 {} \;

For Files:

find /path/to/your/wordpress/install/ -type f -exec chmod 644 {} \;

Top ↑

Regarding Automatic Updates # Regarding Automatic Updates

When you tell WordPress to perform an automatic update, all file operations are performed as the user that owns the files, not as the web server’s user. All files are set to 0644 and all directories are set to 0755, and writable by only the user and readable by everyone else, including the web server.

Top ↑

Database Security # Database Security

If you run multiple blogs on the same server, it is wise to consider keeping them in separate databases each managed by a different user. This is best accomplished when performing the initial WordPress installation. This is a containment strategy: if an intruder successfully cracks one WordPress installation, this makes it that much harder to alter your other blogs.

If you administer MySQL yourself, ensure that you understand your MySQL configuration and that unneeded features (such as accepting remote TCP connections) are disabled. See Secure MySQL Database Design for a nice introduction.

Top ↑

Restricting Database User Privileges # Restricting Database User Privileges

For normal WordPress operations, such as posting blog posts, uploading media files, posting comments, creating new WordPress users and installing WordPress plugins, the MySQL database user only needs data read and data write privileges to the MySQL database; SELECT, INSERT, UPDATE and DELETE.

Therefore any other database structure and administration privileges, such as DROP, ALTER and GRANT can be revoked. By revoking such privileges you are also improving the containment policies.

Note: Some plugins, themes and major WordPress updates might require to make database structural changes, such as add new tables or change the schema. In such case, before installing the plugin or updating a software, you will need to temporarily allow the database user the required privileges.

WARNING: Attempting updates without having these privileges can cause problems when database schema changes occur. Thus, it is NOT recommended to revoke these privileges. If you do feel the need to do this for security reasons, then please make sure that you have a solid backup plan in place first, with regular whole database backups which you have tested are valid and that can be easily restored. A failed database upgrade can usually be solved by restoring the database back to an old version, granting the proper permissions, and then letting WordPress try the database update again. Restoring the database will return it back to that old version and the WordPress administration screens will then detect the old version and allow you to run the necessary SQL commands on it. Most WordPress upgrades do not change the schema, but some do. Only major point upgrades (3.7 to 3.8, for example) will alter the schema. Minor upgrades (3.8 to 3.8.1) will generally not. Nevertheless, keep a regular backup.

Top ↑

Securing wp-admin # Securing wp-admin

Adding server-side password protection (such as BasicAuth) to /wp-admin/ adds a second layer of protection around your blog’s admin area, the login screen, and your files. This forces an attacker or bot to attack this second layer of protection instead of your actual admin files. Many WordPress attacks are carried out autonomously by malicious software bots.

Simply securing the wp-admin/ directory might also break some WordPress functionality, such as the AJAX handler at wp-admin/admin-ajax.php. See the Resources section for more documentation on how to password protect your wp-admin/ directory properly.

The most common attacks against a WordPress blog usually fall into two categories.

1. Sending specially-crafted HTTP requests to your server with specific exploit payloads for specific vulnerabilities. These include old/outdated plugins and software.
2. Attempting to gain access to your blog by using “brute-force” password guessing.

The ultimate implementation of this “second layer” password protection is to require an HTTPS SSL encrypted connection for administration, so that all communication and sensitive data is encrypted. See Administration Over SSL.

Top ↑

Securing wp-includes # Securing wp-includes

A second layer of protection can be added where scripts are generally not intended to be accessed by any user. One way to do that is to block those scripts using mod_rewrite in the .htaccess file. Note: to ensure the code below is not overwritten by WordPress, place it outside the # BEGIN WordPress and # END WordPress tags in the .htaccess file. WordPress can overwrite anything between these tags.

# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>


# BEGIN WordPress

Note that this won’t work well on Multisite, as RewriteRule ^wp-includes/[^/]+\.php$ - [F,L] would prevent the ms-files.php file from generating images. Omitting that line will allow the code to work, but offers less security.

Top ↑

Securing wp-config.php # Securing wp-config.php

You can move the wp-config.php file to the directory above your WordPress install. This means for a site installed in the root of your webspace, you can store wp-config.php outside the web-root folder.

Note: Some people assert that moving wp-config.php has minimal security benefits and, if not done carefully, may actually introduce serious vulnerabilities. Others disagree.

Note that wp-config.php can be stored ONE directory level above the WordPress (where wp-includes resides) installation. Also, make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission).

If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing for it:

<files wp-config.php>
order allow,deny
deny from all
</files>

Top ↑

Disable File Editing # Disable File Editing

The WordPress Dashboard by default allows administrators to edit PHP files, such as plugin and theme files. This is often the first tool an attacker will use if able to login, since it allows code execution. WordPress has a constant to disable editing from Dashboard. Placing this line in wp-config.php is equivalent to removing the ‘edit_themes’, ‘edit_plugins’ and ‘edit_files’ capabilities of all users:

define('DISALLOW_FILE_EDIT', true);

This will not prevent an attacker from uploading malicious files to your site, but might stop some attacks.

Top ↑

Plugins # Plugins

First of all, make sure your plugins are always updated. Also, if you are not using a specific plugin, delete it from the system.

Top ↑

Firewall # Firewall

There are many plugins and services that can act as a firewall for your website. Some of them work by modifying your .htaccess
file and restricting some access at the Apache level, before it is processed by WordPress. A good example is iThemes Security or All in One WP Security. Some firewall plugins act at the WordPress level, like WordFence and Shield, and try to filter attacks as WordPress is loading, but before it is fully processed.

Besides plugins, you can also install a WAF (web firewall) at your web server to filter content before it is processed by WordPress. The most popular open source WAF is ModSecurity.

A website firewall can also be added as intermediary between the traffic from the internet and your hosting server. These services all function as reverse proxies, in which they accept the initial requests and reroute them to your server, stripping it of all malicious requests. They accomplish this by modifying your DNS records, via an A record or full DNS swap, allowing all traffic to pass through the new network first. This causes all traffic to be filtered by the firewall before reaching your site. A few companies offer such service, like CloudFlare, Sucuri and Incapsula.

Additionally, these third parties service providers function as Content Distribution Network (CDNs) by default, introducing performance optimization and global reach.

Top ↑

Plugins that need write access # Plugins that need write access

If a plugin wants write access to your WordPress files and directories, please read the code to make sure it is legit or check with someone you trust. Possible places to check are the Support Forums and IRC Channel.

Top ↑

Code execution plugins # Code execution plugins

As we said, part of the goal of hardening WordPress is containing the damage done if there is a successful attack. Plugins which allow arbitrary PHP or other code to execute from entries in a database effectively magnify the possibility of damage in the event of a successful attack.

A way to avoid using such a plugin is to use custom page templates that call the function. Part of the security this affords is active only when you disallow file editing within WordPress.

Top ↑

Security through obscurity # Security through obscurity

Security through obscurity is generally an unsound primary strategy. However, there are areas in WordPress where obscuring information might help with security:

1. Rename the administrative account: When creating an administrative account, avoid easily guessed terms such as admin or webmaster as usernames because they are typically subject to attacks first. On an existing WordPress install you may rename the existing account in the MySQL command-line client with a command like UPDATE wp_users SET user_login = 'newuser' WHERE user_login = 'admin';, or by using a MySQL frontend like phpMyAdmin.
2. Change the table_prefix: Many published WordPress-specific SQL-injection attacks make the assumption that the table_prefix is wp_, the default. Changing this can block at least some SQL injection attacks.

Top ↑

Data Backups # Data Backups

Back up your data regularly, including your MySQL databases. See the main article: Backing Up Your Database.

Data integrity is critical for trusted backups. Encrypting the backup, keeping an independent record of MD5 hashes for each backup file, and/or placing backups on read-only media increases your confidence that your data has not been tampered with.

A sound backup strategy could include keeping a set of regularly-timed snapshots of your entire WordPress installation (including WordPress core files and your database) in a trusted location. Imagine a site that makes weekly snapshots. Such a strategy means that if a site is compromised on May 1st but the compromise is not detected until May 12th, the site owner will have pre-compromise backups that can help in rebuilding the site and possibly even post-compromise backups which will aid in determining how the site was compromised.

Top ↑

Logging # Logging

Logs are your best friend when it comes to understanding what is happening with your website, especially if you’re trying to perform forensics. Contrary to popular beliefs, logs allow you to see what was done and by who and when. Unfortunately the logs will not tell you who, username, logged in, but it will allow you to identify the IP and time and more importantly, the actions the attacker might have taken. You will be able to see any of these attacks via the logs – Cross Site Scripting (XSS), Remote File Inclusion (RFI), Local File Inclusion (LFI) and Directory Traversal attempts. You will also be able to see brute force attempts. There are various examples and tutorials available to help guide you through the process of parsing and analyzing your raw logs.

If you get more comfortable with your logs you’ll be able to see things like, when the theme and plugin editors are being used, when someone updates your widgets and when posts and pages are added. All key elements when doing forensic work on your web server. The are a few WordPress Security plugins that assist you with this as well, like the Sucuri Auditing tool or the Audit Trail plugin.

There are two key open-source solutions you’ll want on your web server from a security perspective, this is a layered approach to security.

OSSEC can run on any NIX distribution and will also run on Windows. When configured correctly its very powerful. The idea is correlate and aggregate all the logs. You have to be sure to configure it to capture all access_logs and error_logs and if you have multiple websites on the server account for that. You’ll also want to be sure to filter out the noise. By default you’ll see a lot of noise and you’ll want to configure it to be really effective.

Top ↑

Monitoring # Monitoring

Sometimes prevention is not enough and you may still be hacked. That’s why intrusion detection/monitoring is very important. It will allow you to react faster, find out what happened and recover your site.

Top ↑

Monitoring your logs # Monitoring your logs

If you are on a dedicated or virtual private server, in which you have the luxury of root access, you have the ability easily configure things so that you can see what’s going on. OSSEC easily facilitates this and here is a little write up that might help you out OSSEC for Website Security – Part I.

Top ↑

Monitoring your files for changes # Monitoring your files for changes

When an attack happens, it always leave traces. Either on the logs or on the file system (new files, modified files, etc). If you are using OSSEC for example, it will monitor your files and alert you when they change.

Goals # Goals

The goals of file system tracking include:

• Monitor changed and added files
• Log changes and additions
• Ability to revert granular changes
• Automated alerts

Top ↑

General approaches # General approaches

Administrators can monitor file system via general technologies such as:

• System utilities
• Revision control
• OS/kernel level monitoring

Top ↑

Specific tools # Specific tools

Options for file system monitoring include:

• diff – build clean test copy of your site and compare against production
• Git – source code management
• inotify and incron – OS kernel level file monitoring service that can run commands on filesystem events
• Watcher – Python inotify library
• OSSEC – Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

Top ↑

Considerations # Considerations

When configuring a file based monitoring strategy, there are many considerations, including the following.

Run the monitoring script/service as root

This would make it hard for attackers to disable or modify your file system monitoring solution.

Disable monitoring during scheduled maintenance/upgrades

This would prevent unnecessary notifications when you are performing regular maintenance on the site.

Monitor only executable filetypes

It may be reasonably safe to monitor only executable file types, such as .php files, etc.. Filtering out non-executable files may reduce unnecessary log entries and alerts.

Use strict file system permissions

Read about securing file permissions and ownership. In general, avoid allowing execute and write permissions to the extent possible.

Top ↑

Monitoring your web server externally # Monitoring your web server externally

If the attacker tries to deface your site or add malware, you can also detect these changes by using a web-based integrity monitor solution. This comes in many forms today, use your favorite search engine and look for Web Malware Detection and Remediation and you’ll likely get a long list of service providers.

The post Secure your WordPress Website appeared first on Freelance Web Designer Leeds, Rob Russell | A-XDigital.