Many publishers get into a wrong assumption that hackers only target websites with high traffic volume. While it is true that big profile websites are favorite targets for hackers, that doesn’t mean regular websites are safe from malicious attacks.
In fact, did you know that hackers also take down websites just for fun? That means almost every website is prone to malicious attacks regardless of the traffic or revenue it generates.
If you’re taking the security of your website lightly, you could be allowing the bad guys to sabotage the reputation of your online business.
If you’re looking to secure your WordPress site, one of the first things you need to do is to find and fix its vulnerabilities. This is an essential task which secures your site from malicious attacks and also boosts its performance.
Let’s take a look at several ways that can help you find and fix WordPress vulnerabilities.
Precautionary steps
Remember the adage – a chain is as strong as its weakest link. Similarly, the security of your website is as strong as its biggest vulnerability.
If you’ve never scanned your WordPress website, chances are your site consists of lots of vulnerabilities. The only thing that keeps your website safe is that no one has found the vulnerability yet.
So if you’re not taking precautionary steps to find and fix the vulnerability, you’re risking the security of your site.
Taking the below precautionary steps will save your site from being fully exploited and destroyed.
Make a regular backup
One of the first things to do to secure your site is to take a regular backup of your site. Regular backup could be a life saver even in the worst case scenarios like data lose or files corruption. That means if something goes wrong, you can easily revert it back to normal.
If you’re looking for a free and an all in one solution for backing up your website, Updraft Plus plugin seems to be an excellent choice.
The best thing is that besides manual backup, it also allows you to automatically backup your content to your preferred remote location such as email, Dropbox, Google Drive, etc.
Use only official directory for free WordPress products
When you’re looking for a free theme or plugin, it is always better to look at the official WordPress directories.
Needless to say, official directories are the starting point for most new WordPress users to find legitimate WordPress themes and plugins. That being said, it is that it is not the only trustable directory for finding free WordPress themes and plugins.
So if you found a legitimate free theme or plugin outside the directory, feel free to install it on your site. However, do keep in mind that in such a case, you’ll have an extra dose of responsibility concerning the theme assessment.
Use an online malware checker like VirusTotal.com for scanning your WordPress themes and plugins before installing it. If the tool finds any infected file or a vulnerable code, it will give you a red warning signal, indicating that you’ll either need to fix the issue before installing or abandon the entire product and find an alternative one.
But what if you’ve already installed a theme and plugin on your site without checking for vulnerability? What if you’re using an outdated plugin containing lots of deprecated functions? Let’s take a look at how to scan your website to find a potential vulnerability in your WordPress install.
Plugins for finding vulnerabilities
Exploit Scanner – Find WordPress themes vulnerabilities
Did you know that a deactivated vulnerable theme is as risky as an activated theme?
So if you’ve installed too many WordPress themes on your website, it is better to remove them from your WordPress install, especially if you’re not going to use them in the near future.
If you’re looking for a free plugin that allows you to scan theme files for potentially vulnerable codes, Exploit Scanner could be an excellent choice.
Aside from scanning theme files, it also scans posts and comments tables in your database for suspicious code.
Do keep in mind that once you scanned, this plugin may return lots of false positives. You’ll need to figure out whether they are suspicious or not before going to remove those themes.
P3 (Plugin Performance Profiler) — Performance test WordPress plugins
Poorly configured plugins are one of the biggest security threats for your WordPress website. Aside from being a security threat, it also degrades the performance of your site.
So profiling those plugins is an essential task especially if you’re using too many plugins on your site. In that case, P3 plugin could be a nice choice. It gives you a detailed report on plugin execution time, performance as well as security threats.
Best of all, even if you’re not a programmer, you can scan the website and get a detailed report. The plugin’s extensive help section lets you quickly figure out what causes the performance drop. It also tells you if it needs to be fixed immediately.
In case you need an advanced help, the plugin also allows you to send a complete report to a WordPress expert right from your WordPress admin panel.
Install WP Security Audit Log plugin for security auditing
Install a free plugin like WP Security Audit Log if you’re looking for keep tracking an audit of every change on your WordPress website.
The free plugin alerts you whenever it finds a suspicious activity on your site before it becomes a problem or a security threat.
This plugin helps you to keep an eye out for potential security threats. It also helps you to check whether your site logged in users are doing what they are supposed to do.
In case you need to read the review of the plugin before installing it on your site, take a look at it here.
Monitor Google Search Console account
If you’ve been rigorously following the SEO industry news, chances are you’re already aware of the term ‘negative SEO’. In case, you didn’t hear about it yet, let me explain it. Negative SEO is a practice of degrading a website on Google and other search engines by building harmful backlinks to your website by using black-hat SEO techniques.
Besides building harmful backlinks, attackers also try to inject bad links on your website by exploiting your site’s existing vulnerabilities.
This practice is widely used by rivals to hurt their competitors search rankings.
In order to figure out if your site is affected with negative SEO, apart from scanning your website’s files and user activity, you’ll also need to regularly monitor Google Search Console account.
Check for malware warning or an unnatural link building warning in the Search Console account (Google Webmaster Tools or GWT). If you found any, probably your site is hit by negative SEO provided that you’ve not followed any shady SEO tactic against Google webmasters guidelines.
Below are a few things you’ll need to follow if you suspect a negative SEO.
- Get a reliable hosting: Before taking any reversing action, make sure your website is hosted on a secure WordPress hosting server. It is an essential step for protecting your website from possible future attacks especially if you’re currently hosting on a cheap shared hosting.
- Look for unnatural links on your website: Use a tool like Ahrefs to find out whether there are any unnatural links on your site.
- Look for plagiarized content: If your site is accused of copyright infringement, use a premium tool like Copyscape.com for finding plagiarized content on your site. Once you found that your content is being distributed on many websites, you’ll need to request those publishers to delete those duplicated content before taking a legal action.
What’s your take on WordPress vulnerabilities? Do you find the platform secure enough not to take these precautionary steps?
Latest posts by Shahzad Saeed (see all)
- How to Find & Fix WordPress Vulnerabilities - January 13, 2017