How to protect your site from hackers?

What motivates hackers?

The main motivation of hackers is usually money. Their goal is to use your site for activities that bring them a good profit.

In some cases, this may be an order from your competitor, and in others, the purpose may be to perform unethical or even illegal activities through your site, and in the end, as the owner of the site, you will be the only one responsible.

As we said, sometimes your site can be attacked at the behest of your competitors. The prices for this are not particularly high anymore. They start at around $50, which means that if one of your direct competitors is just jealous of your success, they can easily pay a hacker to seriously damage your site.

Another reason could be the competition in search engines (mostly Google). If you actively promote your site, regularly take care of its optimization, and publish paid ads, as a result of which your site ranks in the top positions in Google, this can also be a motive for hacking by competitors, even unknown to you.

In many cases, hackers are not at all interested in your company in particular or the content of your site. They usually aim to use your server for purposes that make them money, such as sending SPAM via e-mail or taking advantage of your web space to store and distribute files with illegal content.

In our practice, for example, we had a case where clients sought our assistance when their high-ranking travel website was hacked and filled with pornographic pages, which were not even visible through the main site. Unfortunately, the owners didn’t notice for months and only found out about the hack when Google completely banned their site as a touristic one and started ranking it as a porn website. Of course, from that moment on, the site became practically unusable and the company had to register a brand new domain and start its Internet presence from scratch.

The bad news and the most unpleasant thing here is that when these abuses (or sometimes even crimes) get finally revealed, the ultimate culprit and victim almost always turns out to be you alone.

Types of hacker attacks

DDoS attack

The meaning of the term DDoS is “Distributed Denial-of-Service”. The principle of this type of attack is extremely simple: a large number of requests to one page of the site are generated through multiple computers until the server on which the site is installed gets overloaded and runs out of resources.

Then, usually, automatically, the server terminates access to the attacked site as a security measure. The result is that instead of the requested page from your site, a white box appears on the users’ screen. Your site simply disappears until the DDoS attack is stopped.

Access to the site administration

This is a situation where attackers somehow gain access to the admin panel of your site. The consequences can be different: from removing the website as a whole to partial changes in the structure or content of the site. As a result of such access, the following consequences may occur:

Installation of malicious code (virus) on the site

This is an advanced and extremely dangerous form of harming your site and business as a whole. In this way, your website will start a malicious and usually illegal activity, and in addition to potentially harming many of its users, it will gain a bad reputation as a virus spreader, which can be followed by very unpleasant and long-term penalties from Google and other Internet institutions.

By gaining access to your site, hackers could also gain access to confidential information such as your customer list, your online store database, order statistics, etc.

One of the particularly unpleasant and hard-to-detect consequences of a hacker attack is making “minor” changes to the site’s settings, such as turning off access to it from search engines. In such a case, your website will soon completely disappear from the results of Google, Bing, and other search engines, and everything on it will at first glance work perfectly normally.

SQL injection

In a SQL injection attack, attackers can use a web form field or URL parameter from your site to access or manipulate your database.

With improperly created online forms, it is possible in this way to “insert” malicious code into the form’s request to the server, so that, for example, a simple contact form is used to change tables, retrieve information, delete or change information from the database data on your site.

How to reduce the risk of hacking?

First of all, although an impenetrable and totally hacker-protected site does not exist, there are a number of ways to reduce the probability of your site being “hacked” to an acceptable minimum.

Hacker attacks have always existed, exist, and always will be there. You cannot stop them. However, you can create obstacles for hackers to prevent their attacks from succeeding.

Always have a backup copy of your website

You should always be prepared for the worst! Whatever precautions you take, it’s important to be able to restore your site “from scratch” at any time.

I won’t tire of repeating how important it is to back up your site regularly. This will really save you a lot of time and nerves if something goes wrong. There are many plugins for WordPress that allow you to do just that – back up your site. Take advantage of it. Back up your site whenever there is a major change in its content. This will save you a lot of nerves, and most likely money.

Hide the version of WordPress

All hackers know that some older versions of WordPress are vulnerable, and often the problems that exist in these older versions are well described on the forums, making them the main target of attacks. Unfortunately, the version of WordPress running on your site is easy to determine, and this gives hackers valuable information on how to break into your site.

So, first of all, regularly update WordPress to the latest possible version, and if you can’t do this really regularly, try to hide the version of WordPress on your site. For this purpose, there are also free plugins (plugins) that will deprive your potential hackers of a valuable source of information about the vulnerabilities of your site.

Restrict access to WordPress administration by IP address

This is an extremely effective method of protecting your site, but unfortunately, it is not always applicable.

As we know, every computer connected to the Internet has its own unique IP, and in WordPress, there is an option to allow access to the administrative panel only to a certain IP address, for example, that of your computer. In this way, access to the administration of WordPress will be given only from your computer.

However, in order to use this method, your computer needs to have a permanent (static) IP address, and in most cases, Internet access providers in our country provide dynamic IP addresses, that is, your computer will probably have a different IP address the next time you connect to the Internet. Therefore, this method of protection is used relatively rarely.

Modify the WordPress administration URL

In a standard installation, the WordPress admin panel is accessed through a permanent URL, which is usually your-domain.com/wp-admin/. Naturally, all hackers know this very well and try to enter the administration through this URL. There are even bots (computer programs) that automatically try through this address to reveal your access passwords through an infinite number of iterations (trials with different alphanumeric combinations).

However, if you change this address for access to the administration, you will put another additional barrier through them. Before trying to crack your password, hackers will also need to find this unknown URL. So, always do it. There are many free WordPress plugins (plugins) that allow you to change the URL for accessing the administration.

Update WordPress and all its plugins as regularly as possible

It may seem obvious, but we won’t tire of repeating that keeping all the software running your site up to date is vital to keeping it secure.

As we have written many times when it comes to WordPress vulnerabilities, a fundamental problem of this kind of open source system is that both the systems themselves and the plugins to them are written by many programmers all over the planet. As a result, sometimes parts of this software contain “holes” and weak spots that are welcome for hackers.

The good news here is that usually the authors of WordPress and its plugins quickly find their mistakes and fix them with the next version. The bad news is that if you don’t regularly update these versions on your site, it can remain vulnerable for a long time for hackers to take advantage of.

Therefore, our hot tip is as often as possible (if you can – even daily) to check your WordPress installation for plugins that need updating and update them immediately.

Hire professionals

If everything described above seems confusing or unclear to you, hire a specialist or a company like ours to take care of the security and maintenance of your site.

Remember one thing: leaving a site based on a CMS platform like WordPress without maintenance and updates will sooner or later get you into trouble. Don’t let that happen.