Archives for December 2019

For many of you keeping your WordPress site secure is not a top priority. Small business owners often think their site is just not big enough to be a threat from hackers. But it is easier than you think to have a hacked website.

But, hackers typically don’t care how big or small your business is. There is always money to be made from selling personal information!

As a result of the theft of customer information, the damage to your company’s reputation could also mean the loss of future income, as you will need to invest extra money to rebuild your reputation and restore customer confidence.

The Cost of A Hacked Website

WordPress is known for being one of the most user-friendly content management systems for websites. It is also a popular target for hackers and spammers. Hackers don’t spend time trying to hack platforms that no one uses – right? With a whopping 61% market share – it is a big target!

7 Types of Security Attacks and How to Prevent Them

A security attack is an unauthorized attempt to steal, damage, or expose data from an information system such as your website. Malicious hackers can go about this in a variety of ways:

1. Malware
   Malicious software – ‘malware’ – infects devices without users realizing it’s there. Variations include Trojan horses, spyware, ransomware, and viruses.
   
   Secretly infected files or software can further introduce malware to your site. You could also trigger a malware download by clicking on a link in a pop-up window or an email attachment.
   
   To prevent malware infections, you’ll want to install a security scanner. Our own security scanning feature is a low-cost and highly effective choice.
   
   If your server is compromised, you can restore your files from a backup. Tools such as our backup feature enable you to schedule copies and save them to an external destination. This way you’ll have one handy should your site become compromised.
   
   
2. Drive-by downloads
   A drive-by download is a method of distributing malware and occurs when a malicious script is inserted into a page’s PHP or HTTP. When a person visits the infected site, the malware is downloaded and silently infects, the device.
   
   The best action you can take to prevent drive-by download attacks is to keep your security systems updated and remove any unnecessary software.
   
   
3. Phishing
   Phishing is among the oldest and most common types of security attacks. These attacks have increased by 65 percent in the last year, and account for 90 percent of data breaches.
   
   This form of social engineering deceives users into clicking on a link or disclosing sensitive information. It’s often accomplished by posing as a trusted source via email.
   
   
4. Spearphising
   Spearphishing’ is a targeted attack on an individual.
   
   A high-profile example is the 2016 case of Hillary Clinton. Staff members were tricked into sharing sensitive information and credentials which led to stolen data.
   
   To minimize risk:
   Never click on or download a file that seems suspicious.
   Be wary of emails addressed generally, such as to “Dear Friend” rather than to you specifically.
   Notice any glaring spelling or grammatical mistakes in emails. These are particularly important to pay attention to when an email is asking for payment or personal information.
   
   
5. Brute-force attacks
   In brute-force security attacks, hackers often use dictionary software to repeatedly and systematically attempt password combinations until they find one that works. Once the cybercriminal has access, he can wreak major havoc on your site.
   
   Users should always choose strong passwords that include a combination of letters, symbols, and numbers.
   
   
6. SQL Injections
   Structured Query Language (SQL) injections are when an attacker injects malicious code into a server to manipulate back end databases. The goal is to reveal private data such as user lists, customer details, and credit card numbers.
   
   SQL injection attacks can cause severe damage to businesses. Attackers can delete tables and gain administrative rights, although the most devastating aspect is the loss of your customers’ trust and loyalty.
   
   Injections can occur through any form element on your site, including contact forms, blog comments, and search bars. Therefore, it’s important to review your forms to ensure each field is configured for the correct entry type.
   
   
7. Man-In-The-Middle (MITM) Attacks
   With these attacks, the criminal positions themselves between your device and the server. They eavesdrop on, intercept, and manipulate communication between two parties – this often happens on unsecured wireless networks such as public WiFi,
   
   Detection of these attacks is difficult, but prevention is possible. Always use secure WiFi connections.
   
   Always install a Secure Sockets Layer (SSL) certificate on your site. This ensures communication between your website and a visitor’s browser is encrypted and inaccessible to MITM attackers. You can acquire a free SSL certificate through a provider such as BlueHost.
   

As you can see, there are many different methods cybercriminals can use to infect your site. These threats require a multi-layer approach to site security.

Our Maintenance Package includes security tools that make it easier to detect and stop attacks on your WordPress site. We also backup your site regularly. Our security scans help keep your content and users safe.

Google Blacklisting: What It Is & How to Avoid It

If you’re looking for a partner to manage your website and do what it takes to keep your WordPress site secure and humming along, check out our WordPress Maintenance Plans or contact us.