“WordPress is insecure” – I hear and read this quite frequently – here’s the lowdown for normal people:<\/p>\n
WordPress is a Content Management System (CMS) used to build websites. \u00a0It is easy to use, and is now so popular that nearly 25% of the top 10 million websites in the world are built using it. \u00a0It’s popular\u00a0because it’s easy to use and there are virtually endless ways to customise it just by installing plugins and themes. \u00a0This means the cost of building a WordPress website is a fraction of the cost of developing a similar website using another platform or building it from the ground up. \u00a0Also there are, by extension of it’s popularity as a platform, loads of WordPress developers out there, so it’s easy to get help when you need it. \u00a0This reduces the ongoing cost of ownership of your website.<\/p>\n
Lots of WordPress sites get hacked into – that is true. \u00a0However there is a bit more to it than that… \u00a0Here are some of the reasons:<\/p>\n
Number 2 above is a biggie. \u00a0It is\u00a0relatively easy to install WordPress, do a bit of tweaking to the layout and populate your content. \u00a0There are many step by step guides available so lots of WordPress websites are set-up by people who aren’t working with websites on a daily basis. \u00a0Of these people, probably a very small proportion give any consideration to security. \u00a0I expect there are lots of very insecure username\/password combinations out there which is the most basic security requirement. \u00a0Of those who do look into security in any detail, almost all will be put off by technical terms such as PHP and htaccess, and terrified by concepts like Brute Force attacks. \u00a0Most WordPress websites I encounter have some serious security vulnerabilities with not even the most basic protection.<\/p>\n
This combination of extreme popularity and lack of security understanding means that statistically WordPress is the juiciest target imaginable for hackers. \u00a0If they\u00a0find a vulnerability and can exploit it, they\u00a0have the power to cause a lot of damage which seems to be what hackers like to do most of all.<\/p>\n
The most commonly exploited “vulnerability” is also the most obvious – the front door, or in this case the login screen. \u00a0If a hacker can login as a WordPress administrator, they can do pretty much anything they want to your website. \u00a0What is required to gain access as an administrator?:<\/p>\n
Number 1<\/strong> – the admin login screen for a WordPress website is by default the same for all WordPress websites, so it is very easy to find the login screen. \u00a0Changing the default admin login URL to something unique immediately makes it harder for hackers.<\/p>\n Number 2<\/strong> – \u00a0many WordPress administrators have the default username “admin”. \u00a0If this is the case and the login URL is also the default (as above), then 2 of the 3 required elements are pretty much a given and the only thing hackers need to guess is the password – see below. \u00a0Even if the “admin” password isn’t being used, quite often it is possible to figure out a person’s username because they have posted something and their display name is the same as their username – slightly harder than the “admin” username issue but not much…<\/p>\n Number 3<\/strong>\u00a0– this is a serious issue because it relies on people to pick secure passwords, and people are notoriously bad at this!<\/p>\n I’d guess that nearly half of all WordPress sites use the default admin login url and have\u00a0an administrator with username of “admin” or “administrator”. \u00a0Hackers have, amongst their arsenal of nasties, scripts which can repeatedly try to login to your website, email or internet banking account with, say, the top 10,000 most common passwords in a matter of minutes.<\/p>\n The answer to this? \u00a0Lock the front door!<\/strong><\/p>\n There are various ways to detect intrusion attempts and block them automatically. \u00a0Given that most hackers know that the admin login URL is generally the default, and it is likely that there is an administrator with username “admin” or “administrator”, they can set-up scripts to automatically try and login to WordPress websites with these default details and the most common 10,000 passwords. \u00a0This is called a Brute Force attack. \u00a0It is possible to secure your WordPress website by automatically detecting this type of intrusion and blocking the attempts.<\/p>\nOther security considerations:<\/h3>\n