With the wind blowing across my face and open spaces ahead of me, life is pretty good when I'm on my "Harley".
I ride a lot, and however liberating it may be, a good rider is always sharply aware of the risks of riding a motorcycle. A good rider knows how to prepare himself – as much as possible – for any event that might occur.
To be a safe rider, you must accept the risk that exists in riding.
I have to consider many variables, but in the end I decided that I want to ride, and I accept the fact that this activity will always involve some degree of risk.
Managing a site is no different from riding a motorcycle when it comes to taking risks and managing risk overall.
Responsibility to your audience
Although WordPress allows the site builder to go a step beyond what most website-building software allows in terms of safety, it is still web-based software, and there are inherent risks for you, for your data and for your visitors.
The safety of site visitors must be a top priority, and they must be protected from harmful content. Your site is not functioning properly if it harms visitors or your reputation.
Just like riding a motorcycle, here too you need to adopt a strategic approach to risk management in WordPress.
Here are several simple approaches to reducing risks that you should consider and implement:
1. Clean your garage
The paint on the "Harley-Davidson" is designed to last 50 years and more – even in conditions of extreme heat or cold.
is not designed to bear the weight of the ladder currently leaning against one of the garage walls, should it fall on it. Before I bought the motorcycle, I decided to clear out a few things in order to create a proper parking spot for it.
As WordPress users, we are very lucky. The WordPress core team does a good job of regularly cleaning up and refining the WordPress core.
They commit to identifying and patching vulnerabilities identified in the software. Every time a minor version is released (numbered, for example, like 3.2.x), it includes bug fixes and security patches.
Below are a few things to consider with every WordPress update:
Update WordPress core: The most important advice I can give any webmaster is to make sure they update their software on a regular basis. When the update is finished, check everything again and update a little more!
The greatest contribution to malicious attacks comes from outdated site versions, which actually account for 70% of all the cases seen in the attack history in uPress's archive – including other software besides WordPress. There are various ways to do this, and it usually takes only a few minutes to update the WordPress core.
Have you tried the automatic update feature in WordPress? It works great, it's convenient and it's located in your WordPress admin panel.
Updating themes and plugins: If everything works great, why do we need updates? For the same reason you update your software – and when it comes to plugins, even more so – because they do not necessarily go through the same testing and screening process as the WordPress core (unless you use uPress One themes and plugins).
Removing inactive plugins and themes: In August 2011, it was revealed to the public that the popular TimThumb script, which was included in popular WordPress plugins and themes, was vulnerable (to malicious attacks). Within a few days we could watch attackers exploiting this vulnerability to carry out actions ranging from flooding with SEO spam that leads to other sites, to damaging the PHP files on the server by means of meaningless characters.
As we were exposed to more and more such cases, we came to understand that most site owners hadn't realized at all that the script (and the malware) was on their server. In other cases, site owners turned off the vulnerable plugin or theme but left them on the server. The fact that the WordPress theme or plugin was turned off was irrelevant to that vulnerability. Attackers began scanning sites in search of TimThumb, and when they found it, they started running arbitrary PHP files on the server. When a plugin or theme is not active, WordPress does not load it.
However, they are still available and can be run on the server. This is one of the less visible weaknesses in a WordPress installation, and it serves as a path for hackers looking for ways to exploit the site. If you do not use a plugin or theme, remove them from the site! This is in fact true for any software: if you do not use it, simply remove it from the server. There is no reason to keep it there if it is not in use.
There is nothing worse than leaving it there, forgetting about it, and then being exposed to all kinds of nasty diseases from across the web. Ultimately, removing all unused software, files and data reduces your risk of exposing your vulnerabilities to unwanted parties, and the risk is reduced even further if you take care of updates and periodic maintenance.
updating your server: If you bear responsibility, then your hosting server should bear responsibility as well. Do they take care of regular software updates? Is your site running on the latest server software? If you are not sure, ask them! If this does not yield the results you expect, you can move to dedicated hosting for WordPress sites and start living with peace of mind.
2. Close your garage door
Obvious as it may sound, one of the things I seriously considered when I bought the motorcycle was my home situation: where would I park the new vehicle? How could I make sure it would be protected when I'm not around?
How does all this relate to WordPress? Ensuring that your local infrastructure is in the most secure state possible provides a good starting point for any work you do on the web.
Here are a few places that will help you reduce risks right from the start:
Keep your computer up to date: Make sure you apply patches or install updates regularly. "Automatic Updates" is a good method. Most operating system vendors patch their systems often – it is important to stay up to date.
Install antivirus software: antivirus programs don't only protect your computer from viruses, but are also effective at detecting malware that can attack your web properties.
Firewalls: Yes, they are still relevant.
Safe browsing: just because your site is a super ninja doesn't mean all the sites on the web are. Most viruses and malware operating on desktop computers nowadays are delivered by infected websites. If a site doesn't look right – it probably isn't right. Firefox users are invited to check out the NoScript Extension, which lets you manage the scripts loaded on a site.
3. Don't leave the keys in the ignition
I had a great day at the office a few days ago.
When I got home, I remembered that I had left the motorcycle key in the ignition lock – in the On position – and the battery had drained. Still, I was lucky. What would have happened if someone with malicious intentions had seen it? And now I had to deal with my insurance company.
The simplest forms of authentication use key mechanisms. This is one of the fastest ways for attackers to get into your site, do whatever they like and run off into the sunset.
Now I ask: are your passwords "strong" enough to fend off attackers long enough to make them lose interest in the site? Did you know that the most commonly cracked password in 2011 was "password"?
Here are the 5 worst passwords:
Password 123456 12345678 qwerty abc123
Hackers don't sit around all afternoon typing passwords for fun, hoping that one of them will be correct. They carry out automated attacks using a method called "the dictionary attack". They create a large list of common passwords and automate the attempts to find a correct password that will break into the site they are interested in.
Here are a few ways that will help you defend against password hacking:
Change your passwords often: The longer you use a password, the more time you give potential hackers to break into your data. Changing your password frequently shrinks the attack's time window.
Don't share passwords: Passwords are like toothbrushes – you should keep them to yourself, and destroy and update them if they have been exposed to others.
Don't write down your passwords: it is exactly like leaving the key in the car's lock. Anyone can use it and do whatever they please with it. Consider using password management tools, such as KeePass or LastPass.
Use a PassPhrase: This is a long password made up of several words, perhaps with some meaning, for example: F0urScoR3&s3v3NYeAr$aG0Now – a fairly complex password, but you can see it contains 3-4 words, uppercase letters, lowercase letters, numbers and symbols. There is no need to "go crazy" like the inventor of the password above, but the idea is to create as complex a set of characters as possible, which will make things very hard for any potential intruder.
4. Find a good mechanic
I don't hand my motorcycle over to just anyone. I give my heart to the motorcycle when it comes to maintenance and invest countless hours in planning the riding experience, the look, the feel. Sound familiar?
In many ways I approach my sites in a similar way, and when I choose a host server for my sites, I do in-depth research before handing over the "keys to the palace". Every time you install a plugin, or allow a web designer to make changes to your site, you hand them the key to your palace. Your host server always holds the keys to the kingdom.
Do your research, get recommendations and investigate wisely. Here are a few things worth considering before using third-party products:
Plugins: Not all plugins are created equal. Unwittingly, an inexperienced plugin developer may expose all kinds of critical elements on your site, or ruin performance. Read reviews of the plugin you are interested in and try to stick with a plugin that shows a history of updates and development here on a regular basis.
Designers: The WordPress designer community has grown significantly and there are many sources to choose from. Make sure to get recommendations for a qualified designer, and consider asking them to build their design on a framework-based theme such as Genesis. A framework will help you keep your designer focused on design and layout rather than programming. Except where a designer is also an experienced WordPress developer, programming actions can often lead to security and performance problems. Even with experienced WordPress designers, it doesn't hurt to stress the importance of site security and ask them to follow the advice in this article, as well as the basic rules of WordPress hardening from the Codex.
Hosting: Most hosting platforms are designed to suit any use and anyone. When you choose a server that specializes in WordPress and takes a proactive approach to security, your risk of experiencing performance, operational or security problems is reduced. uPress's Managed WordPress Hosting system, for example, incorporates a proactive PHP scanning array that prevents hackers from accessing its customers' sites or even obtaining information about them. It can also be said that the uPress team understands WordPress, SEO and hosting, and knows how to combine all this knowledge in supporting its customers.
I hope this article will help you ride the WordPress highways with pleasure.
As you can see, a few plans and simple steps can lead you to complete disaster, or to peace of mind. The choice is in your hands.
