Judging by Netflix series, hackers are either geeks with personality disorders and greasy hair (living in a musty basement, addicted to gaming and pizza) or the complete opposite – cool, destructive, funny, and dripping with charisma.
What is certain is that nerds or cool people are always, always sophisticated, creative, and sharp-minded.
But, without wishing to offend the hacker community or cast doubt on their abilities, millions of WordPress sites are hacked every year not thanks to a sharp mind or special skills, but by exploiting known weaknesses that can easily be prevented.
The fact that they exist, sometimes for years, has much more to do with human nature and the belief of those attacked that"it'll be fine" and much less to the sophistication of the attackers.
Here are 4 of the common ways to break into your site and the simple way to deal with it:
Outdated or hacked plugins
It is boring to repeat this at every opportunity, but one of the most common reasons for WordPress site breaches is Outdated or hacked plugins and according to studies, over 90% of hacked sites contained such plugins.
Dealing with it does not require special skills, but rather using plugins only from trusted sources and keeping them updated to the latest versions.
Certain hosting companies such as Kinsta, uPress, and SiteGround also offer help in this area (at uPress it is even part of the standard service).
Outdated or hacked themes
The tendency not to "touch" the theme (because the site's design might "break"; because we fell out with the site builder and he doesn't answer our phone calls; because the programmer charges for 8 hours of work; and so on and so forth) is very common, but dangerous.
As with plugins, Outdated themes expose the site to attacks and breaches. There is no choice – update.
Brute Force
a somewhat flashy name for very common, simple attacks in which the attacker tries to guess the site's password or to an account by running many combinations, and the web is full of available tools that make it possible to carry out such attacks automatically (Hydra, John the riper, ,Madusa Patator and others).
Using a strong password, unique, made up of letters, numbers and symbols (which we can remember by using a password manager, for example) will prevent a large part of such attacks, and it is recommended to add a suitable WAF service from companies such as Cloudflare or F5, which will provide an additional layer of protection by blocking suspicious and malicious activity.
DDoS – denial-of-service attacks
This is not a hack, but a disruption of the site's operation, including taking it down using flooding it with requests at a volume that the bandwidth cannot accommodate.
The great popularity of such attacks stems from the relative ease and low cost with which they can be carried out.
Relatively small attacks may cost less than $10-20 per hour, and for a few hundred dollars you can already "buy" advanced attacks that run for a relatively long time and with a huge amount of traffic.
The conclusion: if someone really wants to disrupt your site's operation, it's not even expensive.
The good news is that the solutions are fairly simple and usually effective. Services such as Cloudflare are based on a huge distribution of servers around the world, with which they deal with these attacks. Hosting companies such as Flywheel, WP engine and uPress allow integration with such services in a simple and accessible way.
So what did we have?
Nothing original, exotic or sophisticated, but definitely effective and proven ways to cause damage and even destroy sites.
Millions of sites are hacked every year – the numbers speak for themselves. Running a business is no small matter, and expenses are always too high, but Trying to save a relatively small amount of money on these basic things can easily lead to the loss of a lot of money.
Don't become part of the statistics – make sure your site is updated and protected.
