What you easily can do yourself

1. Updates, Updates, Updates

At the top of the list is keeping all plugins, themes, and even the WordPress core up to date. Regular updates close known security gaps that attackers specifically exploit. Updates therefore not only bring new features, but above all important security patches.

2. Sensible user capabilities

Not every user needs admin capabilities – usually, one administrator account is sufficient. All other user should only get the capabilities they need in order to do their job. This limits the damage if a user account is compromised. A hacked editor account is significantly less critical than administrator access.

3. Delete inactive plugins

Be sure to only use plugins and themes that are actively maintained. Sometimes the author loses interest or an extension is no longer updated for other reasons. Themes and extensions that are no longer maintained pose a major security risk and should be removed promptly.

The same applies to plugins and themes that are not actively used. You try out a plugin or theme and then deactivate it again. We don’t delete them right away because we might use them after all. You should also keep an eye on this list and delete everything that is not being used.

4. Only use trustworthy sources

Only obtain themes and plugins from official and trustworthy sources. Supposed bargains, where paid extensions are offered for free or at very low prices, usually contain malicious code. This puts your entire website at risk.

5. Secure Access

You should always use strong credentials, which means, above all, good passwords (see box). Never reuse passwords, even if it makes them easier to remember. Avoid the default username “admin”, as this is always the first one tried in brute force attacks. Each user should have their own account with a secure, unique password and only be granted the necessary rights.

6. Don’t skimp on hosting

A good hosting provider protects its servers with a modern, secure infrastructure, creates regular backups, and provides expert support in case of problems. This is an important basis for the security of your website.

Hide login?

Very often, I read the following advice: you should hide the login page. This is not difficult to implement; the WP login is simply assigned a different URL. I don’t consider this measure to be very effective, because attackers can also find hidden login pages. It is better to focus on strong usernames and secure passwords.

And what about security plugins?

There are many offerings in the plugin directory under the keyword “security”. These plugins promise fast, comprehensive protection for all situations. They are available in free versions via WordPress.org or in premium versions for an annual license fee. They usually offer functions from the following areas:

• Firewall, i.e., login attempts are logged and, if necessary, the IP addresses from which the attempts originate are blocked.
• The malware scanner checks the installation for potential malicious code and compares the plugins with lists of known security vulnerabilities.
• Ways to secure user accounts and logins, e.g., by requiring strong passwords.

Many of these functions can also be handled by a good hosting provider. Depending on your hosting provider’s security standards, you may not even be allowed to install any security plugins. This is not a disadvantage, but a sign that the hosting company takes the issue seriously and takes care of it. You can often configure individual aspects in your customer menu.

The appeal of a security plugin is that it guides users through all of the above security aspects. The functions are brought together in a dashboard, where everything is clearly displayed and (ideally) well explained. However, if you want to use more than just the basic functions, you usually need the paid version. For those who have a more affordable hosting plan, a security plugin can increase the security of the website.

Instead of installing a large extension with many functions, you can also manage many aspects individually. For example, you can install a plugin that enforces strong passwords and, ideally, requires two-factor authentication for certain user groups. Or one that only allows a certain number of login attempts.

I also have other options for security scans; there are plugins and services that offer this service, either free of charge or for a fee. This often comes together with the backup function: a plugin that regularly creates backups and sends them to another server, if possible, can usually also initiate a security scan.

Conclusion on security plugins

Security plugins can help make the complex topic of security easier to understand. Some things may not seem absolutely necessary at first glance—I’m thinking, for example, of hiding the WordPress login. But when used correctly, these plugins can be helpful.

It is important to note that security plugins in particular require meticulous attention when it comes to updates. After all, these tools have extensive rights in the system and interfere deeply with a website. If a security vulnerability remains open here, the security plugin itself becomes a security risk.

The usefulness of a security plugin depends not least on the hosting. If your website is hosted by a provider that already offers sophisticated firewalls and malware protection, installing an additional extension does not add much value.
Security plugins can also lead to a false sense of security: if weak passwords are in use or there are many unmonitored admin accounts, the back door is wide open. Even a security plugin cannot prevent this.

The post Securing WordPress easily and efficiently has first been published on start the loop_.

The best way to manage secure passwords is with a password manager. This kind of software remembers all your passwords and stores them securely and encrypted. It allows you to sort and organize your passwords easily. You can add notes and see when you last changed a password, among other things.

Password managers also offer a solution to a very common security problem: using the same password multiple times. I once had a very well-thought-out password that I used in many different places. Unfortunately, this greatly increases the risk of access data falling into the wrong hands. All it takes is one leaked list containing the password.

Password managers are available for all operating systems (Windows, Mac, Linux) as well as for smartphones and mobile devices (Android, iOS). The software is quite convenient; for instance, it usually provides extensions for web browsers. The password manager also saves the URL of a login page and immediately suggests the correct combination of username and password.

This might also protect you from fake websites, as your password manager will not provide the login data since the URL is unknown. (Unfortunately, you certainly are able to add it manually. But maybe the short moment of surprise is enough to make you realize that something is not right.)

Three of the best known password managers are:

1. 1Password – A widely used password manager with many features for individuals and teams.
   Visit the website of 1Password
2. Bitwarden – Open-source password manager with secure encryption and cross-platform use.
   Visit the website of Bitwarden
3. Keeper – Great if you need to share passwords with others
   Visit the website of LastPass

This article in Wired gives you a short overview over some of the password managers.

The post Password Manager has first been published on start the loop_.

Shops store payment data, member sites have user accounts. This data — names, email addresses, passwords, payment information— can be stolen and converted into cash. On websites where user data is stored, the data is usually the target of an attack.

But what if there is no user data on the website at all? Does that automatically protect me against attacks?
Unfortunately not. Because it’s not just data that is of value to attackers.

Taking control of the website

Gaining control of a website is by far the most common motive for cybercriminals to attack a website. The goal is to gain admin access or server access. Anyone with access can insert malicious code.

Compromised websites are used to send spam emails, redirect users to phishing sites, or host malware. There are many ways to use a website for criminal purposes: gambling, pornography, fake shops, SEO spam (backlinks for other sites), affiliate fraud, and so on.

Search engine bots often detect malicious code on a website before the owners themselves do. The website is then classified as dangerous and the search engine removes the site from its index, marking it no longer accessible. Associated email addresses are also affected by such a block, they are blacklisted: All emails are marked as spam.

This can quickly result in quite extensive damage. Cleaning it up involves a lot of work. Without the help of a professional service provider, it is close to impossible for most website owners. Even if you detect and delete the malicious code, the attackers will almost certainly have left an open “backdoor” through which they can inject new malicious code at any time. Finding this backdoor is not easy. And there is no quick solution for rebuilding the site’s good reputation and search engine ranking.

At this point, it pays to have a reliable hosting company who takes security of their servers seriously: If malicious code is detected by your hosting company, they will take your website offline immediately. This way, you hopefully can avoid all the problems that come with being blacklisted.

The post What exactly do we need to protect our websites from? has first been published on start the loop_.

New versions of plugins are released relatively frequently. Depending on the number of plugins used on a website, updates may be required almost daily. The WordPress core, i.e., the WordPress CMS itself, receives minor updates approximately every 1 to 2 months, with a new version released about twice a year. Themes also receive updates, but less frequently than plugins. Updates are often security-related. So if a plugin offers an update, please do not ignore it.

Updates that close a known security vulnerability should always be installed as soon as possible.

Which plugins should be allowed to update automatically?

I roughly divide plugins into three groups:

• Plugins that are indirectly or directly important for the SECURITY of the website. These can be one of the common security plugins, plugins that create backups, and similar plugins. What they have in common is that they have nothing to do with the display of the website. At the same time, they usually have far-reaching permissions and can quickly become a risk.
• Plugins that are essential for the DISPLAY and FUNCTION of the website. Examples include WooCommerce for a shop, LearnDash for an e-learning platform, and, of course, all the additional plugins that you need to go with them.
• Plugins that do not affect the appearance or functionality but are useful tools. These include “KoKo Analytics,” “Yoast SEO,” “Enable Media Replace,” maintenance plugins, or something like “Admin Columns.”

Before enabling automatic updates for a plugin, you should ask yourself the following questions:

• How high is the risk if this plugin runs in an outdated version?
• How big is the danger that something on the website will break because of the automatic update? Like, for example, the display not working anymore, or the shop having a problem?

In addition, conflicts can always arise when two plugins clash after an update. Unfortunately, this cannot be completely ruled out.

Plugins that I usually update automatically

The plugins in the first group, i.e., those that are security-related but run in the background, are usually at the top of my list for automatic updates. Especially if a security vulnerability becomes known, I want it to be closed as quickly as possible.

I also frequently use automatic updates for plugins in the third group. This applies to all useful tools that are not directly responsible for the website’s appearance to visitors. As a rule, they should not cause errors that impair the functionality of the website.

Plugins for which I initiate updates manually

I don’t usually allow automatic updates for plugins that are essential for a web shop, an e-learning platform, or a booking system, for example. I usually read through the changelog before updating. This tells me what changes the update brings. If it’s only a minor update, the list is relatively short.
This helps me to identify potential sources of trouble. In other words, I know where I need to look more closely after the update.

With very complex systems, such as a WooCommerce shop or an e-learning platform, I have to take a close look and test thoroughly. Ideally, these updates should first take place in a staging environment, i.e., an exact copy of the website in the same environment as the live website. This allows you to update without serious consequences. If something does go wrong, you can take your time to search for the error.

How do I enable automatic updates?

Since WordPress version 3.7, it has been possible to select the option to automatically install updates for a plugin on the plugin overview page. For free plugins, updates usually come via WordPress.org. For premium plugins, for which you have purchased a license via the plugin’s website or a platform, these updates are usually delivered by these websites. In rare cases, you may need to download the latest version as a file and reinstall it.

If automatic updates have been enabled, they are usually performed once a day. Sometimes the plugin page will also indicate that an update is scheduled in x hours. Once the update is complete, the system will email the administrator’s address. If there were any problems during the update, you will also receive a message.
It is therefore important to use a current email address as the admin address so that you receive these emails.

Core updates from the WordPress system can also be updated automatically. Here, you can choose whether only minor updates, which usually contain security patches, should be performed, or whether major WordPress updates should also be performed automatically.

Pay attention to silent warning signs

It sometimes happens that a plugin is no longer being maintained. In other words, there will be no more updates at some point. This happens very quietly, and it is very easy to overlook. One indication is when the “auto-update” option disappears, meaning that the plugin can no longer be accessed via the WordPress repository.

In most cases, the old plugin still works, but it is no longer state-of-the-art and potentially unsafe. In this case, you should swiftly look for a replacement.

An exception would be if the plugin authors deliberately remove the plugin from the WordPress repository. In this case, however, a note would appear indicating where to get updates in the future and, above all, how to proceed in order to obtain them.

When an update goes wrong

Every now and then, an update causes the website to crash. In the worst case, all you see is the dreaded “white screen of death.” Then you have to find out what the culprit is and, if possible, revert to an earlier version of the respective theme or plugin. If that is not possible or practical, you have to consider whether you can replace or even delete the plugin.

The post Auto-updates on WordPress has first been published on start the loop_.