AJ Kumar | Entrepreneur
WordPress is arguably the web’s most popular content management system and blogging platform, and for good reason. The system is free, easy to use and provides a wealth of features that would otherwise cost business owners thousands of dollars in development expenses.
But if something sounds too good to be true, it usually is. While the WordPress platform still represents a useful web development option for small businesses, it’s critical that you familiarize yourself with some of the system’s weaknesses to avoid its hidden security dangers.
WordPress updates its platform frequently to respond to known threats but isn’t able to police every possible one. Here’s a look at the platform’s three biggest security weaknesses that you should be aware of:
1. WordPress is susceptible to attacks and URL hacking.
The WordPress platform executes server-side scripts in the PHP web development language, using commands sent via what are called URL parameters to control the behavior of the MySQL databases that store your site’s data.
If that all sounds pretty technical, don’t worry. You don’t need to understand web coding to protect your site. What you do need to know is that this type of website structure is vulnerable to a certain type of attack. Hackers can use malicious URL parameters to reveal sensitive database content, a process known as “SQL injection attacks.” Once hackers have this information, they can hijack your site and replace your content with spam or malware.
To protect your WordPress site from such an attack, consider modifying your site’s .htaccess file, which is a configuration file that enables you to control the way your hosting server behaves. You can prevent hackers’ URL parameter requests from succeeding by including the code found here.
Note that this code is intended for WordPress owners who are using Apache-based web hosting. If you aren’t sure what type of hosting you use or if you need assistance in modifying your site’s .htaccess file, contact your web hosting provider’s support team or a private web developer.
2. Free WordPress themes frequently contain security exploits.
One of the biggest benefits of WordPress is that you can install it for free, use free plugins to add functions and download free theme files to give your site an appealing look. Unfortunately, unscrupulous developers have laced downloadable theme files with everything from undetectable spam links to malware files that infect a site once the theme is installed.
To keep your website safe, download files only from sources you know and trust. Paid themes represent less of a security risk than free themes. But if you want free themes, you can scan them for malware before uploading them to detect any attacks that may have already occurred using the anti-virus program installed on your computer.
3. WordPress’s default login process can be easily hacked.
All WordPress dashboard logins are located at the same address across URLs, meaning that nearly every WordPress login page can be found here. Also, WordPress’s default settings don’t allow for secure logins. This means a site running on the WordPress platform may be susceptible to “brute force” attacks, in which bot programs try various login combinations in the hope that one lucky combination will allow access to the site.
To get a feel for how prevalent these attacks can be, consider that the sites hosted by popular blogging site Copyblogger experience between 50,000 and 180,000 unauthorized login attempts each day.
To protect your website, install the Limit Login Attempts plugin. In addition, you can work with your web hosting provider to block IP addresses that make multiple unsuccessful login attempts.
While it might sound like a lot of work to take these precautions, you can expend much more time and effort trying to fix your site if you wind up the victim of a successful hacking attempt.
