Sign up for updates.

Cavanaugh Interactive

We help you untangle the web

wordpress security

5 Steps for Protecting Your WordPress Website

by

Malware-Binary Code


Whether your website is old or new, it’s an investment you can’t afford to ignore.

In my 22 years of building websites, I’ve never seen malware incursions, malicious hacks, and virus activity on a scale so insidious and pernicious.

Waiting for a website to “fail” is like playing Russian roulette, and the odds against you increase if you don’t have a strategy for combatting constant assaults.

In some cases there’s no warning your site is infected. A worst-case scenario is finding out directly from a site visitor after their browser has flagged your site as hacked!

And there’s more involved than just a mad scramble to repair the damage. A compromised site will…

  1. Cost you out of pocket;
  2. Take unexpected time and energy;
  3. Endanger your users, causing a declining base and loss of trust in your business; and
  4. Get your site blacklisted on Google.

5 Steps to Improve WordPress Security

  1. Regular backups. Your preferred hosting package should be a Managed WordPress account that includes automatic updates, auto-restore, and site speed optimization.
  2. Run updates. When WordPress is updated, then themes and plug-ins need updates. Note: Every out-of-date plug-in is a security risk, so if you don’t need it, delete it.
  3. Set up a new admin-level user account, then delete the default Admin account. Choose a non-obvious username and secure password.
  4. Install a security plug-in like Wordfence or All In One WP Security & Firewall.
  5. Repeat steps 1-4 on a regular basis.

Your responsibility for your website doesn’t end with the launch. It’s up to you to get a plan to keep it safe and healthy by caring for it on a regular basis.

P.S. Want to learn more about setting up a maintenance plan? Just contact me and I’ll perform a quick review of your website with recommendations on how to protect your web assets.

Google to Flag All “http” Pages as Insecure by January 2018

by

Google security warning

If your website address uses the label http:// Google will soon display a red security notice that the site is insecure. The warning will become more prominent as time goes on, eventually flagging all web pages without extra security encryption.

Eventually, we plan to label all HTTP pages as non-secure, and change the HTTP security indicator to the red triangle that we use for broken HTTPS,” Chrome Security Team Emily Schechter said.

Hosting companies are making it easy to add an extra layer of security by installing a “Secure Socket Layer” (SSL) Certificate. Currently, the web has more than 50 percent of its traffic encrypted, so at this point your site may be a “late adopter” in danger of getting flagged as insecure.

WordPress is the most popular publishing platform on the web, powering almost 30 percent of all websites. If you have a WordPress site and have any kind of contact form set up, that page may already be flagged by Google as a security threat in the newest version of Google Chrome v.62, just released in October. Soon, that warning will extend to all your other pages, creating the impression that your site isn’t safe and should be avoided.

What Should I Do?

If your website is still using http://, here are some logical steps about what to do next:

• You need an SSL certificate to enable https on your site. This sets up a more secure connection between your site and visitors, preventing “man-in-the-middle attacks” and verifying site ownership. Benefit: Visitors see you’re protecting their sensitive information and you’re less likely to suffer a site hack.

• Be sure to purchase the right kind of certificate. A single certificate is issued for one domain name, but there are multi-domain and wildcard certificates as well. Benefit: Your business is verified as the owner of the domain name.

• If you already have an SSL certificate installed, make sure it’s up to date and robust. If purchased from your hosting service, make sure they offer technical support. (Do you check your smoke alarm battery periodically? Making sure your site is running up to date is pretty much the same thing!)

• Verify that your HTTPS pages can be crawled and indexed by Google to maintain site rankings.

Here’s How to Begin:

  1. Check your website for http:// and if that’s your connection, you need an SSL certificate to protect your site from the Google warning that your site is “insecure.”
  2. Check with your webmaster (if you have one) about securing your site.
  3. If you don’t have an “official” webmaster, contact your web designer—the person who set up your site in the first place. That person should be able to help you choose the right certificate and get it installed.

Don’t hesitate to ensure your site’s credibility. The clock is ticking and all too soon you’ll see the dreaded warning sign on your site telling visitors your site is not secure.

Not sure about resolving this issue soon? I love to help people solve technical problems. Just call Nancy at 414.771.8906 or email nancy@cavanaughinteractive.biz.