Thread by @LensDigitalUK

I have just spent the last day cleaning a WordPress site that had been infected with malware. I believe the site was attacked due to an out of date plugin that had a vulnerability. Detailed here from @wordfence - wordfence.com/blog/2020/09/m…

#wordpress #CyberSecurity #wordfence

1/

Most of the attacks on WordPress sites are crude. They are automated attacks trying to exploit commonly known vulnerabilities. Taking a few simple steps can help secure your site. It won't stop the attacks but it will make it harder for them to get through.

2/

Make sure that your WordPress admin user is not called 'Admin'. This is the most common user that is attacked. Also do not call you admin user after your domain i.e. if your domain is thisismysite.co.uk, do not call your admin user 'thisismysite'

3/

If you follow my tweets, the next point is one I keep repeating - backup your site. Install a plugin like Updraft, wordpress.org/plugins/updraf…, configure automatic cloud backups. At least if your site is hacked, you can restore the old site.

4/

Install a security plugin such as @wordfence (wordfence.com). This will prevent most attacks. They have a premium version where you get the security rules immediately. The free version get the rules after 30 days.

5/

Once you have WordFence installed, you can then enable 2 factor authentication - wordfence.com/help/tools/two…

This means that as well as userid / password to login, you will need something else - usually an app such as Authly.

6/

Keep your WordPress Core / Themes and Plugins up to date. One of the most common methods of attack is to exploit vulnerabilities in outdated plugins.

If you subscribe to the @wordfence blog, you will get notified when they identify any new vulnerability.

7/

We can help to make sure that your site is secure or if the worst has happened, we can help to recover your site.

Drop us an email on [e-mail]

wearelens.co.uk

8/ End

@threadreaderapp unroll please