5 Ways To Protect Your Website Hosting

The Worry Is Real

There is a common problem when it comes to security about website hosting. Whether you are on Shopify, WordPess, or another platform…the security issues are all paramount. For now, we are going to focus on WordPress websites, and believe it or not, they are actually more secure than their online counterparts. If you are looking for the best and most reliable way to secure your WordPress Hosting, than the answer is pretty simple –pick a high quality WordPress host – we recommend Siteground!

Once you have chosen your host, here are our top 5 ways to keep your WordPress website secure.

1.Protect Your Login Page To Prevent Direct Brute Force Attacks

The standard WordPress login URL is well known. Simply take the domain name and add on /WP – login.php or /WP – admin/ and you are at the login page. It is up to you as a user or up to the individual you hire to manage your website to customize your website to make it harder for hackers to gain access.

With a brute force attack on your WordPress site, a hacker is attempting to decipher your username or password by using a trial and error approach. They are hoping that they will eventually be able to correctly guess this information and gain access to the back end of your WordPress site. This is a method that has been used for a long time, and it is still used today because it is effective.

Having a longer password makes it harder for hackers to use a brute force attack to gain access to your website. There are a number of reports of hackers attacking the same site for months or years without success because of the complexity of the password.

Over the years, hackers have developed tools to aid them in successfully using a brute force attack. One tool that hackers use is a dictionary. They may run through all of the words in an unabridged dictionary. At the same time, they will augment words with special characters and numbers. They may also use specialized dictionaries. That being said, a sequential attack is time consuming.

Some hackers avail themselves of a reverse route force attack. This attack is where hackers begin with a username or password that has been released online. Then they will start to search millions of usernames until they find a match for said password.

There are a number of tools online that are designed to help nefarious individuals successfully accomplish a brute force attack. These tools are designed to attack computer protocols, like MySQL and FTP.

• One step you can take is to add a lock-down feature after a certain number of failed login attempts have been reached. This way whenever someone tries a series of incorrect passwords, the site locks itself down. There are a number of plug-ins that you can use to this effect.
• The password that you select is also important. You want your password to be at least 10 characters long and to include numbers and symbols. If you do this, you create 171.3 quintillion possibilities. With an average computer, let’s say a GPU processor that attempts 10.3 billion hacks per second, it would take approximately 526 years to crack the password. That being said, a supercomputer may be able to crack it within a few weeks.

2. Use Two Factor Authentication For WordPress Security

Continuing with the idea of keeping your login page safe, we recommend the use of two factor authentication to get the most out of your WordPress security. At first, the idea of two factor authentication might seem a little bit like overkill. But when you look at the reality of the situation, the need for this form of security becomes clear.

Just ask yourself, how many accounts do you have online? The average consumer has around 25 accounts. Each account requires some form of login credentials. Remembering unique usernames and unique passwords for 25 or more accounts is difficult. So what people do to make things simpler is use the same password on multiple sources. This is terrible because all a hacker has to do is guess one password and then they have access to a number of accounts.

What makes things worse is that people often opt for the Keep Me Logged in option for the sites that they visit the most. What people don’t realize when they do this is that websites store cookies on the computer. Malware can harvest these cookies, giving the nefarious individual everything that they need to gain access to their private information.

Two factor authentication requires you to provide login details for two different components, usually located on two different devices. A popular option is to use the Google Authenticator app. This sends a code to your phone. The code needs to be added after your username and password on your WordPress login page. This means that only a person who has your phone will be able to log into your site.

There is a hidden level of security to this because most people who are security-conscious enough to use two factor authentication on their WordPress site are also security-conscious enough to keep their phone locked with a security code. In order to gain access to your WordPress site, a person would need to have your username and password for your login, they would need to have access to your cell phone, and they would need to know how to login to your cell phone.

3. Change Your Password Regularly

What does regularly mean? The answer is going to vary depending on how secure you want things to be. It has become common for people to opt for long passphrases that are all but impossible for hackers to predict but a lot easier for the user to remember as opposed to a bunch of random numbers and letters.

It’s easy to remember that you need to change your password frequently, but it can be hard to actually do it. This is why it is important to have a quality password manager. A quality password manager is not only going to create safe passwords for you, but it is also going to store them for you in a secure vault. You will be able to use a variety of passwords without needing to remember a variety of passwords.

What if you have a multi-author blog? Now, you have multiple people who have access to your admin panel. This only increases the vulnerability of your WordPress security. You can use a plug-in like iThemes Security, which is designed to make sure that the passwords your users select are secure. This is a precautionary measure. It might require a little bit of extra work on the part of your users, but it is worth it because it minimizes the potential risk associated with weak passwords.

While determining how frequently you should change your password is a personal decision, there are some factors that may make you decide to change your password sooner than later.

• For example, if you have logged into your WordPress account using a shared computer, such as at a library or in a hotel, you may want to change it.
• If you do not use multi-factor authentication and you have not changed your password in the last year, you may want to change it.
• If you notice evidence that malware is affecting your site or that your site has in some other way been compromised, you should change your password immediately.
• If the password you’re using for your WordPress login is the same that you use for social media, streaming and shopping services, or banking institutions, then you should change it immediately.

Changing your passwords annually will require some planning. It is recommended that you set a time aside at a predetermined interval to review all of your passwords.

4. Log Idle Users Out Of Your Site

Leaving the WP – admin panel of your WordPress site open is the same as leaving your front door open. It poses a major security threat. Anyone can change the information on your website, alter the user account, or destroy the account altogether. An easy way to fix this is see to it that after a person has been logged out for a set period of time, WordPress times out. There are a number of plug-ins that you can use designed for this purpose, and one of our favorites are Inactive Logout.