Is it possible to avoid being hacked?

When launching a web site, security is a very important aspect to consider. Getting hacked is the last thing you want. Is WordPress safe? Can we really eliminate risks?

Is avoiding being hacked really possible?

In fact, completely eliminating risk is impossible. Whoever tells you otherwise is wrong. There are far too many variables in the equation to say that risks can be reduced to zero. However, there are many ways to minimize them.

To many, the threat may seem small, but in fact it has never been greater. Twenty years ago, hackers were targeting institutions such as government agencies and large corporations in an effort to cast them in a bad light. Now, a website could be compromised for months before you’d even know about it.

What are the motivations behind website hacking?

Despite popular belief, being an independent worker or a big corporation has very little influence on the chances of being hacked. There are many reasons to hack a site and that’s why in fact, EVERYONE IS A TARGET!

Theft of information is the main reason why large companies are hacked. However, the theft of resources now means that everyone can be a victim. But what is resource theft?

This is the use of company resources (web hosting, email server, etc.) without your consent in order to execute a fraudulent action. The most obvious example would be to hack your website in order to use it to send SPAM. Basically, it has no impact on your daily business… until your server is banned and no longer authorized to send email because of these intruders’ activities. Even worse: your web hosting provider could suspend your account or the police may come visit you.

To this is also added the fact of using your site to do “SEO Spam” (or spamdexing) which consists in coming to modify the structure of the page of your website in order to make references to other sites. The purpose of this is to try to increase the rank of another site’s page in search engines via your website. Consequently, your website will be discredited and your SEO ranking in search engines will drop drastically. All this, of course, can be done without any visual change on your site.

How to reduce the chances of being hacked?

The paradox is that the solution is both simple and complex While the steps to follow are simple, their implementation may not be as straightforward since you may not have all the access needed to achieve your goals depending on the type of hosting you are using.

1. Be up to date
   Whether it’s for WordPress, your theme or your plugins, everything needs to be up to date. This also includes your hosting when it comes to PHP, MySQL, Apache/Nginx and all other server tools that are installed.
2. Use complex and different
   passwords Gone are the days when we had the same password that we reused everywhere. You can use a solution like 1Password or LastPass to manage multiple passwords.
3. Minimize access
   If a user doesn’t need to be an administrator, give them less access. If a user does not need access, then revoke it. Also, make sure that these users follow rule #2.
4. Use an SSL
   certificate Encrypting data between you and the server can avoid many problems. Especially since Google has forced the switch to HTTPS and penalizes sites that have not done so for several years!
5. Delete what is not enabled
   If themes or plugins are installed but not enabled, this represents an unnecessary risk. Remove anything that is not required.
6. Adjust the permissions of your files
   Your files should have rights to 644 while directories should be at 755.
7. Install a security
   plugin Security plugins like iThemes Security, SecuPress or WordFence can not only prevent problems, but also detect anomalies.
8. Protecting yourself with a firewall
   Using a service like CloudFlare, a WAF (Web Application Firewall) or other type of firewall like Fail2Ban can reduce the risk of intrusion and reduce the impact of attacks by acting as an intermediary between your server and your visitors.

Obviously, when it comes to reducing the risk of being hacked, making backups won’t help lower the odds of being compromised in any way. On the other hand, you will be happy to have backup copies of your site if the unthinkable were to happen and you had to get your site back up and running.

Foresight pays off

Even if it is not possible to eliminate the risk completely, by following best practices in terms of security, you will help reduce the hacker’s attack vectors. It can be expensive to fix a website or web hosting that has been hacked.

Of course, there are the costs of the malware removal of the website itself, but you also have to think about the costs of crisis management (if customer data has been stolen), the reputation damage and the negative press it can bring Believe us: prevention is better than cure!