0

For many years I've been using WordPress as a platform for websites, it is convenient to me as a developer and for customers. But recent months, several sites of my clients were hacked and I'm concerned about this problem.

  1. If you do not consider the option of password brootforcing, how hackers can get access to the file system of the site and upload malicious files there?

  2. Is it real protect site without using Security Plugins (e.g. iThemes Security), which create additional load? What would you advise on server-side?

  3. Is it real to protect WordPress without updates? Sometimes there is no way to automatically update old projects. Two sites have been hacked: v3.x (which is understandable) and v4.x (up to date)

I would be grateful for your advice, because I have very little meaning in this...

Improve this question
2
  • 2
    This may not answer your question directly but by being a part of a big platform that is targeted in such attacks, all you need to add is a unique/strong security question on Login page. Then also make sure you do not install too many BS plugins, and if you do, grab a moment and read through the code to understand what exactly it is doing... some functions may raise an eyebrow. Bring everything to minimum and always update WordPress when updates are available, same with plugins you are using.
    – Christine Cooper ♦
    Jan 9, 2015 at 14:08
  • 2
    The only time I got caught with uploaded malicious files was on the one site where I happened to install the MailChimp plugin (~3 million downloads) and forgot about it and then got hit with blog.sucuri.net/2014/07/… - 5 months after the vulnerability was announced! Very embarrassing (and tedious to fix).
    – bonger
    Jan 9, 2015 at 14:53

1 Answer 1

Reset to default
5

But recent months, several sites of my clients were hacked and I'm concerned about this problem.

In my experience pattern of hacks in quick succession indicates a common link. Typically it is vulnerable plugin/theme or incompetent hosting.

If you do not consider the option of password brootforcing, how hackers can get access to the file system of the site and upload malicious files there?

Hacking is arms race by nature. If there was a way to simply enumerate the ways in which hack can occur then it would be possible to simply close all of those ways. But it's not.

Is it real protect site without using Security Plugins (e.g. iThemes Security), which create additional load? What would you advise on server-side?

Plenty of developers I know are extremely skeptical of WordPress security plugins. There are a lot of installations out there not using them and working just fine.

Personally the one addition I consider necessary is plugin for two-factor authentication. It has low probability of causing issues and keeps access secure even if credentials were leaked.

Is it real to protect WordPress without updates? Sometimes there is no way to automatically update old projects. Two sites have been hacked: v3.x (which is understandable) and v4.x (up to date)

No, it is not. By nature of software any large project still contains security vulnerabilities to be discovered. For each major release of WordPress there are typically couple minor releases with bugfixes and security fixes.

Recent versions of WordPress started to automatically update for security releases. You could consider opting in to major releases as well, but that comes with increased risk of things breaking without testing.

Overall staying on specific version of WordPress indefinitely is simply bad.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.