Combatting Wordpress Security With WPLifeline

Have you ever had your website hacked, or maybe there's malicious code on the site and you, you really wish you didn't have to deal with that? Well, you're probably like many people. Today's episode, we're talking to Scott from WP Lifeline, and they have an amazing solution for business owners where they take care of all the security, all the updates, and backups of your site. You don't want to miss this if you have a WordPress website. This episode is absolutely for you. Welcome, Scott, to this episode of the Content Amplification Podcast. We're going to be talking about websites, but not about how to build them, but how to keep them secure. And that is where your company, WP Lifeline, comes into play. Scott, thank you so much for talking. No problem.

Thanks so much for having me.

So as I said, uh, we're going to talk about websites, but more so the website security side. Before we get into the nuts and bolts and things that people really need to understand, why website or WordPress security even more so? Why is that something that you got into?

Out of necessity, really. I got into WordPress security because after launching several online businesses over the years, I had settled in on using WordPress as the primary platform to build my own websites for my own business. And they needed to be secured. And then I had business friends who wanted websites, and so I, you know, I hosted and maintained theirs, and so security had to be part of that. And then eventually I found myself, I have this business with referrals and grew it from there. And so the reason I got into WordPress security is it was out of necessity. These sites need to be secured. You can't leave them wide open to be exploited because although WordPress is a very secure platform, You need to close all those doors or people will get in.

Mm-hmm. And we hear time and time again people say, you know, my website got hacked. And you go to your site and it's either it's offline or there's, you know, not so ideal stuff being displayed on there. What are some of the, I guess, common vulnerabilities that WordPress faces that people may not be aware of?

I think most people are aware of you should keep the core files and the plugins and the themes updated. I think most people are aware of that. I think some people don't realize that some plugins aren't secure. They're either not updated regularly by developers, and they just have, you know, a sort of weird obscure plugin on their site, and that's a backdoor. And there's some plugins that'll let you know which ones are vulnerable and should be removed. But I think the biggest one, you know, when I hear the stories about websites being hacked, I think the biggest one is insecure passwords. And people just getting— it's like leaving your front door not even just unlocked but open. I mean, if your admin username for your WordPress website is admin and the password is password123, you're in big trouble. And I'm shocked at how many websites actually get hacked by people just being able to walk through that front door.

Yeah, you make a good point. Had so many clients over the years that, that they have a very simple password, um, that's on there. And I mean, there's, there's probably tools out there that guess these passwords very easily for these hackers as well. Now you mentioned about, um, you know, plugins not getting updated. Now I think this kind of plays into, you know, going with a premium kind of paid plugin versus just searching for something for free, right? And free because I don't want to spend money on a plugin if there's a free version, but is it really free if you're looking at opening these vulnerabilities that are there, right?

No, no, absolutely, 100%.

Excellent. Now, when it comes to this, um, you know, how you've built your company WP Lifeline, a lot of businesses, I think, either they don't understand how to update, they're scared to hit that update on plugins and things like that, or they, you know, they may have, may have done it and something's broke. Tell us about what WP Lifeline does and what that can give a business owner who has a WordPress website.

Yeah, I think with the scenario you just presented, sometimes, yeah, depending on how your site's built, the plugins that are used, when you do, oh, I need to update, there's a button, I click it, I update everything, and now it's broken. One of the main things that we do is backups. So you can always roll the website back to like the previous day or a week ago. And this isn't, you know, there's a distinction between what our business does versus others. Like, we're not a hosting company, we're not like GoDaddy. The reason I want to bring this up is that sometimes with hosting accounts you get a backup included, but those shouldn't necessarily be relied upon. They will always tell you, do your own backup as well. So one thing WP Lifeline does is we have redundant backups. So there's like a backup on the hosting server, which is off the server on a separate server, but with the same company. But if something tragic happens to that company or they go bankrupt, what are you gonna do? You need to have a redundant backup as well. And I would bet you that 98%, maybe not that high, maybe 90% of people with WordPress websites, I'm safe, I've got a backup. Not if there's some tragic event that happens. It's rare, very rare. I've seen it happen once with a hosting company that I won't name. But, uh, it's, uh, that can happen. Um, so yeah, updating, updating the plugins and themes is really important. And, and, uh, but there's sort of— there's a delicate nature to it as well. It's, um, you know, um, you can set it on auto update. You could set your plugins and themes to auto update on your own. People like, why do I need WP Lifeline to do this? Because it's, it's not just a very simple a science. And the example I'm going to use, a lot of people use Elementor, which is a page builder. There's other page builders out there, and then there's add-ons for these page builders, and people can build these beautiful sites. Now, if Elementor releases a new plugin update but this add-on hasn't caught up to this new update yet, it's got— the site's going to break. So there's a delicate balance that you need to not update your plugins and themes as soon as possible. But also you don't want to leave it too long where, you know, it could end up being a security issue or vulnerability that people can get, get in through. So it's a small part of what we do to secure websites. And I started writing a list earlier because I knew what we were talking about today. I'm like, there's so much that we do to help keep our clients' websites secure, but that's, that's the biggest one. But also using other great tools that are out there, and there's many, many of them. On our server we use a, essentially it's a plugin called Munify360, which sits at the server level, and it does things like blocks IPs using a firewall. It's also scanning for malware. And then on the WordPress level we'll also use Wordfence, which is one of the sort of the three biggest players. And with that one plugin alone, it can eliminate or help monitor some of the biggest security flaws with websites. I'm just going to name a couple of them. Like you can roll out two-factor authentication for getting access to the website. You can limit the login attempts if someone's robots. You mentioned it earlier, like if there's like a brute force attack where they're just trying to guess those easy passwords. If it spots an easy password, it'll let you know. It'll say this user has a simple password, tell them to change it. And, um, but I think keeping, keeping your, your plugins and your core files up to date and those regular backups are really, really important.

Hey there, fellow entrepreneurs. It's Shaun Whynacht, the host of this podcast. Let me ask you a question. Have you ever wanted to transform casual customers into raving fans? Well, I have a program that will do exactly that. It's called the Customer Journey Amplification System, and it's more than just a program. I personally feel it's a game changer for any small business. Together, we'll dive into every touchpoint of your business and your client's customer journey, creating brand advocates who just can't stop singing your praises the whole way. You know, it doesn't just stop there. With our 12-month ongoing support, I'll be with you every step of the way for an entire year, ensuring that your customer journey is working for your business. So if you want an experience that resonates above your competition, I invite you to visit AmplifyMyJourney.com today and find out exactly what it can do for your business. And let's start crafting that legendary customer journey together today. There may be things that, that could be going wrong with your website that, that got breached that you visibly can't see, right? Your site looks like it's working fine. I know you may have gotten some notifications from a hosting company that says there's, you know, malicious files detected on your site. You may have never known that. It seemed to work perfectly fine. How do you guys combat that? Are you— I think you said you're scanning for this kind of stuff?

Yeah, so with how we— if we're hosting our client's website, we don't host all our clients' websites, but if we're hosting a client's website, we've got like 2 layers of security. So on the server, it's always looking for that malicious code. If it spots it, it actually just removes it automatically overnight.

Oh wow.

Yeah, and then, but more the WordPress level, WordFence is what we use, and quite often it gets run daily, a notification is sent, and then it can just be removed. Sometimes it's a little more complicated. Sometimes you need to actually get into the file structure and replace a file. Sometimes what happens when they sort of get in a backdoor is they replace some of these core WordPress files, and sometimes it just needs to be refreshed. Like, just get a, just get a new version down because it's like a fake version of WordPress. But we find WordPress really does the trick. But removing some malware is trickier than others. And like you said, sometimes you don't even notice it. We did have one client and it did get caught by the Immunify360, which was on the server, but they couldn't see the problem. But when people were going to their website, they were being redirected to like a casino site. And then the business owner would go to their site, it's like everything seems fine because it was some sort of intermittent sort of— it only would redirect at some, sometimes, not all the time. So it was very hard to nail down. But in the end, we did a WordFence scan, saw the malicious code, and we just removed it. And then we reinstalled the latest version of WordPress on top of it, and then everything was fine.

So it sounds like ultimately you're giving people that peace of mind that it's just going to be taken care of, and they don't have to really worry about it. You guys are on the ball with that. Are there any types of, you know, industries or certain types of sites that should be a little more aware of, hey, you're, you're probably on a higher list of being attacked? Yeah, I guess so to speak.

Yeah, absolutely. Believe it or not, small businesses, small businesses, the small business websites are actually targeted because quite often they can't afford some of the high-level security options that are available to corporations. I mean, I don't know what corporations pay to secure their website, but I would bet it's a fair chunk of change. And you mentioned earlier, I mean, small businesses, I mean, we're all trying to find a way to keep our expenses down and keep the money coming in, but website security is not one of those places. Anyway, so small businesses do get targeted because those doors are often not overly locked, and they can get in and even spamming, like we see this too with WordPress blogs. Where you get these weird comments like, I really liked your blog post, but it was very generic. But what they're slipping in there is an email and also like a URL, which someone's using to try and, you know, get some sort of backlink value somewhere else. I think that's how small business websites typically get exploited. But they know that they're more susceptible to being hacked into and either malware being laid out there or being spammed. The other two is e-commerce sites. Most e-commerce sites with payment transactions are usually offsite now through other platforms like Stripe and PayPal. But the e-commerce sites where there is actual transactions happening on the website, they will try it. You know, I think those are often targeted. We don't deal with any multimillion-dollar e-commerce websites, but we do have some e-commerce sites. Like I said, payments are managed off-site, so it's not so much an issue. And the last one is healthcare. Healthcare is quite— is targeted quite often, just because the nature of some of the personal information that hackers can get access to. And we do have, surprisingly, a lot of medical professionals, and they're always concerned about that. One of the first questions is, do you encrypt data on forms on the contact form of the website? Which we do. And if there is a website out there that is not running an SSL certificate, you know, that's a big, big problem. But so healthcare, they're very conscious and concerned because I think there's certain legal requirements as well that they can be exposed to if that information gets out.

Yeah, absolutely. And by SSL, for those that aren't familiar, that's, you know, the little lock icon next to your URL when you go to the site. If it's not there, it says not secure. Secure, you don't have it. Now, you mentioned, you know, some people can't afford this high-level security. What is, what is your service, you know, on average cost with you guys for that peace of mind? And I think I kind of, kind of would parallel to this to like, you would probably have a security system on your place of business to prevent people from breaking in. This would be a very similar—

Yeah, that's actually a great analogy. I've never, I've never used that before, but, but you're absolutely right. If you have a brick-and-mortar building um, you know, versus like an online store. I mean, yeah, you have to have those security systems in place, and, and there should be various types like cameras, um, you know, breach alarms. I don't know what they help me with a brick and mortar, but, uh, um, no, absolutely. So costs, um, like anything, like even with, you know, getting a price on a website, it's like, you know, how, how long is a piece of string? Like what's included. But to answer your question, we have various levels of service that we provide. But just to get started, like, with a very secure website with us, which includes maintenance— there's a lot included in that— and then support. People have any problem at all, they reach out to us, we will solve their problem for them. And hosting's free with us. We prefer our clients being on hosting. With us because it gives us way more control to make sure things are really, really secure, because we cannot secure DreamHost as well as we can secure our own server. I'm not saying DreamHost is a poor choice. I'm just saying that if you host with DreamHost, we don't have as much control over it. I would name others: SiteGround, GoDaddy. You know, they all have good security, but we don't have as much control over it. So to get started with us, it's $39 US a month. But we do have another package which is $99 US a month, which is more comprehensive security and also speed and performance. I know we haven't talked much about that today. But making sure that images are optimized, the website's loading quickly, cache is set properly. So those are our two primary packages that most of our clients sit in between. So $39 to $99 depending on what people, you know, what level of care people need.

Absolutely. And you just mentioned there about the speed and performance and everything, which is crucial, you know, in Google's eyes, right? They want that good user experience, and you will get penalized in the organic search results if your site is loading very slow that way. So I mean, the investment there, I mean, that part alone but also the ability that you guys will host, including in that package, you know, saves the person that additional hosting cost, which they may be thinking right now, well, I'm paying for hosting and then I have to pay now for security. Roll it all into one. I mean, I think you guys have a really great combination here, uh, for that. Now, are you seeing— just before we wrap up, are you seeing anything like there's more attack attempts? Is this something where this is only going to get worse? I don't want to scare people, but The reality is, I mean, the more and more people are out there, AI is probably playing a part in this with trying to build ways to exploit sites. Are you seeing this increasing, that this type of service is probably going to be a must-have for almost everybody?

I do think it's already a must-have for everybody. I think it should, you know, yeah, I think everyone has to have a couple different layers of security. But what we're seeing a lot of right now That I think people, and again, not to scare anybody, but that people should be aware of is coming through email. You know, depending on how people have their emails hosted. I mean, I'm a big fan of Google Workspace. I know Microsoft 365 has a great product as well, but the free emails that come with hosting, they're just IMAP and people should be wary of them. Because there's a lot of phishing emails. And I think most people know what phishing is now. And you'll get a weird email that says something like, you know, your hosting account's at 98%, log in now to free up more space. And so they click the button, oh, log in, and they put in their username and their password. Now they've got their hosting login detail, and they've, you know, phished that email out— or sorry, phished those login details from you. And now they're into your website, now they're into your hosting, and now they can wreak havoc. I see a lot of that right now, so, you know, I think either just be really, really wary of these, you know, phishing emails that try and pretend they're from your hosting company, or consider a more contemporary email platform. And again, I know all entrepreneurs are trying to save a buck, but, you know, free email accounts might not be the best choice for your business.

Yeah, absolutely. You know, there's a reason why it's free. It's not free.

Yeah, that's right.

Right. Yeah, there's no support behind it.

That's right.

For sure. Right. So Scott, thank you so much for shedding the light on this, telling us what we need to know, and then also how you guys have come up with a really comprehensive solution for that. So we're going to put a link to how they can find out more. Get plans from you guys in the show notes. Anything else you want to add before we wrap up?

I can't think of anything. I want to thank you for having me today. Before we started this call, I've never been on a podcast before, so I appreciate you having me and taking a risk and giving me a chance. So, no, I appreciate that.

Excellent. It's been a pleasure. Thank you. I want to take a moment and thank the sponsor of our podcast, eWebinar. If you've been doing webinars for any time now, or you've even just considered starting to do a webinar, you should consider eWebinar. This platform allows you to do evergreen webinars with a feature set that is just like hosting a live webinar. Those that are in attendance can chat with you, can engage with your content, all in a recorded format. Format. Check it out. You want to learn more? Go to BlueCowMarketing.ca/eWebinar.