Combatting Wordpress Security With WPLifeline | How to Secure Your WordPress Website 2024

Welcome, Scott, to this episode of the Content Amplification Podcast. We're going to be talking about websites, but not about how to build them, but how to keep them secure. And that is where your company, WP Lifeline, comes into play. Scott, thank you so much for talking.

No problem. Thanks so much for having me.

So as I said, uh, we're going to talk about websites, but more so the website security side. Um, Before we get into the nuts and bolts and things that people really need to understand, why website or WordPress security even more so? Why is that something that you got into?

Out of necessity, really. I got into WordPress security because after launching several online businesses over the years, I had settled in on using WordPress as the primary platform to build my own websites for my own business. And they needed to be secured. And then I had business friends who wanted websites, and so I, you know, I hosted and maintained theirs, and so security had to be part of that. And then eventually I found myself, I have this business, and with referrals and grew it from there. And so the reason I got into WordPress security is it was out of necessity. These sites need to be secured. You can't leave them wide open to be exploited because although WordPress is a very secure platform You need to close all those doors or people will get in.

Mm-hmm. And we hear time and time again people say, you know, my website got hacked. And you go to your site and it's either it's offline or there's, you know, not so ideal stuff being displayed on there. What are some of the, I guess, common vulnerabilities that WordPress faces that people may not be aware of?

I think most people are aware of you should keep the core files and the plugins and the themes updated. I think most people are aware of that. I think some people don't realize that some plugins aren't secure. They're either not updated regularly by developers, and they just have, you know, a sort of weird obscure plugin on their site, and that's a backdoor. And there's some plugins that'll let you know which ones are vulnerable and should be removed. But I think the biggest one, you know, when I hear the stories about websites being hacked, I think the biggest one is insecure passwords. And people just getting— it's like leaving your front door not even just unlocked but open. I mean, if your admin username for your WordPress website is admin and the password is password123, you're in big trouble. And I'm shocked at how many websites actually get hacked by people just being able to walk through that front door.

Yeah, you make a good point. You know, I've I've had so many clients over the years that they have a very simple password that's on there. I mean, there's probably tools out there that guess these passwords very easily for these hackers as well. Now you mentioned about plugins not getting updated. Now I think this kind of plays into going with a premium kind of paid plugin versus just searching for something for free, right? Free because I don't want to spend money on a plugin if there's a free version. But is it really free if you're looking at opening these vulnerabilities that are there, right?

No, no, absolutely, 100%.

Excellent. Now, when it comes to this, um, you know, how you've built your company WP Lifeline, a lot of businesses, I think, either they don't understand how to update, they're scared to hit that update on plugins and things like that, or they, you know, they may have, may have done it and something's broke. Tell us, tell us about what WP Lifeline does and what that can give a business owner who has a WordPress website.

Yeah, I think with the scenario you just presented, sometimes, yeah, depending on how your site's built, the plugins that are used, when you do, oh, I need to update, there's a button, I click it, I update everything, and now it's broken. One of the, one of the main things that we do is backups, so you can always roll the website back to like the previous day or a week ago. And this isn't, you know, there's a distinction between what our business does versus others. Like, we're not a hosting company, we're not like GoDaddy. The reason I want to bring this up is that sometimes with hosting accounts you get a backup included, but those shouldn't necessarily be relied upon. They will always tell you, do your own backup as well. So one thing WP Lifeline does is we have redundant backups. So there's like a backup on the hosting server, which is off the server on a separate server, but with the same company. But if something tragic happens to that company or they go bankrupt, what are you gonna do? You need to have a redundant backup as well. And I would bet you that 98%, maybe not that high, maybe 90% of people with WordPress websites, I'm safe, I've got a backup. Not if there's some tragic event that happens. It's rare, very rare. I've seen it happen once with a hosting company that I won't name. But it— that can happen. So yeah, updating, updating the plugins and themes is really important. And, and, uh, but there's sort of— there's a delicate nature to it as well. It's, um, you know, um, you can set it on auto update, you could set your plugins and themes to auto update on your own. People like, well, why do I need WP Lifeline to do this? Because it's, it's not just a very simple a science, and the example I'm gonna use, a lot of people use Elementor, which is a page builder. There's other page builders out there, and then there's add-ons for these page builders, and people can build these beautiful sites. Now if Elementor releases a new plugin update, but this add-on hasn't caught up to this new update yet, the site's gonna break. So there's a delicate balance that you need to not update your plugins and themes as soon as possible, but also you don't want to leave it too long where, you know, it could end up being a security issue or vulnerability that people can get in through. So it's a small part of what we do to secure websites, and I started writing a list earlier because I knew what we were talking about today. I'm like, there's so much that we do to help keep our clients' websites secure, but that's the biggest one. But also using other great tools that are out there, and there's many, many of them. On our server we use a, essentially it's a plugin called Munify360, which sits at the server level, and it does things like blocks IPs using a firewall. It's also scanning for malware. And then on the WordPress level, we'll also use Wordfence, which is one of the sort of the three biggest players. And with that one plugin alone, it can eliminate or help monitor some of the biggest security flaws with websites. I'm just going to name a couple of them. Like you can roll out two-factor authentication for getting access to the website. You can limit the login attempts if someone's robots. You mentioned it earlier, like if there's like a brute force attack where they're just trying to guess those easy passwords. If it spots an easy password, it'll let you know. It'll say this user has a simple password, tell them to change it. And, um, but I think keeping, keeping your, your plugins and your core files up to date and those regular backups are really, really important.

Now there may be things that, that could be going wrong with your website that, that got breached that you visibly can't see, right? Your site looks like it's working fine. I know you may have gotten some notifications from a hosting company that says there's you know, malicious files detected on your site. You may have never known that. It seemed to work perfectly fine. Um, how do you guys, guys combat that? Are you— I think you said you're scanning for this kind of stuff?

Uh, yeah. Um, so with how we— if we're hosting our client's website, we don't host all our clients' websites, but if we're hosting a client's website, we've got like 2 layers of security. So on the server, it's always looking for that malicious code. If it spots it, it actually just removes it automatically overnight.

Oh wow.

Yeah, and then, but more the WordPress level, WordFence is what we use, and quite often it gets run daily, a notification is sent, and then it can just be removed. Sometimes it's a little more complicated. Sometimes you need to actually get into the file structure and replace a file. Sometimes what happens when they sort of get in a backdoor is they replace some of these core WordPress files, Sometimes it just needs to be refreshed, like just get a new version down because it's like a fake version of WordPress. But we find WordPress really does the trick. But removing some malware is trickier than others. And like you said, sometimes you don't even notice it. We did have one client and it did get caught by the Immunify 360, which was on the server. But they couldn't see the problem. But when people were going to their website, they were being redirected to like a casino site. And then the business owner would go to their site, it's like everything seems fine. 'Cause it was some sort of intermittent sort of, it only would redirect at some times, not all the time. So it was very hard to nail down. But in the end, we did a Wordfence scan, saw the malicious code, and we just removed it. And then we reinstalled the latest version of WordPress on top of it, and then everything was fine.

So it sounds like ultimately you're giving people that peace of mind that it's just going to be taken care of, and they don't have to really worry about it. You guys are on the ball with that. Are there any types of, you know, industries or certain types of sites that should be a little more aware of, hey, you're, you're probably on a higher list of being attacked? I guess, so to speak.

Yeah, absolutely. Believe it or not, small businesses. Small businesses— the small business websites are actually targeted because quite often they can't afford some of the high-level security options that are available to corporations. I mean, I don't know what corporations pay to secure their website, but I would bet it's a fair chunk of change. And you mentioned earlier, I mean, small businesses, I mean, we're all trying to find a way to keep our expenses down and keep the money coming in. But website security is not one of those places. Anyway, so small businesses do get targeted because those doors are often not overly locked, and they can get in. And even spamming— like, we see this too with WordPress blogs where you get these weird comments like, "I really liked your blog post, but it was very generic." But what they're slipping in there is an email and also like a URL which someone's using to try and, you get some sort of backlink value somewhere else. I think that's how small business websites typically get exploited, but they know that they're more susceptible to being hacked into and either malware being laid out there or being spammed. The other two is e-commerce sites. Most e-commerce sites with payment transactions are usually offsite now through other platforms like Stripe and PayPal. But the e-commerce sites where there is actual transactions happening on the website, they will try, you know. I think those are often targeted. We don't deal with any multi-million dollar e-commerce websites, but we do have some e-commerce sites. But like I said, payments are managed off-site, so it's not so much an issue. And the last one is healthcare. Healthcare is quite— is targeted quite often just because the nature of some of the personal information that hackers can get access to, and we do have surprisingly a lot of medical professionals, and they are always concerned about that. One of the first questions is, do you encrypt data on forms on the contact form of the website? Which we do, and if there is a website out there that is not running an SSL certificate, you know, that is a big, big problem. But so healthcare, they're very conscious and concerned because I think there's certain legal requirements as well that they can be exposed to if that information gets out.

Yeah, absolutely. And by SSL, for those that aren't familiar, that's, you know, the little lock icon next to your URL when you go to the site. If it's not there, it says not secure, you don't have it. Now you mentioned, you know, some people can't afford this high-level security. What is your service, you know, on average cost with you guys, uh, for that peace of mind. And I think I've kind of, kind of would parallel to this to like, you would probably have a security system on your place of business, uh, to prevent people from breaking in. This would be a very similar—

that's actually a great analogy. I've never, I've never used that before, but, but you're absolutely right. If you have a brick-and-mortar building, um, you know, versus like an online store, I mean, yeah, you have to have those security systems in place and, and there should be various types like cameras, um, you know, breach alarms. I don't know what they help me with a brick and mortar, but, uh, um, no, absolutely. So costs, um, like anything, like even with, you know, getting a price on a website, it's like, you know, how, how long is a piece of string? Like, what, what's included? Um, but to answer your question, um, we have various levels of service that we provide. But just to get started, like, with a very secure website with us, which includes the maintenance— there's a lot included in that— and then support. People have any problem at all, they reach out to us, we will solve their problem for them. And hosting's free with us. We prefer our clients being on hosting with us because it gives us way more control to make sure things are really, really secure, because we cannot secure DreamHost as well as we can secure our own server. I'm not saying DreamHost is a poor choice. I'm just saying that if you host with DreamHost, we don't have as much control over it. I would name others: SiteGround, GoDaddy. They all have good security, but we don't have as much control over it. So to get started with us, it's $39 US a month. But we do have another package which is $99 US a month, which is more comprehensive security and also speed and performance. I know we haven't talked much about that today, but making sure that images are optimized, the website's loading quickly, cache is set properly. So those are our two sort of primary packages that most of our clients sort of sit in between. So $39 to $99 depending on what people, you know, what level of care people need.

Absolutely. And you just mentioned there about the speed and performance and everything, which is, is crucial, uh, you know, in Google's eyes, right? They want that, that good user experience, and you will get penalized, uh, in the organic search results if your site is loading very slow, um, that way. So I mean, the investment there, I mean, that part alone, but also the ability that you guys will host, including in that package, you know, saves the person that additional hosting cost, which they may be thinking right now, well, I'm paying for hosting and then I have to pay now for security. Roll it all into one. I mean, I think you guys have a really great combination here, uh, for that. Now, are you seeing— just before we wrap up, are you seeing anything like there's more attack attempts? Is this something where this is only going to get worse? I don't want to scare people, but the reality is, I mean, the more and more people are out there, AI is probably playing a part in this with trying to to build ways to exploit sites. Are you seeing this increasing, that this type of service is probably going to be a must-have for almost everybody?

I do think it's already a must-have for everybody. I think it should, you know, yeah, I think everyone has to have a couple different layers of security. But what we're seeing a lot of right now that I think people, and again, not to scare anybody, but that people should be aware of is, um, is coming through email. Um, you know, depending on how, you know, how people have their emails hosted. I mean, I'm a big fan of Google Workspace. I know Microsoft 365 has a great product as well. Um, but the free emails that come with hosting, um, they're just IMAP, and people should be wary of them, um, because there's a lot of phishing emails. And I think most people know what phishing is now, and you'll get a weird email that says says something like, you know, your hosting account's at 98%, log in now to free up more space. And so they click the button, oh, log in, and they put in their username and their password. Now they've got their hosting login detail, and they've, you know, phished that email out— or sorry, phished those login details from you. And now they're into your website, now they're into your hosting, and now they can wreak havoc. I see a lot of that right now. So, you know, I think either just be really, really wary of these phishing emails that try and pretend they're from your hosting company, or consider a more contemporary email platform. And again, I know all entrepreneurs are trying to save a buck, but free email accounts might not be the best choice for your business.

Yeah, absolutely. There's a reason why it's free.

It's not free of problems.

Yeah, that's right. Right? Yeah. There's no support behind it if it's free. For sure, right? So Scott, thank you so much for shedding the light on this, telling us what we need to know, and then also how you guys have come up with a really comprehensive solution for that. So we're going to put a link to how they can find out more, get plans from you guys, in the show notes. Anything else you want to add before we wrap up?

I can't think of anything. I want to thank you for having me today. Before we started this call, I've never been on a podcast before, so I appreciate you having me and taking a risk and giving me a chance.

So, no, I appreciate that. Excellent.

It's been a pleasure. Thank you.