In this solo podcast episode, Shaun Whynacht connects the heightened cyber‑threat landscape—spurred by the Russia‑Ukraine conflict and related sanctions—to the everyday security needs of marketers and e‑commerce site owners. He explains how automated bots target WordPress sites, injecting malicious code that can hijack pages, steal data, or get the domain blacklisted. Shaun then outlines four concrete, actionable measures to protect online assets: (1) install an SSL/TLS certificate and verify HTTPS; (2) deploy a web‑application firewall, recommending Sucuri for its DNS‑level filtering and cleanup service; (3) enable two‑factor authentication (2FA) via plugins or authenticator apps; and (4) use strong, unique alphanumeric passwords managed with a password‑manager such as LastPass. Throughout, he stresses the urgency of these steps given the volatile geopolitical climate, provides practical “how‑to” checks (e.g., looking for the lock icon in browsers), and encourages listeners to consult the show notes for links to the tools mentioned.
Chapters
So this week around the world, there's been a lot happening. If you've been following the news around Russia's attack on the Ukraine, and then how all the other countries have been reacting to this with, you know, the US putting sanctions on Russia, Canada putting sanctions on Russia. And what does that really mean to you? This is a marketing podcast. So let's just think about that. You know what, Russia has been a competing force. I don't know if that's really the best word, competing, but they've been a threat, a threatening force in the whole cyber attack world for quite some time now. You know, there's been rumors and allegations and maybe even proof that they have interfered with elections in the US in past years. But Russia has come out and said that they are actually going to embark on cyber attacks and cybersecurity warfare against anyone who stands against them. So what are we seeing in the world of marketing right now? Where do we stand? What should you be considering even though you may just have a website for your e-commerce store? Maybe you got a big business and you have a lot of online assets that you have to take into consideration. Well, here's what I'm going to tell you. It's extremely important to have your sites secure. And, you know, even more so now, but even, you know, there's a lot of hackers out there that are creating bots that are trying to, you know, interfere with your web, your WordPress website logins, all that kind of stuff. And every time that a plugin becomes out of date, you know, there's a potential security loophole in that. And if you've ever had to deal with a site being hacked, if you've ever had to deal with malicious code being injected on your site, it can be very frustrating, painful, and it can easily be cleaned up with the right methods. But still, it takes a lot of time and effort. And if you don't you know, don't mitigate that risk, if you don't eliminate that threat, if you don't clean those files, there's a bigger issue that you have to deal with, and that's with your domain getting banned and blacklisted. And if you go down that route and you get that far, it's very hard to get that turned around. So in today's episode, this is what I want to talk about. I want to give you some experience that I've had, what we've had to deal with in that world. And then also how we've been able to turn that around and clean things up and secure and, and really kind of put those fences up. So let's talk about WordPress. That's the website builder that we use for all of our client sites, what we use in our own company. And you know, there's a lot of automated threats out there. We talked about malicious codes and bots and things like that. And what they're doing is they're running a software script that is really just looking through the internet for holes in WordPress sites. Code that allows them to get in. And once they get in, they basically just upload files and then a file takes over. And in some cases it can shut down the entire site and break it, but in other cases, uh, you know, it can inject content on there. A lot of time it's like Viagra content and, you know, in some cases pornography. But in most cases what it wants to do is just cause mass spreading and infect other sites that come there. There are people that will inject code to steal personal information, to steal credit card information if you are processing transactions. So here's a couple things that I would recommend you do to make sure that your site is secure. Number 1, make sure that your site has a security certificate, also known as SSL, a secure layer on that site. How do you know if your site does? Well, there's a very simple way to do that. Just go to your website domain in a browser, and does a little lock show up? Next to the URL. If it does, then you have that security layer in place. Now Chrome has made it a lot easier to kind of see if it doesn't exist because it actually says not secure, right? I mean, how more forthcoming do you have to be with that? If it says not secure, that's one number one thing you need to look at. And it's not that hard if you use certain web hosts. A lot of times that's included free of charge. You just need to turn it on and just contact the tech support or call your web person and say, hey, you know what, You know, let's get this, get this locked up and in place. The other thing is putting in a firewall. Now we've done that for a couple of our clients' sites who unfortunately have gotten malicious code injected. And, you know, we've had it cleaned and everything. And there's a company called Sucuri, S-U-C-U-R-I. We are not an affiliate. We're not being paid to say this, but the reason I'm talking about it is because I absolutely love how they work. You know, it's about $200 US a year to have your site secured by this, the service. And how it works is we redirect your domain, so your domain address goes to their name servers, so their servers first. It's just a loop through, and what it's doing is that's the firewall, that's the wall that's filtering for all this malicious traffic and blocking it, and then it will redirect over to your web host. Really beneficial from that firewall side. But the real bread and butter comes down to— and this is the part that I absolutely love— if by any chance that your site does get hacked, even if you don't have the service and it's been hacked, you have a lot on there and you don't know how to clean it up, your web person doesn't, and you're freaking out, when you buy that $199 service or $299— they have different levels— they will clean it up. You give them access to the site, they will go in, they will scrub it completely clean, make it compliant, make it functioning, everything's great. Uh, and then you integrate that firewall. And then if for some reason it does get by, they clean it up again for you. Well worth the investment than having to, to run that risk. Also, if you're taking e-commerce transactions on your website, you don't want to not have something of secure nature there, especially if people are putting in those credit card details on your site. For one, it needs to be secure, and two, if you have that firewall, firewall, it's going to have that extra level of protection. And the third thing that I'm going to recommend, and I know you hate this, I know I hate this, I hate having to do this for any sites or any services, is two-factor authentication. If you don't know what two-factor authentication is, you've probably come into, uh, you know, been encountered with it where you go to log in and it sends you an either an email with a code or sends you a text message with a code, or now they've got authenticating apps. That you just log into and it generates a code every 60 seconds and you can just type it in. That is in place because that is ensuring that even if your password gets out to the site, nobody can log in unless they have that code and it's very unique, specific to you. I would argue the fact that the app is the more secure way than even the email because I don't know if you're like me or like other people, a lot of times you reuse a lot of your passwords. So your password to your email may be the same thing as your website. That's not my case, but that may be for some people. So they may be able to get into your email. If you can do it through an app or text message, even more secure. And WordPress, very easy, just look for 2FA or two-factor authentication plugins. They're free. You install it, it gives you a QR code, tells you what app to download, scan that code with your phone, and, and it's basically set up from there. And every time you log in, it's going to send you the code or ask you for that code that's generated by your device. So, and the bonus thing, I only said 3 initially, but we're going to go into the 4th one, is use unique alphanumeric passwords for every single login that you have. What do I mean by that? Well, let's first talk about alphanumeric. Alpha, letters, numeric numbers, and you can even get into the symbol side. Generate a very secure password, you know, anywhere from the 15 to 25 characters in length. No longer can you have like, you know, fuzzy kitty kitten 21, right? That you use for everything since high school, right? Get away from that. Use a password service like LastPass. Um, there's a bunch of other ones that are out there as well. We use LastPass. I love it. Uh, works on my phone, works on the computer, and it allows you to generate those. And when you go to the sites, it'll automatically give you that stuff to log in. If you've got team members, you need to share logins, you can do that with that program as well and not show them the password. You can revoke it back. So secure your stuff, secure your assets. The world is very much a volatile place, even more so right now at the time of recording this episode. Uh, and we're probably going to see some things being breached in the oncoming weeks and months as a result of what's going on in Russia and the Ukraine. So just to recap here, 4 things you want to do to secure your assets. Number 1, SSL security certificate security layer on your hosting. Do that. Number 2, firewall. Make sure that you have a firewall in place as an added level of security. Doesn't have to be there, but if you really want to be secure, you can go ahead and do that and get that in there. Highly recommended. Number 3 is two-factor authentication. Make sure that you are prompted for a code every time you log into your site or any one of your services, even your your Facebook account. They all have that. And the number 4 one is make sure you're using unique passwords for everything that you're using. So if you want more information on this, go to the show notes for this episode, and you will see the links to the ones that I mentioned there, and you'll be able to get that information. So if you like this show, please subscribe, share it, get it out there, give us a comment, give us feedback, whatever you want. This show is for you. And thank you so much for watching. For listening and being part of our whole community. Until next time, keep things secure and keep growing your business.
