Securing WordPress Websites - RD224
Release Date: 07/13/2020
How are you standing out from your competition What do you think of when you hear the word “pencil”? I bet that one of the images that flashed through your head is of a yellow-painted piece of wood with a graphite center. The quintessential yellow pencil found the world over. A Medium article by Melissa Gouty titled “Why Pencils Are Painted Yellow" got me thinking about the parallels between a yellow pencil and your design business. I'm going to paraphrase Melissa's article for the sake of my comparison. The common yellow pencil that we take for granted helped spark the renaissance....info_outline 3 Things To Do Today For A More Productive Tomorrow - RD233
Being diligent today will make you more productive tomorrow. I talked about dividing your to-do list into three sections, non-negotiables, procratinatables and optionables, and how doing so will help you organize your day. I also discussed listening to your body's clock to determine the best time of day to tackle certain projects and tasks. Today's post is all about setting up for a more productive tomorrow. And to do that, you need to start today. For as long as I can remember, my nightly routine before bed has included looking and preparing for the next morning. Call it my shutdown...info_outline Writing The Perfect To-Do List - RD232
The Perfect To-Do List + Time Management = Success. If you search through the Apple or Google app directories, you will find dozens, if not hundreds, of options for creating so-called perfect to-do lists. I like for grocery lists and shopping lists or keep track of the unending chores and tasks I need to do around the house. For work-related lists, my go-to is (get a free month with this link). I have Evernote fine-tuned with different notebooks for every part of my work life. But it doesn’t matter if you use a digital tool or pencil and paper if you don’t understand the...info_outline Producing In-House - RD231
Are you producing any of your design projects in-house? I got the idea for this episode of the podcast when a member of the shared her new toy with us in our Slack group. Laura bought a . It’s an eco-solvent printer she plans on using to produce stickers, vehicle graphics and apparel graphics, among other things. This new piece of equipment will allow her to produce materials for her clients in-house. She also plans on using it to make pieces to sell through her Etsy shop. This got me thinking about different ways designers can produce things in-house. Now for the record, I...info_outline Farming Out Design Work - RD230
Do you farm out design projects? Finding yourself overwhelmed with too many design projects is a sure sign that you are not charging enough for your design services. Don’t turn clients away. Instead, raise your prices and start farming out design work. The following is a post from the . Hi guys So I'm turning away a lot of work at the moment, as I have my day job, and seem to have very little energy in the evenings and weekends to take on many freelance jobs. Seriously, I'm feeling so burned out, have been for a while now. I do the odd freelance jobs here and there for previous clients that...info_outline Invest In Yourself - RD229
If you want to succeed as a designer, you must invest in yourself. Have you heard the quote, “it takes money to make money?” The same concept applies to growing your design business as well as improving yourself as a designer. If you don’t invest in yourself, you’ll become stagnant, outdated, and eventually overlooked. Clients hire graphic and web designers because they want fresh ideas and skillsets to implement them. These clients will quickly tire of someone if all they ever produce are the same old things. No business or person, for that matter, can do the same thing over and over...info_outline Print Is Not Dead - RD228
Contrary to popular belief, print is not dead. There was a time, not long ago, when graphic designers designed almost entirely for print. Sure there were trade show booths and vehicle graphics, but in their way, those are print as well. As the internet became more and more popular, started to encroach on a turf that was mostly populated by computer programmers. And before you knew it, a whole new industry was born–Web design. design allowed graphic designers to help clients on two fronts—both digital design and print design. But as time moved along and the world moved closer to being a...info_outline First Contact: Interviewing New Design Clients - RD227
Do you vet potential new design clients? How do you know that you’re the right designer for a project? Or maybe the question should be, how do you know a potential new design client is right for you? In the past, I’ve covered what to ask during a , and to ask your design clients about their projects. Almost all of the questions covered in those episodes are for building relationships with your clients after you’ve decided to work with them. But I don’t think I’ve ever talked about that first contact with a potential new client before. First contact. The first contact refers to those...info_outline What Got You Here Won't Get You There - RD226
How are you going to take your design business to the next level? “What got you here won’t get you there.” I’ve heard this phrase a few times over the past couple of weeks, and it got me thinking about my life, my design career and my business. This is not about Marshall Goldsmith’s book of the same title. Although I hear it’s a great book. It’s about the phrase itself and how it applies to you and your design business. At its core, “What got you here won’t get you there” is such a simple statement, and yet it holds so much truth. You can only get so far in life...info_outline Creating Systems - RD225
Are you creating systems to help your design business? Mike, a member of the , posted in the Community Slack group his frustrations with one of his clients. Mike built, manages and updates an eCommerce website for a client of his. His frustration is that every time his client wants a new product added to the site, he fails to provide Mike with all the necessary information, requiring Mike to contact the client, sometimes more than once, for the rest of the info. Mike’s situation reminded me of a similar one I had with a client several years ago. And how my frustrations forced me into...info_outline
My strategy for securing WordPress websites.
The internet is filled with unscrupulous people. Are you doing everything you can to ensure your clients’ portion of it is safe by securing their WordPress websites?
I recently published a podcast episode and article on earning extra income by offering website maintenance plans. Part of that strategy is making sure the websites you manage are secure. I received many questions afterwards asking how I secure my clients’ WordPress websites.
There are many ways and many tools available for securing a WordPress website. Here is the method that works for me.
Those two words, “WordPress Security” may sound intimidating to the uninitiated. Let me assure you they’re not. If I can learn how to do this, so can you. I’m not a programmer. I’m not even a developer. I’m just a WordPress user who figured out a security strategy that works for me.
What is WordPress Security?
WordPress security involves putting measures in place to decrease the chance of someone compromising a website.
If you sell WordPress Security as part of your website maintenance plan, be sure to tell your clients there are no guarantees. If a skilled hacker is determined to gain access to a website, they will, and there’s not much you can do to prevent it.
The purpose of Website security is to make it as difficult as possible for them, so they leave your site alone and go in search of an easier target.
Most hacking attempts are easily preventable with a few simple measures. Here’s what I do.
Securing Account Login.
By default, every WordPress installation provides easy access for administrators to gain entry to a site through the URL domainname.com/wp-login.php. This default makes the WordPress login page the most attacked part of any website.
So how do you secure the account login?
Hide the backend
I use iThemes Security Pro to hide the backend of every website and replace the login page with something else. If anyone tries entering the site via the /wp-login.php page, they’ll be taken to a 404 page not found page instead.
This is more of security by obscurity, and is not a very strong strategy, but if it helps prevent automated bots and such, then why not do it?
iThemes Security Pro > Security > Settings > Advanced > Hide Backend
Force the use of a strong password.
The stronger the password, the harder it is to crack. Forcing a strong password makes it more difficult to gain access to a site.
iThemes Security Pro allows me to force the use of strong passwords. New site users must enter a strong password to create their account, and existing site users are forced to update their weak password when they next log in.
iThemes Security Pro > Security > Settings > Password Requirements
Prevent the use of compromised passwords.
One of the main vulnerabilities of passwords is their reuse. Many people think up a good password, but then they use it everywhere. All it takes is for one database breach containing their user name and password, and a hacker can gain access to wherever the two are used in combination.
iThemes Security Pro connects to the haveibeenpwned API and refuses any compromised passwords.
As part of this prevention method, I recommend all my clients use a Password Manager such as 1Password to create strong, unique passwords for every site they visit.
iThemes Security Pro > Security > Settings > Password Requirements
Limit Login Attempts.
Even a strong password may be guessed if given enough time. So as an extra measure, I turn on Brute Force Protection in iThemes Security Pro to prevent the number of failed login attempts.
I have it set so that three failed login attempts will lock a user out of the site for 15 minutes. After their third lockout, it bans the IP address from even viewing the website.
iThemes Security Pro > Security > Settings > Local Brute Force Protection
Two-Factor Authentication, sometimes called 2FA, adds an extra step to the login process. The way it works is after entering a username and password; users must enter a temporary six-digit code to gain access to the site.
This code can be obtained from a predetermined list, one that’s emailed to the user, or, my preferred method, using an App on a smartphone such as Google Authenticator.
Google Authenticator generates a new unique code every 30 seconds. When logging into a website with Two-Factor Authentication, you must enter the code from the app and press the login button before the code expires.
The only way to gain access to a website protected by 2FA is to have the user name and password, plus have access to the smartphone tied to the account.
iThemes Security Pro > Security > Settings > Two-Factor Authentication (This is a PRO feature)
I want to mention Passwordless Login as a security option, but note that I don’t use this method myself. I explain why, later.
Passwordless login is a way to gain access to a website without entering a password or a 2FA code.
To use Passwordless Login, you enter your email address on the login page then check your email for a “magic link” that grants you access to the website. No password or Two-Factor Authentication code required.
Passwordless login is secure because it requires access to the email account associated with the site.
Although Passwordless Login is very secure and works great for clients, I don’t use this method. I sometimes need to access to a client’s website through their account instead of my admin account. I wouldn’t be able to access a site with Passwordless Login since I don’t have access to my client’s email account.
iThemes Security Pro > Security > Settings > Passwordless Login (This is a PRO feature)
WordPress Site Monitoring
Now that the account login is secure, the next thing I turn to is site monitoring. I want to know when something happens to one of my client’s website.
WordPress security logs are an excellent resource for seeing what is happening with a site. If a website gets hacked, the security logs will have the best information to help you recover.
To be honest, I don’t understand most of what the security logs contain. But I know where they are, and how to download and share them if I need to get an expert involved in fixing a compromised site.
iThemes Security Pro > Security > Logs
Monitor File changes
iThemes Security Pro allows me to monitor when files on a website change. This is a great way to know when someone had gained access to a site.
Be warned; this feature will also notify you of every change and update you make to the site.
iThemes Security Pro > Security > Settings > File Change Detection
Scanning for Malware
iThemes Security Pro regularity scans and notifies me if it detects malware on a website. This has saved me in the past when a client’s site became compromised. I was able to fix the issue before it escalated.
iThemes Security Pro > Security > Settings > Site Scan Scheduling (This is a PRO feature)
Themes and Plugin Management
Delete unrequired and inactive themes and plugins.
It’s much easier to hack into a website if it has outdated themes and plugins installed.
The first step in theme and plugin management is to deactivate and delete any unrequited or unused plugins. You can always reinstall a plugin should it be needed.
Also, make sure you acquire your plugins from reputable sources. I’ve seen some questionable WordPress Plugin bundles recently offering thousands of dollars worth of premium plugins for next to nothing. These plugins may work, but they may also be compromised. It’s not worth risking your business or reputation over.
Keep active plugins and themes updated.
As far as security is concerned, when it comes to the WordPress Core, Themes and Plugins, the best rule of thumb is to keep everything updated.
Many updates are to patch security vulnerabilities.
iThemes Security Pro has a nice feature called Version Management that allows a site to automatically update itself as new versions of the WordPress core, themes and plugins are released. Although handy, I leave almost all of this feature off. I prefer updating plugins myself. Should something on the site break during an update, I want to know right away.
The only option I turn on is the “Auto Update if Fixes Vulnerability” option. This allows updates only if it fixes a security issue.
iThemes Security Pro > Security > Settings > Version Management (This is a PRO feature)
Manually updating the WordPress Core, Themes and Plugins.
For updating my client website, I use iThemes Sync, a WordPress manager. iThemes Sync allows me to monitor and update all my clients’ websites from one dashboard.
iThemes Sync sends me daily emails telling me what plugins and themes have updates available. I can log into iThems Sync and perform all the updates from the one dashboard without having to log into each website individually, saving me time.
The basic version of iThemes Sync is free for up to 10 websites.
Whenever registering a domain, I highly suggest you include domain privacy. Some hosts include domain privacy while others charge an extra fee.
Domain Privacy hides the domain owner’s contact information from the public. Without domain privacy, a domain owner’s email address, mailing address and phone number are available for anyone to see.
Since it’s common to use the same email address to register a domain and access the associated website, without domain privacy, you’re handing hackers half of the login information they need.
That’s my WordPress Security plan.
That’s it. That’s what I do to secure my clients’ WordPress websites.
This is not meant to be an add for iThemes. There are many tools you can use to do the same things I do. Some of them possibly better and maybe less expensive than what I use. But I’ve been using the iThemes programs for several years, and I know, and I trust them. And so far, knock on wood, they’ve worked for me.
What's your strategy for securing WordPress websites?
Let me know by leaving a comment for this episode.