WordPress security - threats and protection mechanisms

So popular, so vulnerable: WordPress security

WordPress is now the most important content management system (CMS) in the world and is used by over 43% of all websites. This also explains why it has become a lucrative target for hackers and criminals.

Facts & figures at a glance

More than 900 million brute force attacks on WordPress sites per month

Over 18 million attacks on WordPress sites were registered during the most severe wave of attacks

These figures illustrate one thing above all: large-scale WordPress hacks are by no means an exception.
In fact, WordPress websites are subject to constant attacks.

What strategies do attackers use to
attack standard WordPress security?

There are a variety of different methods that attackers use to try to circumvent WordPress' own security:

Automated botnet attacks

In this type of WordPress hack, the brute force attacks, the hackers try to gain access to the admin account of unsuspecting webmasters/entrepreneurs with the help of a botnet via repeated and automated login attempts in order to spread malware or host illegal content from there, among other things.

Spam bots in the comments section

In addition to account data, the comment function on WordPress is also repeatedly the target of attacks. This involves automated comments being left on thousands of websites, which reduce the reputation of the website and may link to infected websites.

DDoS attacks

With the help of automated DDoS attacks ( DDoS = Distributed Denial of Service ), hackers attempt to attack the WordPress website with a huge number of requests and cause the server to collapse as it can no longer process the huge amounts of data. This WordPress hack often has direct and serious economic disadvantages for those affected.

SQL injections

SQL injections ( SQL = Structured Query Language ) target the heart of every WordPress website: The database. This is where all of the website’s content is stored. Not only the operators, but also the users of the website have the possibility to infiltrate content into the database. This is exactly where the WordPress hack SQL injection comes in: The hacker enters an SQL command into the contact form (often automated), which is identified as harmless by WordPress and is then executed. The attacker can then delete, spy on or change the data with serious consequences.

How can WordPress operators increase the
increase the WordPress security of their website?

WordPress security is extremely important for website operators. It turns out that WordPress websites can be attacked using different types of WordPress hacks, sometimes with fatal consequences. Although WordPress does not offer sufficient security functions by default, there are many possible solutions to ensure the security of the website. There are specialised hosting providers, such as HostPress, which guarantee the security of the website. These providers are able to take over WordPress security completely, so that the operators no longer need to have any security concerns. Despite the attacks, operators can continue to use the most popular and advanced CMS WordPress with peace of mind.

How WordPress security works at HostPress

At HostPress, we work with WordPress ourselves on a daily basis and know the dangers. That's why we rely on the best protection mechanisms and professional security solutions on the market. As a security provider, we know the variety of attack strategies and therefore rely on various mechanisms to ensure your WordPress security and prevent your website from being successfully attacked.

Regular website maintenance
We regularly check whether there is anything conspicuous on your website. In addition, you have all your WordPress installations in one central location and can decide on updates manually.

Backups
You have the choice of performing automatic backups or manual backups to secure your website. You can also decide where the backup should be stored. Locally, on your FTP or with us.

Web application firewall
The firewall checks the traffic on your website with the help of ModSecurity and recognises malicious requests immediately, blocks the attacker and thus prevents the servers from being overloaded.

Fail2Ban
This recognises brute force attacks and renders them harmless with the built-in security function by preventing the botnet from gaining access to your website.

Malware scanner and antivirus with auto-cleaning function
Damage caused by malware? Not with our scanner. It ensures that the malware is recognised and rendered harmless. We are also happy to help you remove the malware permanently.

Outbound spam protection
Our outbound spam protection prevents spam from being sent from your WordPress by limiting the number of outbound messages according to your rules.

The perfect all-round protection for your installations

360° protection thanks to the best security from Imunify

Antivirus, firewall, WAF, PHP security levels, patch management,
Domain reputation with a clear interface and extended functions.

ImunifyAV+
(included in all tariffs)

The malware scanner detects and cleans up encrypted malicious code embedded in files with advanced file obfuscation techniques that can be automatically cleaned up with one click.

Malware scans by schedule/job
Incident reporting via UI and API
Automation via command line and API3 Integration of third-party solutions (CSF/lfd/cpHulk)
Integration of Plesk
Malware clean-up with one click

(can be booked as an add-on)

Imunify360 is an advanced multi-layered security platform for web servers, which can be booked in addition to our security mechanisms. Imunify360 uses an advanced firewall/WAF with machine learning rules, automatic scanning and removal of viruses and malware, proactive protection and blocking of malicious PHP scripts without any latency. It thus stops the latest types of attacks, such as brute force attacks at network and HTTP level, exploitation of security vulnerabilities, including 0-day attacks, DoS attacks, port scanning and many others.
Thanks to cloud heuristics and artificial intelligence for threats, Imunify360 also protects your server directly when it detects attacks on other installations.

Everything from AV+
Uses cloud heuristics and AI for threats
Outgoing email spam (SMTP traffic)
Monitoring whether websites or IPs are blocked by blacklists, with notification if this is the case
CDN protection 20CDN providers including Cloudflare improved Fail2ban
Proactive protection against zero-day attacks for websites running PHP, automatically and without latency
DDoS, brute force and portscan protection
Malware database scanner
Malware cronjob scanner