What could have gone wrong when so many sites can be hacked, defaced, abused?
Just to mention a couple of issues that may cause this:
- Insecure hosting (bulk hosting, many domains on one IP, cheap hosting, non-dedicated hosting)
- Wrong Installation of WordPress
- Bad username/password combination (can be hacked through brute-forcing)
- Insecure plug-ins and themes
- Outdated version of WordPress
- Wrong file rights’ settings
- Uneccessary excess files and retirable script libraries.
No Table-prefix used with wp-name files, so they could be easily guessed.
Change in wp-config.php but not if you already have an existing configuration.
Use random names in your database: https://www.random.org/strings/ & http://installatron.com/
and use: https://strongpasswordgenerator.com/
Use unique keys and salts in the config.php file to protect against cookie-hacks.
Never use admin, if already in use change for a normal user name, and use administrator as the admin account.
Never use the name of your site, remember you can use spaces now to make passwords look like sentences.
Update core software version, plug-ins and themes and use reliable ones that are maintained, see reviews.
Reset file rights from standard 644 wp-includes, root website. wp-admin, wp-content to 755 'htaccess to 644,
readme.html could be deleted when it shows a version number.
One could consider to use security plug-ins like iThemes Security, Wordfence or Bulletproof Security.
Tips credits go to - frankwatching dot com
Follow Eddy’s and my advice, when we spotted insecurity on your website.
polonus (volunteer website-security analyst and website error-hunter)
