Do you have WordPress under control?

/0 Comments/in

Having control over your website is crucial, especially considering it can be a significant source of income and visitors. Knowing what is happening with your website day and night, including the type of visitors it receives, is essential for effective management.

Tools like Google Analytics or the Count per day plugin can provide valuable insights into your website’s traffic, showing you where visitors come from and which pages they visit. However, one notable observation is the presence of visitors who spend 0.0 seconds on your website. These are known as “bots” that visit your website solely to leave a link behind. They may visit your website around 40 times a day, but they do not engage with any content.

Additionally, some visitors may land directly on your admin panel, indicating possible hackers and hackbots. These are usually automated processes performed by computers, making up about 99.5% of such attempts.

It is reassuring to know that many hacking attempts fail, but it is essential to be aware of potential security threats. Being informed about the number of attempts to access your admin area and their sources is crucial.

Moreover, having visibility into the actions of successful hackers is essential. Understanding how they gained access, which files they modified, and their activities enables quick action and response.

Ithemes Security PRO is a powerful tool that can help you regain control and enhance security for your WordPress website. Some of its features include:

– Keeping track of login attempts to your admin area.
– Notifying you of successful login attempts.
– Monitoring IP addresses that excessively visit your website.
– Detecting IP addresses attempting to fish for admin addresses.
– Logging file modifications, additions, and deletions, with precise timestamps.

By leveraging Ithemes Security PRO, you can proactively monitor your website and detect suspicious activities promptly. This allows you to take action against potential threats before they escalate and helps prevent costly security issues.

If you haven’t already, considering using Ithemes Security PRO can significantly enhance your website’s security and provide you with peace of mind.

How do I know if my WordPress website has been hacked?

/0 Comments/in

It is true that unexpected events can occur, such as automatic updates causing issues with WordPress or certain plugins not working. Additionally, user errors in the administration panel can lead to unintended changes on your website. Not every unexpected modification to your website is necessarily caused by a hacker or hackbot.

To determine if your WordPress website has been hacked, you can look out for the following signs:

1. Your website redirects visitors to another domain.
2. Google displays a red warning screen when accessing your website using the Chrome browser.
3. The Sucuri Malware scanner indicates that your website contains malware.
4. Your website displays strange advertisements in Google search results.
5. You can no longer access the admin area, and unknown users (administrators) have been added.
6. Your website is blacklisted, and you cannot send emails.

If none of the above points apply to your website, it is likely not hacked.

In cases where you encounter changes that you cannot understand, there are several possibilities:

1. Other users might have made the changes. Check the “author” of pages and posts, including revisions, to see if any specific name is associated with the modifications.

2. The Ithemes Security PRO plugin provides detailed logs of logged-in users in the administration panel. Check these logs to see if any changes or issues occurred during a specific user’s login session.

3. If automatic updates are enabled, a plugin update might have caused the problem. Try reverting to an older version of the plugin to see if it resolves the issue.

4. Ithemes Security PRO logs the changes made to files on the server, including additions, deletions, and modifications, along with timestamps. By reviewing these logs, you can identify which files were updated and when. You can then restore the files or roll back to an older version of the plugin to potentially resolve the problem.

If you suspect a hacker or script has infiltrated your WordPress website, check for files containing Base64 code, as they might indicate malicious activity. In such cases, you may need to carefully remove the code from the affected files or delete the suspicious files altogether.

If you want ease and certainty in dealing with website security, you can seek professional help to restore and secure your website. Engaging experts can ensure all files are thoroughly checked and your website becomes hack-free. Additionally, with a restoration and security service, you often get the PRO version of Ithemes Security NL for free, along with a 30-day guarantee to ensure your website remains securely protected.

Why are hackers hacking?

/0 Comments/in

Hackers committing cybercrimes have become increasingly common. Hacking can be done from the comfort of one’s home, and hackers can remain anonymous if they know how to cover their tracks.

1 in 5 Dutch individuals will eventually be confronted with a hacked website, hacked social accounts, compromised computers, or even hacked smartphones.

Money or in some cases “fame” is the motivation for hackers to target websites, especially if they can redirect visitors to their own (often illegal) websites. For hackers, it’s not about quality, but quantity. If a website is easily hackable with a script, hackers will use it as a means of advertisement.

Hackers can monetize their activities by operating websites that fish for bank credentials or sell products. By increasing the number of visitors and links to their website, they can rank higher on Google and generate revenue from product sales.

Hackers often evade capture by using proxies or different IP addresses. They might operate from internet cafes or use other people’s Wi-Fi connections. Similar to how burglars work at night to avoid detection, hackers try to remain unseen. Once a website is hacked and redirects visitors to an illegal website or webshop, the hacker behind the attack is concealed, and the compromised website becomes the end of the line.

Hackers can gain entry to a website personally by phishing for usernames and passwords, but more often, they exploit known vulnerabilities within a system. They may use brute force attacks to try multiple passwords rapidly or perform a SQL injection to access the MySQL database and disable security or create their login credentials. Other methods include gaining access through FTP, admin panels, databases, or malware that records keystrokes and sends them to the hacker.

Yes, hackers are considered criminals as their actions often cause harm and incur costs to website owners. Cybercrime is not limited to individuals with tattoos and criminal records; even seemingly innocent individuals like teenagers or young adults can engage in hacking without realizing the legal and harmful consequences.

To protect against hackers, using Ithemes Security PRO is recommended. This plugin ensures that WordPress is not easily exploitable, and it thwarts hacker attempts to hack into the system. It tracks login attempts and injection trials, and it also creates backups of the database and records server changes, allowing easy restoration of the website if needed.

Je moet WordPress beveiligen tegen WordPress hackbots – Lees nu waarom

/4 Comments/in

De meesten weten het niet, maar je moet WordPress beveiligen tegen hackbots en niet tegen die ene persoon die je website handmatig probeert te hacken! Waarom je WordPress moet beveiligen tegen hackbots en niet tegen hackers? Nou..

999.9% van alle aanvallen op WordPress websites worden door hackbots uitgevoerd, ze werken 24/7 zonder ophouden en werken vanaf iedere computer of server over de hele wereld

NOTE: We hebben het hier – op moment van schrijven – nog over de “gewone hackbot” dat werkt met een standaard script dat diverse tests uitvoert en bij succesvolle terugkoppeling een voorgeprogrammeerde aanval uitvoert. Het zal niet lang meer duren voordat hackbots bestaan uit een AI aangedreven bot die niet alleen test, aanvalt maar ook leert en verschillende keuze kan maken.

Met deze kennis op zak weet je dus waarom je nummer 1 prioriteit ligt in de beveiliging van je website tegen hackbots.

Een hackbot, wat is dat nou?

een vriendelijke hackbotEen hackbot is in de basis een geavanceerd script wat geschreven is om andere websites te hacken.
Het script wordt uitgevoerd door een bot c.q. robot ofwel computer, meestal een server aangezien die verbinding heeft met het internet.
Hackbots kunnen zich 24/7 bezighouden met het speuren naar WordPress websites met bekende lekken in plugins, verouderde WordPress installaties, in thema’s en in de beveiliging.

WordPress beveiligen, dat doet mijn webbouwer toch?

webbouwer designerNee, de meeste webbouwers maken websites. Webbouwers zijn gericht op de vormgeving, op je content, en in het gunstigste geval installeren en configureren ze een gratis beveiligingsplug-in.
De meeste webbouwers gaan daarna door naar de volgende website terwijl doorlopend onderhoud en bescherming nodig is tegen hackbots.

WordPress beveiligen, dat is iets voor mijn webhoster

Nee,  je webhoster is niet verantwoordelijk voor de sofware & plugins die je gebruikt. De webhoster zal je vrij laten om verouderde plugins te gebruiken, een lekke WordPress versie of thema’s die lek zijn.

Waarom een hackbot het grootste risico vormt

Een hackbot kan gemakkelijk 1000 aanvragen (lees aanvallen) per minuut op je website afvuren om zo lekken te testen. Waar een mens handmatig slechts 3-5 lekken per minuut kan testen als die heel snel typt 😉

Hoe gaat een hackbot te werk?

Een hackbot scant zoekmachines op websites die met WordPress gemaakt zijn, en kijkt daarna naar:

  1. Verouderde plugins met bekende beveiligingslekken
    Plugins worden gecodeerd door derden, verschillende personen en soms hele  teams. Niet iedereen is zich veiligheidsbewust waardoor hackers lekken ontdekken en misbruiken.
  2. Gebruikersaccounts
    Er wordt gekeken naar de auteurs, en de mogelijke wachtwoorden. Soms zijn die bij een lek naar buiten gebracht (Controleer hier) en in het ergste geval zijn het gemakkelijk te raden wachtwoorden middels brute-force aanvallen.
  3. Thema’s
    De zwakke punten in thema’s worden getest. Denk aan invoervelden, verouderde addons.

Als er beveiligingslekken gevonden zijn zal een hackbot een script afdraaien die specifiek voor zo’n lek geschreven is. Dat noemen ze een payload in de hackerswereld.

Hackbots veranderen continu

Dit maakt het enorm lastig voor webbouwers en andere dienstverleners zich richten op hun vakgebied en niet continu up-to-date blijven met de nieuwste veranderingen van hackbots.

Als hackers doorkrijgen dat hun hackbots niet meer door de beveiliging heenkomen passen ze de bots/scripts aan.

Ik heb maar een kleine website!

Dat is ook 1 van de verschillen tussen hackbots en mensen, een bot probeert ELKE website binnen te dringen. Hoe klein de website ook is.

Of je nu een lokale kapper, bakker of fietsenmaker bent.. voor een bot is iedere website er één die de bot graag overneemt

Dat terwijl een mens zich vaker richt op grote bedrijven of webshops zal richten.

WordPress beveiligen tegen een hackbot, hoe werkt dat?

Als je weet waar een hackbot naar kijkt, weet je ook wat je moet verbergen en hoe je de toegang moet blokkeren voor die nare hackbots:

  1. Je begint met het loggen van de aanvragen (aanvallen)
    De aanvallen zijn meestal vrij willekeurig, in de zin dat er heel veel zwakheden uitgeprobeerd worden. Er worden aanvallen gedaan op plugins, op het thema en op wachtwoorden.
    Deze pogingen moeten ge-logd worden, bij 10-20 pogingen kun je zeker zijn dat het een hackbot is en geen mens. Het loggen gebeurt onder andere op basis van de resultaten die de server terug geeft bij die willekeurige aanvallen. Die zijn meestal foutief, de zogenoemde 404 page not found resultaten zeggen veel over de aanvrager, of het een bot is of een mens.
  2. Dan blokkeer je de hackbots op IP basis
    Ieder apparaat, iedere verbinding heeft een uniek IP adres. Dat wordt dan geblokkeerd. Het wordt op de lijst gezet van risicovolle IP adressen na een bepaald aantal beland dat IP adres zelfs in de robots.txt om te zorgen dat het IP adres niet alleen geweigerd wordt ná de aanvraag maar zodat die zelfs geen aavraag meer op de server kan doen en zo de servercapaciteit niet kan verspillen.

Man wat is dat simpel! Loggen en blokkeren, Toch? Ik smijt er dan gewoon een beveiligingspluging in van iThemes Security, Securi, of WordFence.. wat? Ik gooi ze er alle 3 in!

WordPress beveiligen met een beveiligings-plugin

Een beveiligingsplugin installeren zal niet direct alle deuren sluiten voor hackbots. Er komt meer kijken bij het beveiligen van je WordPress website.

  1. Je moet de beveiliging van de server in orde hebben
    In de meeste gevallen ligt deze verantwoordelijkheid bij je webhoster. Verzeker jezelf ervan dat je een goede webhoster hebt die de server up-to-date en veilig houdt.
  2. Je moet stevige wachtwoorden gebruiken
    Nee niet de naam van je kat met de postcode of je geboortedatum erachter 😉
  3. Je moet het gebruik van plugins beperken
    Iedere plugin laadt code in waar lekken in kunnen ontstaan.
  4. Je moet je website up-to-date houden
    Je kunt de beveiliging nog zo streng afstellen, als een plugin verouderd en lek is kan een hackbot binnen 1-2 gerichte aanvallen in je website komen. Nog voordat de beveiliging aanslaat en hem blokkeert.

Kan ik WordPress zelf beveiligen?

Met de kennis die je nu hebt kun je WordPress een stuk beter beveiligen. Je weet waartegen je jouw WordPress website moet beschermen.
Toch is het een vak apart en zijn hackers er dagelijks over de hele wereld mee bezig om hackbots te maken die WordPress websites kunnen overnemen.

[pers-server]Als je een grote bedrijfswebsite hebt is het belangrijk om je website door een WordPress specialist te laten beveiligen.[sluit-pers-server]

Zoals je ondertussen wel doorhebt zijn wij WordPress specialisten in de beveiliging! Je bent bij ons aan het juiste adres voor het beveiligen van je WordPress bedrijfswebsite.

Wil je jouw website laten beveiligen?

  • Iedere maand updates
  • Professionele beveiliging tegen hacks en bots
  • Pro beveiligingsmodules
  • Website scans
  • Reputatie monitoring
  • Veilige backups
  • Error fix
  • Uptime ondersteuning
  • Geen zorgen meer over hacks, hackbots of malware!

Al voor [beveiligen-abonnement-pakket1] euro per maand!

Beveiliging direct aanvragen!

WordPress has been hacked! How does WPbeveiligen fix this!

/0 Comments/in

Absolutely, every WordPress website is unique, even if we have seen hundreds of them. That’s the beauty of our profession! Each site presents a new challenge to properly restore and secure it.

But isn’t WordPress the same for all?

While the core files of WordPress are often the same, everyone uses different themes, plugins, and has varying numbers of pages and news articles.

We come across websites with just 3 plugins, but also with 30 plugins. As a general rule, keeping the number of plugins between 5 to 8 is advisable to maintain a good and secure website.

There are premium themes, free themes, and custom-made themes, all of which require their unique approach.

How does WPbeveiligen know what to do with themes and plugins?

We have been developing WordPress websites since 2007, six days a week. Over the years, we have worked with countless plugins and themes.

We continue to develop websites, test new plugins and themes regularly.

Sometimes, we encounter a new plugin or theme that we are not familiar with, and in such cases, we study and research it thoroughly to clean it without losing any code.

Does WPbeveiligen use a scanner or specific tools?

We use various methods to clean a website, but a significant part of the process involves manually reading and inspecting code, opening and examining folders, and checking file modification dates.

Although we can use tools to expedite the process of finding certain vulnerabilities and files, we still spend several hours manually reviewing and restoring a site. Automated software cannot distinguish between spam links, hacker HTML, and genuine content that belongs on the website.

There is no one-click solution.

It is a combination of knowledge, experience, and extensive research, recoding, and renewal.

One thing you can be certain of is that we use our expertise and passion for WordPress to restore and secure websites.

We offer a standard 1-month guarantee, and with a premium security plugin, we ensure that your website becomes less susceptible to hacking attempts.

Where hackers hide their code

/0 Comments/in

Hackers have their favorite spots to place their malicious code, and being aware of these common locations can help you identify and remove hacks from your WordPress website.

A Hack in the header.php

The header.php file in your theme is loaded first on every page and contains the <head> section where JavaScript can be loaded without drawing too much attention.

How to recognize a hack in the header.php?
To identify a hack in the header.php, you should know which JavaScript files should be loaded, both from your theme and plugins. Any additional or suspicious code, especially if it appears as Base64-encoded, should raise concern. Taking a backup and then removing the suspicious code is the first step to resolve this.

A Hack in the uploads directory

The uploads directory is often targeted by hackers since it is writable, making it convenient for them to spread their files. Hackers may use folders named after years (e.g., 2011, 2012, 2013, 2014) to hide their files.

How to find hack files in the uploads directory?
There should be no PHP files in the uploads directory. You can perform a simple search on the server for PHP files to identify and remove any suspicious files.

A Hack in the WordPress Core

If you notice hack files in the wp-admin, wp-includes directories, or other core files, it is best to re-upload a clean version of WordPress. The root (www or httpdocs) is also susceptible to hacks, as it is the base directory for all your files. Comparing your files with a clean WordPress installation can help identify any unwanted files.

Always upload the latest version of WordPress, but be sure not to overwrite the wp-config and wp-content directories (Remember to create a backup first!).

A Vulnerable Plugin

Plugins are often the weak point for WordPress. Some plugins may write files to the directories mentioned above, making them a security risk.

Always ensure that your plugins come from the WordPress library or are officially purchased. Avoid using illegally downloaded plugins, as they may contain backdoors.

Prevent a Time-Consuming Search!

If your WordPress website gets hacked, experienced WordPress experts may spend 1-2 hours searching, digging, and reading to find and remove hacks and backdoors.

To prevent this, consider using Ithemes Security PRO, which can help you track when and where files are modified or uploaded. It provides information on the file name, date, and time of changes. Furthermore, Ithemes Security PRO sends you an email notification whenever files are modified, allowing you to take prompt action if necessary.

A useful feature of Sucuri

/0 Comments/in

Sucuri Security offers a WordPress plugin that you can find in the WordPress plugin library under the name Sucuri Security. While it may not be an all-in-one solution against hacks and has some limitations, it does have one very useful feature that can save you a lot of time, especially if you have many plugins installed.

The Plugin Reinstaller

If your website uses 20-30 plugins (which is, of course, too many and poses a significant security risk), it can become a cumbersome task to remove each plugin, download a clean installation, and then upload it back to the plugins directory, especially when there are hacker files present.

Sucuri has a feature for this scenario where you can select all plugins at once and have them removed and reinstalled with a clean version in one go! This saves you a lot of time and effort.

You can find this feature under “Post Hack > Reset plugins.”

securi plugins installeren

You might be wondering if you can simply update a plugin instead. While updating a plugin does modify some files, it won’t remove any hack files that may be present.

In summary, download the Sucuri plugin and use the reset plugins function!

And then?

After using the Sucuri plugin to reset your plugins, it’s a good idea to install a robust security plugin like Ithemes Security PRO to enhance the security of your WordPress website.

My WordPress website is showing an error?

/0 Comments/in

If there is something wrong with the code, the database, or the hosting, you may encounter an error.

For many, these errors are not understandable, but as WordPress security experts, we often encounter them on hacked websites.

Not every error is caused by a hack, so to find the right solution, it’s important to understand what the error means.

The 404 error

The 404 error is the most common and occurs when a page cannot be found.

Your website may still be accessible since a 404 page is usually displayed within your website’s layout, but the page either no longer exists or the URL was mistyped.

The 500 error

The 500 error usually indicates an issue with the server. It could mean that the server is temporarily offline or needs to be restarted. In such cases, your website will not be accessible until the hosting provider resolves the problem.

Error establishing a database connection

You’ll see this error when the database is unreachable. It can occur due to incorrect database credentials, but it may also be caused by hosting issues preventing the database from loading.

A white screen without an error message

In some cases, you may encounter a blank white screen. WordPress sometimes suppresses errors for security reasons since displaying errors could provide information to hackers.

To debug this, you can set the debug_mode to “true” in the wp-config file of your WordPress website.

WPbeveiligen can help you solve the problem

We have the knowledge and experience to resolve most errors. You can contact us on a no-cure-no-pay basis for error resolution.

The cost of fixing an error usually ranges between €40-€60 excluding VAT, as it typically takes no longer than an hour to resolve the issue.

10 ways to open up WordPress to hackers

/0 Comments/in

These are the 10 things you absolutely should not do if you want to keep your WordPress secure:

  1. Keeping the username “admin.” Most scripts are designed to perform a brute force attack in combination with the username “admin,” where thousands of passwords are attempted on your admin page.
  2. Leaving “admin” in the wp-admin link without setting a maximum number of login attempts. Setting a limit to 3-5 login attempts will deter brute force attacks.
  3. Displaying your username above each post. Choose a different name for publishing posts!
  4. Leaving the comment area open without an anti-spam plugin. If you don’t use comments or rarely receive them, consider disabling the comment section.
  5. Using the website name as your login username or password. This is one of the first combinations attempted by hacking scripts!
  6. Using dozens of plugins. The more plugins you have, the higher the chances of one having a vulnerability. Exploiting a vulnerability in one of your plugins can lead to a MySQL injection or the creation of files on the server.
  7. Leaving the WordPress version number in the source code. Hack scripts can easily find the exploits (vulnerabilities) associated with that specific version.
  8. Not updating WordPress for 3 years. This might have been acceptable when WordPress was relatively new, but due to its popularity, there are now numerous scripts scanning the internet for WordPress sites.
  9. Illegally downloading and using plugins and premium themes. Sites offering illegal themes often insert their ads or backdoors into the theme. A simple line of code can collect and transmit information to the hacker.
  10. Using the cheapest hosting. The server is also a target for hackers. They attempt to access the server through vulnerable WordPress websites to launch attacks on other sites. Cheap web hosts, unfamiliar with WordPress and not focused on security, often have slow servers, leading to slow website loading times.

These are the 10 points you can change to make it more difficult for hackers to compromise your WordPress website.

Alternatively, you can let WPbeveiligen proactively secure your WordPress, addressing these 10 points and more than 30 other security measures!

Preventing a Brute Force Attack

/0 Comments/in

How do you block a Brute Force attack?

You can block a Brute Force attack by using a security plugin that imposes a temporary or permanent block on the computer from which the attack originates after 5-10 failed login attempts. This block is based on the IP address. Initially, the block is temporary, but if the Brute Force attack continues, it may become a permanent ban.

Hiding the username

The security plugin we use immediately ensures that your username is not visible everywhere. This is a critical point as the username is the first key to a Brute Force attack.

Usernames are easier to determine than you might expect. For example, many users still use “Admin” as the username or have a username that is the same as the website’s name.

Hopefully, you don’t recognize yourself in these common mistakes. But even if you have a username that is as long as the dictionary, the usernames can be easily retrieved from the database, the author page, or the name above blog posts. There is even hacker software that can reveal usernames.

Think of it like the nameplate on your house – easy to read, but make sure they don’t get their hands on the password (the key)!

Hiding the login page

It’s important to prevent a Brute Force script from easily accessing your login page.

By default, every WordPress login page can be reached at:

  • www.yourdomain.com/wp-admin
  • www.yourdomain.com/wp-login.php

This is well-known information.

The Ithemes Security PRO NL plugin allows you to choose a new unique address. For example:
www.yourdomain.com/log-in-here

vulnerability in WordPress

What does WordPress do against Brute Force attacks?

As Brute Force attacks are common, WordPress decided in 2015 that passwords should meet certain requirements:

  1. They must be at least 8-10 characters long
  2. They should include numbers, uppercase letters, and special characters
  3. They cannot be the username or website name

In a Brute Force attack, each character or digit that makes the password longer exponentially increases the difficulty of cracking the password.

When are you most likely to face a Brute Force attack?

The only good news so far is that the better your website performs in search engines like Google, the more bots will find your website.

It means that your website is well-visible and being visited by users!

Prevention is better than waiting..

Brute Force attacks will always exist, so prevention is better than cure. If you act too late, your website may be filled with backdoors, leading to potential damage. Google doesn’t appreciate spammy websites and can even inform visitors with a red warning that your website is unsafe!