The big caching test – The preparation

/0 Comments/in

In this article we will do everything we can to make a new WordPress website as slow as possible. Going against all our principles we turn on as many plugins as possible to get a load time of 5 seconds with as much executing Javascript, PHP & CSS processes.

This experiment serves to ultimate test the cache plugins and see which one works best under great pressure!

The start

1 smooth server, 8 gig ram Intel(R) Xeon(R) CPU E5-2683 v3 @ 2.00GHz (Several sites are currently running)

1 new WordPress installation with the default WordPress 2017 theme

Test method used:
– Google Developer Tools (Network view)
– Reload without browser cache!

These tests did not use Pingdom or GTmetrix since they have various factors that cause incorrect information to be displayed.

Speed after fresh installation:
800 ms (milliseconds, also known as 0.8 seconds)

Now we all know that no WordPress website runs without plugins.
From previous tests we learned that each plugin adds 0.3 to 1 seconds to the loading time.

Below the report of the plugins we have used, and the loading times that have been added.

WooCommerce +0.3 seconds (still without displaying products etc)
WordFence+0.2 seconds
Count per day +0.1 seconds

We put the shopping cart and hit counter on the test page, but the site is not slow to get.
Knowing that most websites take between 3 and 9 seconds to load, we still have a long destructive way to test the caching plugin properly.

We’re going to use some more plugins and data!

We’re increasing the size to 432KB with a nice image of the sun that’s good for 110KB.
speed

 

 

Then add a contact form (Contact form 7) +0.1 seconds

Then add Yoast SEO, which adds a few requests, but still no exciting loading time with: 1.65 seconds.

wordpress caching
No visitor will drop out on this and Google pagespeed insights also thinks it’s okay.

 

 

 

 

 

 

 

 

 

Conclusion so far, 5 plugins on a WordPress website are no problem at all.

We’re going to increase the pressure!

It’s time for the big guns, a Nextgen gallery with 10 images. Nextgen makes 10 neat thumbs of that and only loads the images after clicking with a lightbox. Kudos to Nextgen 😉

snelheid wordpress website

 

 

 

You can see that the website has shot up to 887KB in terms of data, but the server still loads the website much too fast for this test, 1.82 seconds.

For this test we just add a nice text of 442 words via Lorum Ipsum.

A text of 400 words has 3 kB, which means almost no delay.

A page of 2 meters

We now have a page of 2 meters with a contact form, a large photo, a slideshow. Not to mention a 400 word story.

The website loads within 2 seconds.

Why are those caching plugins so necessary?

Many websites use 30-40 plugins without shame. Or the images are not compressed.

Anyway, you’ve come here for the big caching test… so we’ll have to keep going!

From 2 to 5 seconds loading time?

We throw in another Youtube video (iFrame embedded) and are at a 2.15 seconds

youtube screen

 

 

And.. A Pollsplugin, Cookie popup,  Tawk to live chat, Slider WD

We are still at a fairly fast loading time of 3 seconds!

We did reach 100 requests (Requests / objects to be loaded) that slow down the website.
In a neat way we do not slow down the website, now we are going to activate another 10 plugins that we show on the page through widgets and [shortcodes].

 

122 requests, load 4.58 seconds (Don’t mind the finish time, it is still increasing due to the slider at the time of reading)

 

As far as we’re concerned, it’s “Time” to test the cache plugins!

The caching plugins,  what do we test them for?

What are we going to pay attention to?
The speed is self-evident, but we will mainly pay attention to the number of requests.
That is what a caching plugin does: Merge and pre-calculate scripts so that you get the calculated data on your screen as quickly as possible with as little server load/server requests as possible.

And of course,

Do the plugins still work? Is the website still loading properly? And, what about all those Javascript & CSS files being merged? Doesn’t that break up the styling?

Part 2 will discuss this further.

 

5 types of hackers and their shenanigans

/0 Comments/in

We encounter hundreds of hacks each year, each one more cleverly devised than the other. For example, one day you may open your website’s homepage and find nothing but a blank page with the text: hacked by… This is called “defacement,” which simply means that your page has been redesigned and altered. Fortunately, only the homepage may be affected, and the rest of your pages may still be accessible.

Another type of hack is known as “the link builder.” Your website remains mostly the same, with a few details changed. You may find pieces of text with links to a shady website. The sole purpose of this hack is to build links so that Google ranks the hacker’s site higher in search results. However, your website’s visibility on Google will significantly decrease due to advertising these dubious products.

Then there’s “the shoplifter,” who targets your online store. They hack their way in and modify the payment options, leaving only one remaining. And as you might guess, that payment option redirects to their own PayPal or bank account, allowing them to receive money from your customers. Usually, the funds are transferred to the account of a so-called “money mule.”

“The script kiddie” refers to a young boy or girl who simply picks up some scripts from the internet and alters some text or the layout of your website. These youngsters are often referred to as script kiddies. However, it’s essential to mention that their actions are no less criminal and should not be taken as a joke. The website owner incurs damage due to the loss of customers and the expenses incurred when a webmaster or security agency needs to repair and secure the website.

Finally, there’s “the corrupt web agency,” which consists of companies in countries like Russia, Pakistan, etc., who struggle to earn enough to support their families. Out of desperation to make ends meet, they misuse their knowledge. Their team of programmers and server specialists develop sophisticated viruses that embed themselves in servers and websites. These hacks are of a high level, requiring more effort to get rid of them. They often target the funds of your online store or promote their own webshop through advertisements. They frequently redirect visitors to their own website or webshop as well. They exert direct and noticeable control over your website, using clever tricks and backdoors.

How do you stop hackers?

/0 Comments/in

To stop hackers, you need to know what they do, where they log in, when they log in, and which files they modify.

If you know what hackers do, you can revert their modifications, remove backdoors, and delete their accounts.

Know what hackers do

You can get a clear overview of all events with the WPB Antivirus plugin.
This is a comprehensive antivirus plugin for WordPress that records everything that happens on your website!

An explanation of the log

Here, I will explain from left to right what you see and what you can do with that information to stop hackers.

  1. First, you see what happened. This includes logins, text modifications, file modifications.
    If you’re aware of what’s happening on your website in a timely manner, you can stop hackers in the early stages.
  2. Then you see the timestamp. This allows you to determine if the modifications occur at times when you weren’t logged in.
  3. The date is self-explanatory.
  4. The IP address. You can click on it to directly go to a GEO website that shows you where that person is located. Russia, China, America… you can quickly tell if they are hackers. Hackers often use a proxy (a fake location).
    You can block the IP address so they can’t access your website anymore. (Security » Ban Users in the plugin).
  5. If it’s a user with a registered account, you see the name, so you know who did what. (Or which account was hacked)
    Change the password in that case.
  6. In the example, it’s empty, but that’s where the requested URL is displayed. Sometimes you see files and pages that you didn’t even know existed!! (You can remove backdoors and unwanted files using an FTP program)
  7. This is also empty in the example, but here you see the destination location where a hacker ends up through their backdoor or page.
  8. The details provide even more information if available.
  9. Finally, on a scale of 1 to 10, you see the impact of an action.

Stopping a hacker

Hackers and the scripts they write can be extremely fast and sophisticated.
We are actively involved in restoring and securing hacked WordPress websites every day.

That’s why we offer subscriptions where we restore and secure your website. With updates & guarantees!!

This way, you pay a fixed monthly amount and never face surprises.

Want to proactively secure your WordPress website with a guarantee? Click here.

Is your WordPress website already hacked? Don’t panic, we will restore your website and stop the hacker(s). Click here.

Hacking the text editor in WordPress

/0 Comments/in

Hackers, click away. We’re not going to teach you how to hack WordPress!!

Now that the hackers are gone, let’s continue with this article.

The text editor hack

A common hack, you see nothing on the page and nothing in your editor.
Until you click on the Text editor tab! Suddenly, there’s ugly code.

Don’t be mistaken, this code is carefully chosen and does more to your website than you want to know.

  1. That piece of ugly text/code can make visitors see an iFrame.
    That’s an entirely different website that appears on top of your website.
  2. That piece of ugly code can redirect visitors to another website.
    For example, the hacker’s webshop.
  3. That piece of ugly code generates descriptions in Google.
    Think “Buy ….. at www…..nl”
  4. That piece of ugly code can turn any word into a link.
    Links to a criminal’s webshop.
  5. And much more!

With JavaScript on your website or on various pages, almost anything is possible!

You don’t want that code in your pages. Especially not secretly, as you may only notice it months later.

How can you find out if you have that ugly code in your website?

Simply check the text editor. (Or database table: wp_post)

How can you prevent that ugly code from getting into your website?

Unfortunately, that code is very easy to inject through a database query. Through an XSS, a vulnerability in a plugin, and 30 other ways.

So,

  1. Regularly update your website
  2. Don’t use too many plugins
  3. Use strong passwords
  4. Install an Antivirus plugin for WordPress that prevents injections, hacks, and hackers (Configure it properly!!)
  5. Keep only the theme you’re using on the server
  6. And lastly, but the first thing you should do now: back up your website!

If you’re having trouble, hire us. It will save you a lot of headache and time, and you’ll know that your website is in professional hands.

Know exactly how fast your website is?

/0 Comments/in

Know exactly how fast your website is?

Use the chrome browser and press F12

Then you will see a developer tools screen where you can click on NETWORK.

Then refresh the homepage of your website by simultaneously pressing SHIFT F5.

You will then see a number of data that we will explain using the image below.

What to look out for

At point 4 you can see how many requests the website makes, how large the website is in KBs and the loading time.

What is slow? Like 5-7 seconds and anything above that is slow.

At point 2 you can see which files are the largest and may slow down the website.

At point 3 you can see the time it takes to load a request or file.

So, now you as a website developer or website owner can see exactly how the speed of your website is doing!

WPsecure, you learn every day 😉

snelheid website

Why a hacker places links in your website

/0 Comments/in

As a hard-working entrepreneur, it is hard to imagine that those “3-5 links” of advertising in your website will make someone money.
So why would a hacker bother to get them into your website?

All SEO experts know why that happens, it’s link building.

Plus, it’s pennies. With scripts, 1000s of sites are provided with those links at once.

The website to which all links point will receive a temporary boost in Google. Until Google catches on to the foul play.

In addition to temporary link building, there are always people who fall for advertising.

How that works:
Your website that has built up a good name suddenly advertises a product that will help you lose weight quickly! 1 in 10,000 people will fall into the trap of the hackers and go to the website and be seduced with a beautiful fairytale about the product… and buy the product.

But criminals do NOT deposit the money from that sold product into their own bank account.. because that’s how they can be arrested or found.

Because the money goes to an anonymous account, they will not deliver the product.
And unfortunately, the contact options on their website are fake.

100% profit.

Note: hackers & criminals will get what they deserve. That won’t bode well in the long run!

Can your fast website get slow without security?

/0 Comments/in

Can your fast website become slow without security?

YES!

By default, various files of your WordPress website can be accessed, which are scanned by countless hack bots and viruses.
(Xmlrpc & rest-api & server directories & readme.html & license.txt & wp-admin directory & wp-login.php… and many more…)

These hack bots visit your website and rapidly request different files, thereby slowing down your website.
They are unwanted “visitors” who also visit 10-50 pages within seconds.
Unusual and burdensome usage of your server and data!

Are we talking about 1-2 bots per day?
No, there are 50-500 bots coming in daily.

The good security measures we implement block unwanted requests after 5-10 attempts.
IP addresses are also permanently blocked in the .htaccess file.
And we ensure that the hack bots don’t find the information they’re searching for.

Complicated? Not for us!

And not for you either. Fill out the form on this page and your WordPress website will be properly secured, updated, and monitored!
Within 24 to 48 hours. Don’t wait any longer!

What Google itself says about a website being hacked and displaying advertising

/0 Comments/in ,

What Google itself says about a website that has been hacked and shows advertisements.

  1. Your site has been demoted in Google’s search results
  2. Visitors are warned when they find you in Google

IN SHORT: Prevent your website from being injected with advertising

The so-called injections via a script are done via:
a. Outdated plugins where a leak has been found
b. Outdated WordPress version
c. Outdated Themes
d. Nulled plugins/themes (Illegal downloaded premiums)
e. Easy to guess passwords
f. A lack of restrictions…. and I can go on like this until Z..

The websites that we see often have 1 of the above combinations.

Below is the official message from the Developer Tools

Google’s Safe Browsing systems have detected that some pages on your site may be hacked or contain third-party resources such as ads designed to trick users into installing malicious software or handing over sensitive information. To protect your site’s visitors, your site has been demoted in Google’s search results and browsers such as Google Chrome now display a warning when users visit your site.

What is the CoinHive hack?

/0 Comments/in

CoinHive is a script written in Java. Nothing wrong with that.
This script makes it possible to “mine” Cryptocurrency which you can convert into real money.

Mining is done by having a computer’s CPU or GPU perform calculations.
In short, mining is not free and therefore costs power and computing power of a computer.

The CoinHive is illegally used by hackers

Where it goes wrong is if hackers can get the script into your website.
Then there are several options:

  1. The script prompts the server to calculate Cryptocurrencies
  2. The script puts the visitor’s computer to work for the calculation (Mining) of cryptocurrencies

And that is of course a crime. But very lucrative for the hacker.
Imagine being able to put 10, 20 or even 100 computers to work to calculate Cryptocurrencies.

How can a hacker insert a CoinHive into your website unnoticed?

There are several ways to do that. We will not discuss them in detail, but give some examples that have been known for years.

  1. Via a leak in your website, such as a leak in a plugin, a theme or in WordPress itself.
  2. By offering a pricey plugin “for free”, with the CoinHive code inside.

Don’t you notice that CoinHive is in your website?

No, a hacker changes the code every time so that the server and security do not recognize it. There are also various methods to make this unreadable.

When you notice.. you’re too late.

A block in Google

That’s when Google blocks your website because “your website is infected with Malware”. That is a collective name that Google uses to indicate that there are hacks in your website.

Antivirus Software Blacklisting

Antivirus software such as Northon, Kasperski, AVG, McAffee will detect the CoinHive on the visitor’s computer, which ensures that the website is blacklisted by the antivirus software after several reports.
Visitors with that antivirus software are then stopped from visiting your website or receive a notification when they visit your website.
This also shows the importance of good antivirus on your PC or laptop!!

Prevent CoinHive hack from entering your website

Make sure your plugins and theme + WordPress are up to date. If a leak is known, the developers often provide an appropriate security update. So you have to make those updates regularly.

Make sure that hackers’ common tricks and hack scripts don’t work on your website. You do this by installing and properly setting up a security plugin.

What if you already have a CoinHive hack in your website?

Then you can approach us, we have the experience and expertise to fully remove the hacks.
Not only removing the hacks is a necessity, but by fixing the leaks and the backdoors we ensure that the CoinHive hack cannot come back.

How we find and remove a WordPress hack

/0 Comments/in

If your WordPress has been hacked, you can assume that a file or piece of code has been placed in the website with which the hacker can send spam or show advertisements on your website.

There are currently 1000s of hacks developed by malicious people, the so-called hackers.
Every hack is written differently. This is to ensure that scanners do not recognize them.

How do we find that code or file among hundreds of WordPress files and all the code of plugins and WordPress?

We have various techniques with which we detect and remove hacks in WordPress

We will explain to you which methods we use to find hacks:

  1. Using the Wpsecure Detection (Plugin)
  2. We check the server in a structured way
  3. We use software that makes reading code easier
  4. We use the knowledge and experience we have built up over the past years
  5. The purpose of the hack betrays the placement
  6. We determine whether it is manual work or automation

1. Using the WPSecure Detection plugin

The WPsecure Detection plugin that we custom made scans the server and shows if there are Eval, Base64 or iFrames in the website.
Some plugins and themes also use this coding, but it’s mostly typical of hack scripts!

We check the line that follows a base64/eval line and recognize the illegal piece of code. (A matter of experience)

2. We check the server in a structured way

Folder by folder, file by file. We structurally check every folder for files that don’t belong there.
Since we have been working with WordPress for years (Since 2007) we know which folders should contain php files and which should not, we also recognize the names, junk folders and other tricks.

We check the website at file level with a checklist in which we tick which folder/files we have checked. This way we know for sure that every folder has been checked.

3. Additional software

With various programs (such as Notepad++) we can the code color reading, this makes it easier for us to read the Read important pieces of code carefully. Both file-by-file comparison and searches are among the methods to find hacks.

4. Knowledge and experience

By cleaning WordPress websites every week and working with WordPress since 2007, we know how hackers work.
We have set up, repaired and secured hundreds of WordPress websites. On various server environments.

5. The purpose of the hack betrays the placement

If there are links in the texts, you can assume that it has been placed in the content. If you can see outside the text, think of the header or footer, you can start the search in the theme.

6. We determine whether it is manual work or automation

We quickly see whether it is an automated hack script or whether someone has actually been involved in hacking the website.
With 999 out of 1000 websites, the work is automated, which means that a leak in the plugins, the theme or in an outdated WordPress version has given access to the server.

isn’t there a one-click fix?

You would expect that there are programs that detect and remove the hacks with 1 click.
Unfortunately this is not the case.

Hackers change their scripts, viruses continuously, so that a scanner will not recognize the hack.
Software simply cannot determine whether a line of code in a plugin, theme, or your WordPress core files is good or bad.

Did you know? 1 file can restore all hacks..

A hacker can use 1 line of code to ensure that backdoors, spam scripts are restored immediately after removal. That is why many web designers, server administrators and programmers cannot get rid of the hacks. They remove the consequence, but the virus remains in a different location on the server.

The hack spreads and is most likely to continue to function.

The challenge

As you may have read, there are several challenges in finding and removing hacks.
When you put us to work, we are working for a few hours, and we carry out various checks.
After that, we regularly check/monitor the website so that you are sure that you are rid of the hacks.

We guarantee that you will be rid of the hack within 10 to 48 hours, and stay that way!

Do you have a hacked WordPress website? Have your website hack-free now!