Imagine your website is a house. It's important to keep the main door (admin account) locked, but what if a burglar gets in? In WordPress, a hacked admin account can often lead to complete disaster for your entire website (and even the server it's on!).

Here's the problem: most people just assume if the "main door" is broken, there's nothing left to do. This isn't how things should be!

How do hackers break into your website?

Access to your website can be through multiple channels: 

1) Someone knows your email and password 

• You may have used the details on another service that had a data leak.
• Your computer was hacked and the password was stolen 
• Your device was stolen and broken into
• You are sharing a login with someone else 

2) Your 'session' is stolen

Once you log in, your computer doesn't send the password every time you click a link on a website. It uses a session that will eventually terminate, and you will have to log in again. That time can be set by the time you are idle on the site, some security time, or an absolute timeout. 

With this session, someone can access all the websites you have, without your username and password. Scary right?

• Most likely your computer has malware and the hacker has stolen your active login to multiple sites
• Your computer was hacked after you clicked a link on an email 
• Your computer was compromised by visiting some other website 

3) Your website code 

• You have a plugin/theme that has a vulnerability in its code but is not fixed
• You have an old plugin/theme 
• Your server is not up to date 
• Your server is not correctly configured
• Your WordPress site is not correctly configured or provides more access than your site requires 

How do we help keep you safe?

Your Managed WordPress Hosting with SixFive includes safeguards to keep your site safe, online and operational. We call it Fortress. It protects you and your website in 4 key ways:

1) As an Administrator or Editor-level user: You have to have Two Factor Authentication enabled 

This mitigates your password being known by a malicious person. 

2) As an Administrator or Editor level user your ability to make destructive changes is restricted through reduced permissions. 

This reduces the ability of someone who has stolen your session by limiting the abilities of the user after a short period of time. Much like online banking will ask you to authenticate when you send money to a new account, this system asks you to authenticate to delete something.  

3) We restrict the ability to add new plugins or change code via the browser admin - Code Freeze

When your site is up and running, the need to change code or add plugins is minimal, and as such is no longer available via the browser. This again, restricts the damage anyone can do when logged in. 

4) Administrator passwords cannot be reset via email

Email is not safe. It is not a secure method of communication and thus, sending a link to reset or a password via email for a privileged account is considered to be insecure.

Non-WordPress protections

The sites and servers we run also have the following non-Wordpress-specific protections in place:  

1) Your DNS and domain are with the excellent Cloudflare service, that provides a firewall to stop a hacker before they get to the website

2) The very good 7G Web application firewall on the server (if Cloudflare didn't stop it)

3) Fail2Ban that keeps brute force login hackers from guessing passwords through repetition

4) Malware scanners called Maldet and Clam AV for antivirus on the server

What else can I do? 

You should only provide Administrator accounts to those who need to make site-wide changes. Consider using Editor, Author, or a custom role for those who are publishing content.

Principles of least privilege are the best approach.