If you have a WordPress site you have certainly run into a security hole at some point. Do not worry about it, one way or another it has happened to us too. We decided to put together an article on the causes, drawing on the research from Sucuri and Wordfence.
The clearest thing our research turned up, and I have to say it plainly, is that the problems come from plugins. Try not to download and install a plugin onto your WordPress site from some third party source. These are the sources that hold plugins you can trust.
- WordPress.org Plugin
- Codecanyon WP Plugin
So you have done your research and found a plugin somewhere online. It is not listed on WordPress and the developer serves you the plugin file from their own hosting. Install that on your system and you have opened a large security hole. It will not harm your site today, but; after a while it can cause you serious trouble.
The Wordfence Report on Causes
Plugins are the principal source of security holes in WordPress. Which is why you have to be as careful as you can with the plugins on your site. For the health of the site, the fewer plugins the better. Every one of us installs plugins without thinking it through and then deletes them. But; each of those plugins leaves traces behind even after removal. We covered that in detail in our piece on speeding up a WordPress site.
Your PHP Version Matters Too
Stay on the latest PHP version as far as you can. What themes and plugins are compatible with will point you at the highest PHP version you can actually use. Try them one by one, find the version that runs cleanly, and update your site to it.
So What Should You Do About Security?
Two factor authentication is a workable plugin that will handle this for now.
With this plugin you can stop anyone connecting to the admin account that runs your site without approving it from your phone. That is a fix going forward, of course; if your site has already had a security incident, you need more than a plugin to clear it.
How Do You Find a Virus on Your WordPress Site?
This is really a much longer subject, of course. But; it has happened to us plenty of times, and here we will set out the route we follow.
- Starting a virus scan through cPanel is a good opening move.
- You can connect to your MySQL through phpMyAdmin and search for the virus code.
- You should install the WordPress Wordfence or Sucuri plugin.
- You should delete every other plugin from your FTP account.
- You should delete every other theme file from the FTP account.
- You should check every file in the uploads folder
- You should delete the WordPress core files and upload the current WordPress files.
- You should change the FTP and database passwords.
- Change your WordPress admin password.
In short, only the uploads folder should be left on your FTP, and everything else should be installed again from scratch. Even the uploads folder you should check folder by folder, “2024 > 01” and so on, before uploading. If there is a .php file or anything out of place inside, never put it back on your FTP server.
Under WordPress “users”, make sure there is no admin apart from you. If you can, restrict every administrator and editor role for now. I hope the steps here are of use to you and that you clear the trouble on your site quickly.
