9 most common WordPress security vulnerabilities and how to fix them

WordPress security is a major yet often neglected concern among site owners. However, there are simple solutions to easily fix the most common vulnerabilities and significantly strengthen your website’s security to protect it against cyber attacks.

Want to improve the security of your WordPress site? Debugbar will help by reviewing the 9 most frequent WordPress security issues along with existing fixes to resolve them effectively.

1. Weak passwords

When choosing a password for their site, many publishers opt for simplicity so they can easily remember their login credentials.

However, using a weak password like “qwerty” or “password” or using the same password for multiple accounts is a major risk to WordPress site security. Such easily guessable passwords are a goldmine for hackers who can then easily log in to your WordPress site and access to your backoffice and take control of your website in order to:

• Modify your site
• Steal sensitive data
• Use your site to spread malware

Fortunately, this vulnerability is fairly easy to fix. You just need to use unique, strong, and hard to guess passwords.

To do so, you should:

• Use a combination of upper and lower case letters, numbers, and special characters (e.g. Str0ngPa33w0rd!)
• Choose a password at least 12 characters long
• Avoid dictionary words or personal information
• Use a password manager to generate and securely store passwords

By following these best practices, your passwords will be much more secure. And if you’re afraid you’ll have trouble remembering all your passwords, don’t panic, there are excellent password managers out there.

2. Outdated themes, plugins or WordPress version

Do you never update your WordPress websites? Are you using old versions of your plugins? That’s a bad idea… Indeed, using an outdated version of WordPress, a theme, or a plugin can cause significant security vulnerabilities because these old versions no longer get the latest security updates.

The risks are manifold:

• Hackers can exploit known vulnerabilities and take control of your WordPress website
• They can inject malware, steal or delete sensitive data
• Your website can even be used as a starting point for cyberattacks

It is therefore important to regularly perform updates to ensure you have the latest versions of WordPress, your themes, and plugins to protect your website.

To do this, nothing could be simpler:

• In your WordPress dashboard, enable automatic updates so WordPress updates itself.
• Regularly check for updates to your themes and plugins (usually a small red dot indicates available updates) and install them as soon as they become available.
• Remove unused plugins and themes that are no longer maintained. An outdated plugin or even outdated themes may contain critical vulnerabilities.
• Back up before any major update in case it causes issues.

With these simple actions you will already minimize security issues related to outdated software.

3. Lack of security plugins

As a WordPress user, you know there are many plugins to enhance your site. Not all are necessarily useful but some are essential. This is especially true of security plugins.

Their absence on a WordPress website makes it much more vulnerable to attacks such as:

• Intrusion into the website admin
• Malware injection
• Data theft
• Etc.

To put it very simply, a hacker can take complete control of your WordPress site with no difficulty if you do not protect it with dedicated plugins.

But don’t worry, it’s very easy to add this protection thanks to some proven plugins:

• Install a plugin like Wordfence to analyze your website. It will block unauthorized access
• The Sucuri Scanner plugin cleans existing malware and prevents future infections
• Limit Login Attempts prevents abusive brute force attack login attempts
• iThemes Security enhances the security of your WordPress website admin account

These plugins provide effective protection against major threats. Combine several for enhanced security and remember to update them regularly.

4. Lack of Two-Factor Authentication

Two-factor authentication (2FA) is a system that requires you to identify yourself twice before accessing your site: once with the password you enter on your login page, a second time using a code you receive via SMS or email.

As you can imagine, the lack of two-factor authentication (2FA) on a WordPress website is therefore risky since the password alone can be guessed or stolen.

Whereas if double authentication is enabled, even with your password, it won’t be able to do anything.

So it’s a useful protection you’d be wrong not to implement, especially since it’s extremely easy and quick to set up. All you have to do is:

• Either install a 2FA plugin like Google Authenticator or Duo Two-Factor Authentication
• Or enable 2FA at the hosting account level if your host offers such an option

Want more details on this protection? Feel free to check out our article: How to Enable Two-Factor Authentication.

Whichever method you choose, don’t forget to back up your 2FA recovery codes in a safe place in case you lose your device.

5. Unsecured web hosting

Hackers love to go through servers to hack a website because it allows them to access multiple websites at once.

If you choose cheap hosting with default configurations, your website is an easy target for hackers. Especially if other vulnerable websites are on the same server as it will allow hackers to move from site to site wreaking havoc.

To secure your website, it is recommended to:

• Choose a hosting specialized in security, like SiteGround or WP Engine. Their servers are configured to maximize WordPress websites security.
• Opt for a VPS (Virtual Private Server) which will isolate your site from others on the machine.
• Secure the web server configuration (Nginx or Apache) to strengthen protection against intrusions.
• Limit access to servers via a properly configured firewall.
  

Of course, this hardening has a higher cost than a low-cost hosting. But protecting your WordPress site is well worth the extra investment.

With a good hosting, you minimize risks of attacks related to an overly permissive configuration.

6. Cross-Site Scripting (XSS) vulnerabilities allowing code injection

An XSS vulnerability allows a hacker to inject malicious code, like JavaScript, into a web page. This code then executes when a user visits the page.

Let’s take an example to be more concrete. Imagine a hacker leaves a comment containing JavaScript on your WordPress blog. Well, as soon as a user reads the comment, this code will be activated and could then allow the cybercriminals behind it to:

• Steal cookies and passwords stored in the browser
• Redirect your site’s traffic to malicious websites
• Install keyloggers to spy on your visitors’ keystrokes
• Modify the contents of your site
• etc.

As you can imagine, an XSS attack can have disastrous consequences… It is therefore essential to take preventive action. You can do this by implementing several actions:

• Validate and filter all user input (comments, forums, etc.) before display to block malicious JavaScript code.
• Encode special characters when displaying. This neutralizes codes already introduced.
• Disable HTML code editing by users on your site.
• Use a WordPress security plugin to scan your site for XSS vulnerabilities.

With these protections, injecting JavaScript via an XSS vulnerability will become extremely difficult. Your users will therefore be better protected.

7. A too permissive Database (SQL Injections)

A SQL injection allows a hacker to inject malicious SQL queries into a WordPress site’s database.

For example, in a comment form, the “name” field normally allows entering text. The hacker will take advantage of the opportunity given to him to write on your site to enter SQL code instead. This code will then be executed by the database and give him the possibility to:

• Steal sensitive information from the database
• Destroy or alter data
• Take complete control of the database
• Install a Malware on your website

To prevent SQL injections you will have to take some preventive measures:

• Validate and filter all data entered by users before sending it to the database
• Use prepared queries or WordPress’s WPDB framework that prevents injections
• Limit permissions on the database to reduce impact in case of successful injection
• Analyze database logs to detect suspicious queries

With these security measures, a hacker will have a much harder time injecting harmful SQL queries into your WordPress site’s database.

8. An unsecured website (HTTP)

Using HTTP instead of HTTPS for your WordPress site makes all communications between the site and visitors vulnerable to eavesdropping and hacking because the HTTP protocol does not encrypt exchanges, unlike HTTPS. Hackers can therefore easily intercept:

• Passwords and personal information entered in forms
• User session cookies
• Data sent between the site and servers

To secure transmissions, you need to:

• Install an SSL certificate on your site to enable HTTPS. You can obtain free or paid certificates depending on your needs.
• Add a permanent HTTPS redirect rule in the .htaccess file.
• Make sure all internal links point to HTTPS URLs.
• Configure HTTP headers to strengthen exchange security (Strict-Transport-Security, etc).

Switching to HTTPS is mandatory to guarantee the confidentiality of data exchanged between your WordPress site and its users. Otherwise, they are vulnerable to eavesdropping.

9. Incorrect file permissions

Incorrectly configured permissions on a web server are a threat to the security of a WordPress site.

Indeed, some sensitive files like wp-config.php must not be writable by just any user. However, with permissions that are too lax, a hacker can:

• Modify wp-config.php file and inject malicious code into it
• Modify other WordPress files (themes/plugins)
• Etc.

To secure permissions:

• WordPress directories must be 755 and files 644
• The wp-config.php file must be 400 or 440
• Write permissions must be revoked on all files except where necessary

With locked down permissions, a hacker can no longer arbitrarily modify files and compromise the security of your site. This hardening of the rules is therefore essential to apply.

WordPress Vulnerabilities in Brief…

In summary, WordPress site security is often neglected and easily avoidable vulnerabilities are not corrected, making them vulnerable to cyber attacks. Fortunately, there are simple solutions to fix the most common security issues and thus effectively strengthen site protection.

Among all the solutions to be implemented to correct vulnerabilities, here are the 5 main ones you absolutely must remember:

• Use strong and unique passwords for each account
• Regularly update WordPress, plugins and themes
• Install renowned security plugins
• Enable two-factor authentication (2FA)
• Choose a secure and well-configured web hosting