Is WordPress Secure?
We are launching new websites all the time and we are always looking for a robust CMS.
WordPress is the obvious choice, do you have grave concerns about the security of your site, since your company has a ton of visibility and could become a target for attack.
- It’s interesting when a good friend asks you a question like this because it makes you reevaluate your opinions and assumptions and make darn sure you’re providing advice that will set up this person that you care about for success.
I think it would be most helpful to distill my thinking on whether or not WordPress is secure into a FAQ format regarding the subject.
Is WordPress Secure?
The good news is that WordPress actually does much of this job automatically. If you have the default configuration, then when the core team releases a minor version of WordPress, it will upgrade to that new minor version automatically. Security fixes are released as minor versions. So when a security fix is released, unless you’ve specifically configured your site to not update automatically, your site will update to the newest security fix and you will be protected from an emerging vulnerability. To be clear, WordPress versions come with three numbers separated by dots. The current version is 4.9.4. The number to the far right is the minor version. So when that changes, your site will be automatically updated. When 4.9.5 is released, your site will automatically update. When 5.0.0 is released, it will not.
Keeping Plugins and Themes Up to Date
You will also need to keep your plugins up to date. This does not happen automatically, except in rare cases where the plugin author provides that functionality. Wordfence security plugin updates automatically when we release a new version. Most plugins don’t. But again, we have some great news. In cases where there is a severe plugin vulnerability, the WordPress security team have the ability to force plugin security updates, and have done so in the past. They have never automatically updated a theme, but they have the ability to do that, too.
In general, though, minor vulnerabilities that a plugin author fixes are not updated on your site automatically. That is why keeping your plugins up to date is one of the most important things you need to do to keep your site secure.
Protecting Yourself During the Window of Vulnerability With a Firewall
Nginx Firewall
Cpnginx Firewall Protects Your Website From Attacks.
- DDOS Layer 7 Protection
- Nginx DDOS protection. Protect servers from L7 DDOS attacks.
- Slowloris Dos Protection
- Control Slowloris DDOS attacks and protection from malicious attacks.
- Protect Range Based Attack.
- Protect your website attack against CVE-2015-1635.
- Block attacks from bad user agents and bots.
- Protect from bad scanners to avoid security leakage.
- Protect your websites from Clickjacking x-Frame attacks.
- Disable Symlink access from your webserver’s document roots.
Google Page Speed
