WordPress sites are one of the most common internet sites, and by some statistic, 27% sites on the internet are created with WordPress. this fact makes them a good target for hacking. Since it is so popular, it makes sense for hackers to invest time in finding vulnerabilities that they can exploit to attack many sites versus concentrating on a single site target. WordPress popularity makes it such a big target for hackers on the internet ecosystem, and therefore we need to plan our security respectfully.
These are some of the ways to hack to WordPress sites:
1) URL injection or bypassing
2) Widgets
3) Templates
5) Botnets / automated scripts attacks
6) Hacking the underlying infrastructure OS Windows/Linux
7) Hacking the underlying Web server
8) Finding variabilities in .NET or PHP
9) Open/un-secure ports
10) Database attack MySQL, SQL injection
11) Admin password hacking
One of the major ways to mitigate the security risks is by making sure your site is patched to the latest version. These patches include fixes that WordPress publishes to block known security risks. WordPress comes with built-in auto-update that makes updating patches a straightforward task. WordPress Hosts providers usually have an automation platform that pushes Patches to their WordPress tenants.
Ways to keep your site secure:
1) Patch WordPress to the latest patch version.
2) If your web site is hosted by a third party vendor make sure it is a trusted hosting company.
3) Encrypt your traffic using https protocol.
4) Use plugin and templates you can test and verify as a trusted plugin/template.
5) Keep WordPress plugins, and themes updated.
6) Backup your site daily.
7) Have a recovery plan that meets your site needs based on the sensitivity of your site information.
8) Monitor and block site attack attempts by using a Firewall.
9) Have strong Admin Passwords for WordPress.
10) Avoid untrusted WordPress Code.
11) User-personalized accounts to your Admins.
12) Install a WordPress Security Plugin.
A result of a successful hack can include the following:
1) Lost of data or data leak.
2) Forwarding traffic to other sites.
3) Defacing sites (changing the way they look and messaging).
4) Inject malware to your site.