Wordpress Website Security Updates 2022

Over the past 6-12 months there have been a number of updates to the different elements of are used to display your website. These include PHP (the embedded scripting language), the WordPress platform itself, various plugins created by developers to be used on the platform and the themes which are used to display content. 

To ensure your platform is fully supported in these different areas and your website is not at risk from reduced security we strongly suggest updating them. We have prepared cost-effective options to be able to run these updates on your website and also offer core enhancements in areas such as website security to stop malicious attacks.

iTheme Security Pro 

We offer a security package that offers a strong defence against common website attacks. This can (but is not limited just to the below):

• Stop automated attacks
• Monitor suspicious activity 
• Strengthen user credentials (2FA)
• Scan themes and plugins for security and vulnerabilities 
• Automatically block-out bad users, user agents and IP addresses

Security headers (one-off Installation)

For additional on-page security, we can also implement a high-security script to halt advanced attacks. 

– Strict-Transport-Security: 

This informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS. This ensures communications are encrypted and helps to protect against man-in-the-middle attacks.

 – X-XSS-Protection, X-Content-Type-Options and Content-Security-Policy: 

These tools are designed to prevent cross-site scripting (XSS), clickjacking and other code injection attacks on both legacy browsers and modern browser types. 

 – X-Frame-Options: 

This stops the ability of a user to embed data inside an iframe into a different site, thereby preventing clickjacking attacks via this method. 

– Permissions-Policy: 

This tool gives site owners the ability to enable and disable certain web platform features on their own pages and those they embed. For example, it can remove the ability to download or save items on a web page or disable API features based on permission criteria. 

– Referrer-Policy:

This tool controls how much referrer information should be included with requests. This can restrict the information freely available to people examining the code of a website or scanning for vulnerabilities in specific elements or areas of the website. 

Complete vulnerability audit

Often PHP vulnerabilities are shared within the community but being notified of vulnerabilities is difficult when there are hundreds and thousands of open source packages available. Website themes and frameworks often deploy with an open source tool known as Composer. We have built an internal system so that we can keep up to date with Composer vulnerabilities for a particular website on a weekly basis. Should a vulnerability arise, we can then work with the client to understand what the solution is but being aware of these vulnerabilities is the first step and it is always a good idea to be proactive, rather than having to deal with a website that has been exposed to by attack. This is not the same as WordPress and plugin updates.

Regular database and file backup checks 

To ensure backups are maintained properly and you always have a working version of your website ready to use in case of failure or attack, we can run regular checks to ensure your database and file backup are not corrupted and all features are working should it need to be deployed. 

We will also store this working backup in a secured off-site location to ensure total redundancy in the event of a fire or other natural disaster at the original server location. This approach is in compliance with stringent security measures including ISO 27001.

We offer different frequencies to check backup integrity, this includes 28 days, 14 days or seven days but our system is compatible to whatever frequency you require.