WordPress is renowned for its user-friendly interface and straightforward learning curve. Beneath this benefit lies a subtle trap – creators are lulled into a false sense of security because of the ease and accessibility WordPress offers. Many of those charged with creating and managing sites lack the fundamental skills required to create safe site infrastructure, implement regular site maintenance and ensure secure user access protocols.

This leaves organizations vulnerable to malicious attacks. The good news is that with the right setup, consistent upkeep, and adherence to strong user security, WordPress continues to be a secure and dependable platform.

Hackers find WordPress a lucrative target because 43% of all websites are powered by it. Most attacks are conducted through a barrage of automated attacks - not motivated individuals with a specific agenda against your organization. Typically hackers are looking for the easiest sites to exploit. Minimize threats by consistently executing fundamental security practices.

WordPress is open source, which means that the code that runs your website may be examined by anyone including hackers. So, is it safe to use open-source platforms? For most SMB's an open-source platform is the right choice because it’s safer, more cost effective and consistent site management is more achievable.

WordPress’ open-source code is maintained by the WordPress security team, volunteer developers, ethical white hat hackers, and other interested parties with good intentions. So even if a vulnerability is exposed, it’s typically identified and quickly resolved through a WordPress update.
Understand that most security breaches happen for three reasons:

• WordPress or its plugins versions are not up to date.
• A user unintentionally installed malicious software.
• Insecure login credentials (login & passwords).

In other words, most security breaches are preventable. Read on to learn how to secure your site and minimize your risk of malicious website attacks.

Low-quality hosting is a major factor behind these security vulnerabilities. Invest in a Cloud, VPS, or dedicated host with good customer service. Saving a couple bucks on shared hosting is a big risk - all it takes is for one website to be infected, and the malware can spread across every site on the network. 
This is why you should only consider cloud, VPS, or dedicated hosting.
Research potential hosting company security records. Are they security-conscious? Do they rely on the latest technology and standards? After hiring a host, perform annual reviews to ensure their ability to provide secure hosting hasn’t declined.
In addition, you should look for a host that offers the following services:

• Up to date server software – Too many hosts still run on PHP 5, which has long lost support. At this point in time, servers should at least use PHP 7.0+. The same goes for other software like cPanel, MySQL or other database programs, and the operating system.
• Malware monitoring and removal – Pick a host that actively makes an effort to detect and prevent malware infections, and possibly offers malware scanning and removal for when you do get breached. Not all web hosts have a policy for removing malware from an infected site, and among those that do, some will charge extra for this service.
• Firewalls and other security measures – There are many ways that hosting providers can increase their server security. Possibly, the most effective among them is to rely on a firewall as it prevents unauthorized outside access to the server. It might be a good idea to check whether a provider has this and other means of prevention in place before making a choice.

A Secure Sockets Layer (SSL) certificate encrypts the data served between the user and your website. SSL grants you an https URL and a certificate to go with it, without which users will receive a red “Not secure” notification in the address bar when visiting your site.
SSL’s certification is essential because it let’s users know that your site is trustworthy and safe to visit. In fact, most browsers block access to websites without SSL.
Migrating your WordPress website to HTTPS can be a difficult process for existing websites. Your website is migrated by following these four steps, which can easily be automated with Really Simple SSL. 

1. Acquire your SSL certificate. As SSL has become industry standard. Most hosting providers will set you up with a free certificate which can be activated in your hosting dashboard.
   
2. Activate SSL. Once your SSL certificate is installed, activate it.
   
3. Upgrade all requests to https. Now that your site is secured over https, you’ll want to prevent any visitors from (deliberately or accidentally) visiting the insecure (http) version of your site. This is usually done with a 301 redirect. All links to used resources on your site (eg. Images, scripts, etc.) will need to be updated to https to prevent your visitors from seeing an ‘insecure site’ warning in their browser.
4. Enforce SSL. To further secure your site, you can add security headers to your site, which further enforce SSL and add an extra layer of security.

Backups allow you to minimize downtime and expense should a catastrophic event take place. Even if your site does get hacked beyond repair, it won’t have to be rebuilt from scratch.
An automatic backup schedule should always be in place. Check to see if your host offers weekly, monthly, or daily automated backups. If this is the case, and your host backs up both your files and database, set the backup schedule and test that it’s working properly each quarter.
Backups should be scheduled daily. It’s also a good idea to process manual backups any time a major site update is performed.
If your host doesn’t offer website backups, or if the backup provided by our host excludes files or our database, you can also use a plugin to perform the action.
It’s a good idea to have at least a solid solution for each website you own or administer, and WordPress backup plugins can provide that extra layer of protection.

If you’ve chosen a good host and your backups are set up, you have foundational infrastructure in place. Plug-ins are the next area of concern, and you must have a process in place to keep them updated. 
An outdated plugin or an insecure theme is the huge gateway for infiltrating your website.
Updating your site components is as simple as going to your WP admin dashboard and checking for update notifications under Dashboard > Updates.
Mark any themes or plugins you want to update by ticking the boxes, then click the button at the top/bottom to start updating them.
Many plugins can be set to automatically update. Chose this option if available. And check monthly to verify that all plugins are updated. If a plug-in consistently fails to update, consider replacing it with a plug-in that can be more securely maintained.
More important than updating your plugins and themes is keeping WordPress up to date.
It’s estimated that 40% of hacked WordPress sites were exploited because WordPress was outdated. Avoid pushing off an update because it may interfere with a plugin. Lose the plugin to save your site.
Pro tip: Remove the WordPress version number from your source code.
By default, WordPress websites carry a meta tag containing the WordPress version number that the site is using. Why make hackers job easier? If you are using a WordPress security plugin, many of them hide your WP version automatically.

Another big mistake WordPress users make is getting their plugins and themes from unreliable vendors. A bad theme or plugin can corrupt, deface, or inject malware into your pages. 
Third-party websites and developers are not endorsed by WordPress, and as such, you never know what you’re getting. Even if a plugin is in the official directory, it is not guaranteed to be safe.
Before downloading any plugin, perform due diligence. Know how often they are updated, if they are maintained and how popular they are. WPScan offers a free directory of known plugin vulnerabilities to help in your plugin review.  
The same is true for themes. WordPress offers a some themes in the theme repository. Only purchase original themes from reputable vendors.
Avoid “nulled” WordPress plugins and themes. Nulled WordPress themes and plugins are pirated software - stolen copies of premium WordPress products sold at a discount or given away. Nulled themes and plugins pose significant security and SEO risks.  They often include malicious code — spammy links, redirects to dubious websites, a backdoor that grants unauthorized access to your data, or malware that could steal confidential information or even crash your entire site.

WordPress comes with a set of easy-to-reach theme and plugin editors. You can find them under Appearance > Theme Editor and Plugins > Plugin Editor. These allow direct access to your site’s code.
These tools are useful to experienced programmers. It’s best practice to disable file editing, as hackers can use the file editor to quickly execute malicious code or delete entire parts of your website. Disabling this slows them down.
You could also turn off the theme and plugin editors with one line of code in wp-config.php. If you end up needing to edit your site or plugins, just temporarily turn them back on. Alternatively, you can edit them via an FTP client.
Disabling file editing won’t necessarily prevent attackers from doing damage, but it can confuse less experienced hackers and slow their attacks down allowing time for the attack to be discovered and begin eliminating the threat.

One of the most common ways hackers gain access is through brute force attacks. Automated scripts are used to guess the right username and password to access your WordPress website.
A successful brute force attack can give hackers access to your website’s admin area where they can install malware, steal user information, and create havoc on your site.
Brute force attacks can be stymied by requiring multi-factor authentication and strong login credentials for every user.
The first step to protecting your WordPress website is to add two-factor authentication (2FA). This requires users to enter a login, password and a secondary code (from an app, email, or text message) to log in to the WordPress site.
There are multiple ways to set up 2-step login in WordPress. Best practice is using an authenticator app. An authenticator app is a smartphone app that generates a temporary one-time password for the accounts that you save in it. There are many apps available such as Google Authenticator or 1Password.
Learn how to set up 2F authentication in this article from our friends at Hubspot.

Login credentials consist of a username and password. Most of us are keenly aware, and constantly reminded of the importance of strong passwords. Usernames are an important but often overlooked security element.
Think of your password and username like your home keys: If your keys are ever lost or stolen, the finder would still need to know your address before they could use the key. Brute force attacks need to break both your username and password to be successful. Using your email address as your username is like writing your address on your key fob - it streamlines the process for hackers.

Safe usernames are unique, memorable (but not common), safely storable, not reused, do not include personal information and do not include your email address.
Avoid using these common usernames:

• Admin – This used to be the default username for WordPress and is, therefore, one that will definitely be tried in a brute force attack.
• Your real name or nickname – This is both public information and as easy to guess as “admin”. In addition, it can make sense to create a separate profile without administrator right to publish content. That way, the username of the main login does not appear on the website.
• Any personal information – Including birthday, etc. Only use a personal detail if it’s something no one could ever know.
• The title of your site, or something obviously related to it  – “Kittens” for a cat adoption agency, etc.
  

Just about everything about passwords is inconvenient. Strong passwords are challenging to create, remember, store and inconvenient to access.
Good password hygiene means that every user in your system creates and effectively manages every password they use. For most of us that is hundreds of passwords. And each must be long, unique and complex.
That’s a lot of passwords. Without the aid of eidetic memory, people are simply not capable effective complex password management.
Password managers are fantastic tool to help users and organizations successfully manage an imposing task. These secure applications create, store and generate new passwords as needed. Most password managers can sync across several devices, so users are never without an important password when they need it.
Organizations can utilize a password manager app to retain control over system access, ensure that every user follows best practices, and remotely turn access on or off.
There are a variety of password managers available. Currently, two of the most reputable are 1Password and Authy.

By default, anyone can log into your website by going to yoursite.com/wp-admin. You can stop them in their tracks by changing the URL entirely. WPS Hide Login allows you to switch it to whatever you want. Just install it and go to the plugin settings to change it.
Change your login path to something unique and difficult to decipher. For many of our clients, we utilize a combination of their client code and zip code of their HW. We use 4-letter client codes so an example would be /DCHC33109
Next, install a plugin to limit login attempts. Any person can spam your server with hundreds of requests until they guess it right. A plugin that limits login attempts will give them only a few chances before they’re locked out. It can also detect and redirect bots away from your login page.
Other lock-down tools you may consider deploying are:

• CAPTCHA tests. CAPTCHA is an acronym that stands for "Completely Automated Public Turing test to tell Computers and Humans Apart."
• Cloudflare Rate Limiting. This automatically detects brute force as well as DDoS attacks and blocks the offending IP address.
  

In summary: Pick a trustworthy host with secure servers, install an SSL certificate, keep your website backed up, update your plugins and themes, and make sure all logins follow secure access protocols. Do all this and hackers will never make it beyond the gate.

Has your WordPress site ever been hacked? How did you manage to reclaim your website and clean it up? We’d love to hear your story in the comments.

Yes, provided you don't have large-scale eCommerce needs. Weebly is simple, affordable and effective. It’s an all-in-one domain, hosting and site builder able to run a powerful site – no coding or advanced knowledge required.

Simplicity is the advantage and disadvantage of using Weebly. Users of any skill-level can visually assemble and launch a responsive, SEO-friendly site fast.

Although not suited for large eCommerce sites, Weebly provides small-to-medium size players with a very cost-effective option.  50 million use Weebly worldwide and it is offered in 15 languages.

It is ideal for professional service providers, small-to-mid size manufacturers, non-profits or similar organizations that need a great site without the carrying costs associated with site development and management.

Weebly offers collaboration allowing site owners to invite people to edit specific areas of your site and assign them different levels of access. It’s a cool feature you won’t find everywhere.

The site-creation tool impresses with a clear, simple drag-and-drop interface that lets you easily build excellent-looking and responsive webpages. Novice users may not realize that the design limitations that come with ease of use also provide a layer of protection against inadvertent catastrophic mistakes that are so easy for novices to make when working in WordPress or other site-builders with more challenges structures and easy code access.

Weebly offers a fair selection of template designs and integrated e-commerce tools. If you’re not able to find just the right theme from Weebly, third-party themes from platforms such as ThemeForest and WebFire give you more options – be aware that these may require more technical knowledge to implement. And, additional functionality is available through Weebly’s app center. You can find over 350 apps and integrations for site-tools, social media, pop-ups, SEO, calendars, appointments, eCommerce and more.

Advanced users can customize HTML and CSS files providing greater control over website layout for users with developer skills.

Weebly is fast with outstanding 99.9% uptime. Many site builders fail on this point but our testing revealed response rates in the United States from 3ms to 81ms. Outside the US speeds averaged 136.8 ms.

SEO functionality is built right into the Weebly platform. Just like any site, the ability to rank highly on search engine results pages (SERPs), comes down to what’s in it. Factors like keywords, site content, and links are all critical elements of effective SEO. If you install the MarketGoo App, you can get a free SEO analysis report of your published site.

What the Experts Say
PC Mag rates Weebly as a good website builder with a 3.5 star rating citing well-rounded features with limited customization. Software analysts Michael Muchmore & Jordan Minor concluded that, “Weebly is an easy-to-use builder. It lets you create and publish attractive, responsive design sites, blogs and online stores, but could use more themes and a better photo repository.

Website development expert Sophia Conti feels that “Weebly is one of the best ways for beginners to build a website that looks and acts like it was built by an expert. It still has some limitations, but if you want to keep costs low and have all your tools in one place, Weebly could be the way to go,” giving Weebly 4.6 stars.

PROS

• No coding or advanced knowledge required
• Responsive themes
• Integrated eCommerce option
  
• Switch themes without rebuilding your site
• App & integration center
  
• Outstanding uptime
• Integrated SEO functionality
• Fast site speeds
• Part of Block, Inc. (Formerly Square, Inc)

CONS

• Lacks reusable photo storage
• Limited design capabilities
• Can’t go beyond H2 headers
• Poor image editing tool
• Limited blogging tools
• Upgrade required for chat, phone or email support

 
The Bottom Line
At the end of the day, choosing between an all-in-one site builder and a custom-built site comes down to your resources and budget.
If you’re looking for simple and affordable, or you’re a one-person marketing team, Weebly is an excellent choice. You’ll be able to create a nice-looking website that can be optimized to attract web traffic, without spending a lot of time or money.
On the other hand, if you aren’t restricted by expertise and are able to handle building and managing your site in-house, WordPress may give you more of what you're looking for.