WordPress Security
IMPORTANT WORDPRESS HOSTING REQUIREMENT ANNOUNCEMENT
Please read!
Please be advised that due to the ever increasing load of security maintenance of WordPress based sites that effective July 15th, 2016 there will be a monthly nominal fee to help cover the expenses for a service we have named SECURITY+. This fee is for WordPress sites only and it is based on the time that it takes to maintain the WordPress Weekly Security infrastructure. Depending on the site, this could be from 10 minutes to 30 minutes per week.
WordPress is the most popular development environment for mobile responsive websites in the world with a current install base of over 24,657,825 installations. Because of this, it is also the most vulnerable to malware infestations, direct denial of service attacks (DDOS), SQL code injections plus much more.
All of the WordPress sites hosted by us are monitored by a service called Wordfence™. Wordfence™ tracks the core WordPress files, associated plugins and themes for outdated versions which is the main reason a site gets hacked. It also tracks attacks from hackers, especially those attacks originating from other countries such as the Russian Federation, Korea and China. However, the standard Wordfence™ version may not completely block the attackers. What is does do, is that it warns us when an attack is attempted and it also emails us problems when it detects outdated versions of the WordPress core files and associated plugins and themes which happens just about every week. Here are examples of such emails:
This email was sent from your website “Providers Management Shop” by the Wordfence plugin.
Wordfence found the following new issues on “Providers Management Shop”.
Alert generated at Thursday 7th of July 2016 at 01:00:13 AM
Critical Problems:
* The Plugin “Duplicator” needs an upgrade.
* The Plugin “Groups” needs an upgrade.
Here is an attack notification email
This email was sent from your website “Seaside Pool Builders” by the Wordfence plugin at Thursday 30th of June 2016 at 10:06:54 AM
The Wordfence administrative URL for this site is: http://seasidepoolbuilders.
A user with IP address 178.137.0.63 has been locked out from the signing in or using the password recovery form for the following reason: Exceeded the maximum number of login failures which is: 20. The last username they tried to sign in with was: ‘admin’
User IP: 178.137.0.63
User hostname: 178-137-0-63-broadband.
User location: Kiev, Ukraine
In addition, we also subscribe to the Sucuri® security notices that alerts us of emerging threats sometimes days before a threat is known at large. We in turn, just like we have since the beginning of this year, login to a WordPress site on a weekly basis and perform the core, plugin and theme updates. We also check the overall condition of the firewall and perform other updates as necessary. This is a very time consuming task.
Wordfence™ has a Premium Version of their service that does block hackers based on origin and behavior. It also allows us to block access to the site from even viewing it from all or selected countries outside of the United States. It also allows us to block access from IP addresses within the US that are suspicious. Should a site become compromised, analysts from Wordfence™ will help us to clean up and harden the site from future attacks.
Google® and other Search Engines constantly monitor for sites that pose a threat to a visitor and if they detect an issue with a site, they will blacklist it. This is what the screen looks like for a blacklisted site in Google (the website address has been erased for privacy purposes):
If a site is blacklisted by the search engines, it will a have significant impact on the search engine ranking and reputation of the site.
We have experienced multiple compromises in the past year, one of which, took over 3 days to rectify.
Internet security is a serious issue and it is not to be taken lightly. A compromised site can become disabled or worst yet, it can infect a device that a visitor uses to view a site. A compromised site can also cross-compromise other sites on the same server, causing an epidemic. So, effective July 15th, 2016, all WordPress sites on our cloud will be required to have signed-up for our SECURITY+ service to perform all the weekly services discussed. This SECURITY+ service also includes the Premium Version of Wordfence™.
Consider the following infographic on WordPress site attacks:
The nominal service fee for us to maintain security and updates on a website with our SECURITY+ service on a weekly basis is only $25 per month and since it involves login in to the site, we are willing to provide up to ½ hour of support per month for other modifications, additions to the site and SEO.
The SECURITY+ service fee includes the following:
- Wordfence™ Premium Service
- Weekly WordPress Core, Plugins and Theme Updates and on-demand as prompted by Wordfence™
- Weekly backups to an off-site storage
- Monitoring of Firewall condition (attack attempts, source locations, etc)
- Blacklisting IP addresses of attack attempt locations and country blocks
- Up to ½ hour per month of website support for additional modifications, additions, SEO, etc.
We hope that you understand this requirement and the value that it provides. You will receive an invoice for this SECURITY+ fee in the next few days which you can pay by check or credit card right from the invoice through our secured Wave payment gateway.
The SECURITY+ service fee is minimal compared to the service it provides. In the event you disagree with this requirement, or you feel you are confident that you can maintain the WordPress security of your site yourself, please email us at cancel@capefeartechnologies.net so that we don’t generate the invoice. In that case, it will be your responsibility to monitor and maintain your site’s security. If a site becomes compromised, it will be immediately quarantined and suspended because of the possibility of cross-infestation.
Thank you for your business and understanding on this very important matter.
If you have any questions please feel free to contact us
