With WordPress powering 61% of CMS based websites, it has become a lucrative target for hackers. Google blacklisting for phishing and email blacklisting for spamming is quite common in WordPress hosting. A well maintained WordPress site is immune to hacking, but in shared hosting, the majority of such websites will be un-patched, and vulnerable to hacking.

Through a few simple strategies, it is possible to make WordPress immune to hacking. Here’s a quick check list on how server management services prevented WordPress hacking in cPanel/WHM servers.

See how we help web hosting companies

Securing the web server through web application firewalls

The efficiency of a web application firewall largely depends on how quickly the firewall is able to include zero day WordPress exploits into their signature database.

While commercial signatures gave close to 100% detection rates, we have seen that the free rules from Comodo, AtomiCorp, etc for the mod_security Apache module is good enough to prevent more than 95% of exploit attempts. Additionally, we were able to extend the malware detection capability of mod_security module by integrating it with ClamAV anti-virus software.

[ You don’t have to lose your sleep over server errors. Our expert hosting support specialists are online 24/7/365 to help you fix all server errors. ]

Enabling auto-upgrade for WordPress installations

In servers that provide WordPress hosting exclusively, we implemented auto-upgrade for clients who subscribed to it. Since WordPress v3.7, automatic security updates are switched on by default, and wouldnt break anyone’s site.

We further extended this feature by plugins like Advanced Automatic Updates, which can upgrade plugins and themes as well. For customers who chose security over extensive customization, the full-auto-upgrade worked very well in preventing website exploits.

[ Use your time to build your business. We’ll take care of your servers. Hire our hosting support experts to maintain your servers secure and stable 24/7 . ]

In those cPanel/WHM servers which used script installers like Softaculous and Installatron, auto-upgrades were enabled using their native features.

File upload scanning through Control Panel and FTP

Compromised FTP and Control Panel accounts are another major source of malware uploads. Desktops, laptops and mobile devices get infected with trojans all the time, and web masters losing their FTP login details are a common cause of malware uploads. We put a block on this channel by deploying file upload scanners.

For those web hosts who didnt want a commercial solution, we have been able to fortify the Apache back end of control panel services with mod_security, and integrate ClamAV scanner into FTP services. This, along with loading anti-virus signatures from various free sources like LMD, SaneSecurity, etc, ensured that malware uploads no longer happened in the servers.

WordPress hosting security challenges can vary from one host to another based on the demands of their market segment. If you would like to discuss how to secure your cPanel/WHM WordPress hosting server, we would be happy to talk to you.