Website Security

Because WordPress is so popular it, therefore, attracts the attention of hackers around the world, whose aim is to break and exploit those sites.  They might do that to leave political messages, they may just do it for fun to appear on hacking league tables, or more seriously they may use your website to target your customer data or to use your site for illegal activities, such as embedding malicious content that spammers direct people to – eg phishing websites. It’s therefore important (and within our service terms and conditions) that customers keep their websites up to date with any security updates – for the main WordPress core software as well as the installed themes and plugins. We would also recommend that unused themes or plugins are removed/uninstalled if no longer required. We’ve created this page to act as a reference point to guide you through the process of checking and updating your WordPress sites to make sure they are up-to-date and remain so. First of all log into your WordPress dashboard If there is a WordPress software update due, you should see that on your main dashboard, the link will direct you through the update process: When you click on Plugins on the left, it will show which plugins require an update and you can set it to have auto-updates enabled. By clicking on Appearance on the left, you’ll see which themes can be updated. When you hover over a theme, you can access the theme details: This then allows you to enable auto-updates for the theme. You may prefer to leave auto-updates off, and process updates manually, to be able to check that the installs process without error. If that’s the case, then it’s important that you log in to your WordPress site regularly to check for site issues or vulnerabilities.

HTTPS, or Hypertext Transfer Protocol Secure, secures the connection between the client and the server, enabling safe data transfer when accessing a website. This applies to all websites, including those using WordPress. By encrypting communications, HTTPS reduces the risk of MITM attacks and protects sensitive information such as login details and card numbers, especially with a valid free SSL certificate. Since HTTPS and SSL usage have become standard, failing to secure your site with a certificate can harm trust in your site and brand. Many browsers amplify the absence of an SSL certificate by displaying security warnings, which can further discourage potential customers. Additionally, using HTTPS across your site significantly affects SEO and search engine rankings. Sites marked unsecured are less likely to be indexed or rank highly in SERPs impacting organic traffic to your domain. Why https is important on WordPress WordPress is arguably the most popular CMS platform, which makes securing your WordPress site more important than ever. Its popularity continues to grow due to the vast ecosystem that supports WordPress and simplifies its use. This guide primarily focuses on a plugin called Better Search Replace. Without plugins like this, resolving such issues would be much more difficult. Primarily this is because one of the easiest ways to secure your managed WordPress site is with installation of a free SSL certificate and then forcing HTTPS connections. This has a number of benefits including securing connections to the site and boosting SEO rankings but for WordPress it can also cause some mixed content issues surrounding existing non HTTPS content including images and other media. Troubleshooting WordPress Mixed Content 2. After logging in to your WordPress admin area head to the plugins menu found in the left sidebar. 3. Now using the search feature search for “Better Search Replace” the plugin we mentioned earlier, once you have found that as shown in the picture below click install and then activate. 4. Now that Better Search Replace is installed & activated you can start using the tool by heading to the “Tools” section found in the left sidebar. 5. Now that Better Search Replace is installed & activated you can start using the tool by heading to the “Tools” section found in the left sidebar. 6. Afterwards from inside the tool enter your domain in the “Search For” field with http:// & enter your domain with https:// in the “Replace with” field. The example below shows the exact entries using yourdomain.tld. 7. Moving on using CTRL+CLICK select all the tables in the “Select Tables” section, this will ensure that the plugin finds any instance of the HTTP address stored in the database. From here use the Dry Run feature (checked by default) and click “Run Search and Replace” to run it as a dry run or uncheck to run the command on your databases.

Importance of backing up  WordPress is a powerful website builder featuring both back & front end functionality through a CMS. Many CMS-type website builders exist, but WordPress is, without doubt, the most popular.  Creating a WordPress Backup is an important part of running a WordPress site. Regularly scheduled backups can help you prevent downtime and data loss. This is especially true if you’re operating a business through a WordPress website. It’s critical to keep downtime to a minimum otherwise, it could have serious implications on customer’s satisfaction. Because of its popularity, WordPress also comes under lots of pressure from bad actors such as hackers, spammers, scammers, etc. To protect WordPress users, the WordPress foundation releases regular updates, patching known security issues. This is why keeping either scheduled backups or manual backups of your site is important, it provides a safety net in the event your website becomes compromised. Just deploy an existing backup and bring your website back! Create a Local WordPress Backup There are 2 different ways to create a backup.  WordPress uses a theme and plugins to determine how a site looks and its functionality. The MySQL backed stores the content of the website. To manually back up a WordPress site, both the WordPress files and WordPress database must be restored. This can be done using an FTP client like Filezilla to download your files. And, the phpMyAdmin tool found within your cPanel or Plesk Control panel to export your database.  Manual WordPress Backup File Transfer Access phpMyAdmin The phpMyAdmin application is the same for both cPanel and Plesk. However, accessing it is different for each control panel, if you don’t know how to access phpMyAdmin the following should help. cPanel Plesk  Export your database phpMyAdmin

One of the most popular CMS platforms available WordPress helps to power a lot of the internets most popular websites and can handle everything from small blogs to eCommerce sites. In WordPress most content changes can be made via the wp-admin area including creating posts, pages and more, to access this area the WordPress admin username and password need to be entered. If you don’t already have a WordPress hosting account get one now! If you have forgotten your WordPress password or need to change it for another reason there are several methods you can reset or change it. In this guide learn how you can update or recover your login credentials. Reset via the WordPress Login Page 1. To start enter your WordPress website login URL into the address bar of your browser. This is usually yourdomain.uk/wp-admin but may be different depending on your configuration, it should look like below. 2. Moving on click Lost your password? as shown highlighted this will start the reset process. 3. Afterwards enter your admin email or username and click Get new password, if you see an error message at this stage you will need to try another email or username or another reset method. 4. Continuing on check the email account for mail from your WordPress site, you should receive mail similar to the one shown below. 5. Finally, using the link provided set a new password and note it down. You should now have regained access to your WordPress account. Change your password with phpMyAdmin 2. Afterwards within the file manager tool navigate to the wp-config file, right click on it and click view as shown. 3. Moving on note down the database name for your WordPress install which you will use later. 4. Now head back to your main cPanel page, navigate and click on phpMyAdmin. 5. Afterwards click on the database that matches the name you noted down earlier. 6. Once inside that database click the users table which will list all of the current configured WordPress users. 8. Now click the edit button next to WordPress admin user to begin changing that password. 9. After clicking the edit button using the dropdown menu highlighted [1] select MD5 and then enter your new password as shown in highlighted [2]. 10. Finally click go as shown to apply those changes to the database changing your admin password.