Slide 1
Slide 1 text
Are You Safe
From Hackers
Michele Butcher
CantSpeakGeek.com WPSecurityLock.com
@Michele_Butcher
Slides can be found at http://mlb.pw/LadyBlogger
Slide 2
Slide 2 text
Michele Butcher
WordPress Specialist, Site Cleaner,
and Trainer for
WP Security Lock
One Woman Wonder at
Can’t Speak Geek
WordPress Website Designer
@michele_butcher
Slide 3
Slide 3 text
Why is security
important?
@michele_butcher
Slide 4
Slide 4 text
Every day hackers try to find
ways to get your information.
@michele_butcher
Slide 5
Slide 5 text
Why do hackers hack?
Make bank
Build a zombie site army
Share their nasty malware with the world
Get your information
They are bored
They want to see if they can do it
@michele_butcher
Slide 6
Slide 6 text
How do they get in?
Guess your login. If you know it so can someone
else. (Brute force attack or man in the middle)
Denial of Service attack (DDoS) flood your site with
more traffic than it can handle
Through a theme, file or plugin
Through your FTP or CPanel. (Files set to read,
write,execute. Brute force, anonymous login,
shared hosting infection)
@michele_butcher
Slide 7
Slide 7 text
And now for the only thing
scary that I am going to say.
@michele_butcher
Slide 8
Slide 8 text
You are NEVER
100% secure
@michele_butcher
Slide 9
Slide 9 text
Even a test site or a knitting site
with only 2 visitors can be hacked.
It can happen to your site.
@michele_butcher
It has happened to me, it can happen to you.
Slide 10
Slide 10 text
Don’t let
security make
you like this guy.
@michele_butcher
Slide 11
Slide 11 text
Never fear…
there are ways to keep the
hacker attackers out!
@michele_butcher
I promise it is not all that painful!
Slide 12
Slide 12 text
Simple Online Safety
Tips
Slide 13
Slide 13 text
Be Mindful of what information
you put on your website.
If you will not put the the information on a flier or
in a commercial, do not put it on your website.
Slide 14
Slide 14 text
Do NOT put your email
on your website
Use a contact form. Let your users
engage with you without them
finding out your important
information.
Slide 15
Slide 15 text
If you fear you might lose information, save it in
more than one spot. Bitcasa, Carbonite, and
external hard drives are great options of
backing up data.
@michele_butcher
Back Up Your Information
Slide 16
Slide 16 text
ALWAYS use complex
passwords. ALWAYS!
For everything!
“password” is never a
good password!
@michele_butcher
Slide 17
Slide 17 text
Use a different password for
each and every thing you log
into.
Slide 18
Slide 18 text
Use something like
LastPass or One
Password to save your
passwords and to share
passwords with others.
Slide 19
Slide 19 text
Never email passwords to
anyone. Including yourself.
@michele_butcher
Use your password manager to share login information
Slide 20
Slide 20 text
Anti-virus
Protect your unit!
Yes I even have an anti-virus on my Mac!
AVG and Avast have free versions as well as paid.
Kaspersky is great with Windows and Macs.
@michele_butcher
Slide 21
Slide 21 text
Update!
Update!
Update!
Update your Antivirus, Operating
Systems, and all the things
Slide 22
Slide 22 text
Be conscious when
using public WiFi.
@michele_butcher
Slide 23
Slide 23 text
Use a VPN when
connecting out in
the wild.
torguard.com
stacksocial.com
@michele_butche
Slide 24
Slide 24 text
If the login has a
Two-Factor authentication,
use it!
@michele_butcher
Slide 25
Slide 25 text
WordPress Security
Basics
@michele_butcher
Slide 26
Slide 26 text
Never ever ever use admin as user
name or password as password.
Never!
@michele_butcher
Got it?
Slide 27
Slide 27 text
What to do when you have
temporary people in your
dashboard
Set up a file change detection notification to know
what they are changing in your site.
@michele_butcher
Slide 28
Slide 28 text
Always use Sftp
Regular FTP is not secure. Do not use it unless
the server is only set up for FTP.
Slide 29
Slide 29 text
Only give them access to what they
NEED not what they want.
Just because they want to be an admin does not
automatically make them one.
Guest bloggers should not be anymore than a contributor.
Slide 30
Slide 30 text
If it is only a temporary login, delete their login
when they have completed their job.
If they have posts on your site, you can knock them
down to subscribers so they can not change anything
on your site.
If they are only doing work, delete them when
their job is done.
Slide 31
Slide 31 text
iThemes Security Pro
Great all encompassing best practices WordPress security plugin.
Two versions a free and a premium.
http://ithemes.com/security
@michele_butcher
Brute Protect
If you are mainly worried about DDoS attacks, Brute
Protect has you covered.
http://bruteprotect.com
Slide 32
Slide 32 text
Set up a file change detection notification to
know what they are changing in your site.
iThemes Security and other security
plugins give you the option to see what
all users are doing when logged into the
dashboard.
Slide 33
Slide 33 text
Who can scan my site
for malware?
Google Webmaster Tools http://google.com/
webmaster
VirusTotal https://virustotal.com
iThemes Security Pro htttp://ithemes.com/
security
@michele_butcher
Slide 34
Slide 34 text
Need an extra eye on
your site?
CloudFlare has a free and premium version.
http://cloudflare.com
@michele_butcher
Slide 35
Slide 35 text
Things you can do to
protect your website
Slide 36
Slide 36 text
Update!
Update!
Update!
Update core, update plugins, update themes,
update content, update everything and update
often!
The biggest source of nearly all hacks as once
something is patched, it is trivial to get into the
old stuff.
@michele_butcher
Slide 37
Slide 37 text
If you use themes or plugins at any of
the envato (Themeforest, code canyon)
always check the box to be notified of
updates. they will not tell you otherwise
This is why the RevSlider SoakSoak infection was so
widespread. Many didn't know the plugin was built
within the theme.
Slide 38
Slide 38 text
Have a minimalist approach
to plugins and themes.
Only have the plugins you are using at that time
on your site. You can always upload them again
later.
Only have your theme you are using on your
site.
If something is not active, delete it.
@michele_butcher
Slide 39
Slide 39 text
Back up your site!
Somewhere, anywhere, just have a backup copy.
BackupBuddy from iThemes is a great choice.
iThemes Security will do a database backup for you.
http://ithemes.com/backupbuddy
@michele_butcher
Slide 40
Slide 40 text
Always back up to someplace
OTHER than your server. If the
server gets hacked, so does your
backup.
Even backing a copy to Dropbox or
your computer is a better option.
@michele_butcher
Slide 41
Slide 41 text
Don’t let your site get
lonely.
Lonely sites can turn into zombie sites and
nobody wants a zombie
@michele_butcher
Slide 42
Slide 42 text
If your website get hacked it is not the
end of the world.
It can and will be fixed.
@michele_butcher
Slide 43
Slide 43 text
Who cleans hacked
websites?
Well I do over at WP Security Lock ~Smile~
http://wpsecuritylock.com
I apologize… had to do one shameful plug.
@michele_butcher
Slide 44
Slide 44 text
Wanting more information
about website security?
Join the community at SafeWP
https://SafeWP.com
Slide 45
Slide 45 text
Questions?
@michele_butcher
Slide 46
Slide 46 text
Thank you for
attending!
Slides can be found at https://mlb.pw/LadyBlogger
Michele Butcher
@michele_butcher
http://wpsecuritylock.com
http://cantspeakgeek.com