Is your website safe?
Two websites for our most significant clients got hacked this past two weeks. Even though we had put in place what we thought at the moment to be proper security measures. We had a two-step authentication to be able to log in to both of them. We also had SiteLock service to scan the website for malware. Keeping the theme, plugins and WordPress version up to date. But all this proved to be insufficient as far as keeping the site safe from hacking.
The hack
More than likely, the attack was an SQL injection attack in which they used web forms to inject malicious code into the database. Subsequently, the sites got compromised with a bunch of pharmaceuticals links pointing to “cheap” version of Cialis, Viagra, and other popular drugs. The main problem with this type of incursion is that Google indexes the site and all these spam links start to pop up in your search results. In effect, killing the reputation of the website and even risking the website being blacklisted. What I found peculiar was the fact that both attacks seemed related in their objectives.
Solution
The remedy was expensive for one of the sites. But in the case of this particular client, the cost was trivial since the reputation of their company is much more important than the price for cleaning and securing their website.
In the case of my other clients, I know cost can be an issue. That is why we researched and found a competing alternative solution that is much more affordable.
The solution to this problem is a double layer security strategy. First, all files are scanned daily at 6 or 12-hour intervals. These scans look for suspicious code or compromising files. The second part consists of a firewall protecting the site from a malicious attack.
How websites get hacked today is commonly misunderstood. We have this erroneous perception that a person visiting our site is looking for a vulnerability to exploit. Nothing is further from the truth. How it happens, in reality, is that hackers use specially crafted software that jumps from link to link, a website to website, searching for any vulnerability. When one is found, it exploits it and installs the malicious code. What this means is that no matter how often your website gets visited. It doesn’t matter if it is a potentially profitable target. All sites are vulnerable, and the scary part is that it’s only a matter of time before a site gets compromised.
At Grapho Studio we take security very seriously. This experience has been an eye-opening one that has plunged us into understanding website security at a much deeper level.
Contact us if you have any questions.
Local SEO