Webmasters often spend so much time securing their database, their servers and their shopping cart software that they don’t pay much attention to their blog. Most larger sites today run some kind of blog, even if it’s just to let users know of new developments. It’s important to realize that this blog can also be vulnerable to security breaches.
The Most Common Way Hackers Break Into Blogs
The most common way attackers get into blogs isn’t through the blog engine itself. For example, WordPress, one of the most popular blog engines, is actually incredibly secure.
They tend to get in through security exploits in plugins or themes. For example, a plugin that you installed a few years ago could have been hacked in the meantime. The hacker can then just scan the web for sites that use that plugin, then automatically break in.
Common Types of Back Doors
Once a hacker breaks into a blog, it’s hard to get them back out. One of the first things most hackers do is install backdoors.
They’ll install backdoors in your PHP files that grants them access to your site again should you change your passwords. They might install backdoors in your databases or in other places on your site.
How to Prevent Blog Break-Ins
Start by updating all your plugins. Whenever a plugin issues an update, make sure you install it. Do the same for your themes and of course the WordPress version.
Try to only install mainstream plugins and themes. If you find a plugin that has just a handful of users, beware. It’s not unlikely that there are security holes in the application that haven’t been discovered yet.
Most popular plugins are safe, because they’ve been tested by so many users and people have probably tries to break them already. Less popular plugins are much more likely to have untested security holes.
What to Do If Your Blog Gets Hacked
So if your blog does get hacked, what should you do?
First, identify the source of the break-in and get rid of it. If it’s a plugin or theme for example, get rid of it as quickly as you can.
Plug all the backdoors, then change all your passwords. Then carefully watch your systems to make sure the break-in doesn’t happen again.
This may be too big of an undertaking for the average online business owner, so I recommend that you contact your hosting company. Your hosting company has a vested interest in cleaning up your site so that’s the best place to start. Contact them as soon as possible and provide as much information as you can, including screen shots, alerts, etc.
Also, a great service that I use is Sucuri. You can run a free scan at Sucuri.net. You will get a report about what files are infected; however, they will not help you with removal. And unless you know where to look for the files, you are in for hours of work. So grab some coffee.
If you don’t know what you’re looking for when you look through your files, bring in an outside consultant who knows how to get rid of these kinds of hacks. They’re quite common, so there are a lot of specialists you can bring in at an affordable price.
==> If you fancy yourself as a “Do it Yourselfer” then check out my ebook, “Creating Your Small Business Web Security Plan.”