{"id":1133,"date":"2019-06-10T11:42:44","date_gmt":"2019-06-10T09:42:44","guid":{"rendered":"http:\/\/65.108.60.219\/?p=1133"},"modified":"2019-06-18T14:32:44","modified_gmt":"2019-06-18T12:32:44","slug":"wordpress-most-hacked-cms","status":"publish","type":"post","link":"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms","title":{"rendered":"WordPress. The most hacked CMS in the world and how not to become a part of the statistic."},"content":{"rendered":"

Without a doubt, WordPress is our favorite Content Management System (CMS) in recent years. According to most recent statistics of W3Techs, WordPress accounts for roughly 60% of entire CMS market share in the first quarter of 2019. Other CMS platforms, such as Joomla and Drupal account for less than 7 per-cent together.1<\/sup><\/span><\/p>\n

Given its ergonomic interface, thousands of pre-made templates and even more funcitonality-extending plugins, it\u2019s no wonder that many SMBs choose WordPress as their default CMS of choice. Moreover, the default out-of-the-box install of WordPress is quite secure in itself.<\/span><\/p>\n

However, millions of active users also means millions of developers tinkering with the code. This is a double-edged sword: on one hand, the open-source nature of WordPress allows anyone to inspect, \u00a0build upon, or improve the code. If a security issue is found, it can be quickly patched. On the other hand, the open-source nature allows the black hats to closely examine the code for potential exploits\u2014and create mischief. Moreover, given that WordPress enjoys such outstanding market success, it cannot benefit from the model of \u201csecurity by obscurity\u201d – which perhaps works in favor of other CMS platforms out there.<\/span><\/p>\n

The numbers<\/b><\/h2>\n

Despite (perhaps because of) its market success, year after year WordPress ranks as the top security-compromised CMS. <\/span><\/p>\n

According to a 2017 study on more than 34,000 websites and subsequently published on the <\/span>Hacked Website Report 2018<\/span><\/i> by Sucuri \u2013 a subsidiary of Go Daddy Operating Company \u2013 WordPress accounted for 83% of compromised CMS platforms.2<\/sup><\/span>\u00a0What\u2019s worrisome is the the fact that this is a continuing, noticeably upward trend. In the 2019 report, for example, this number already reached 90%.3<\/sup><\/span><\/p>\n

The issues<\/b><\/h2>\n

One may be quick to jump to conclusion, that perhaps WordPress is security-deficient in itself. Nothing is farther from the truth, however. WordPress is an open-source project, inspected and improved upon version-by-version by hundreds of developers and security experts. <\/span><\/p>\n

However, there are a few security considerations to keep in mind, when rolling out a WordPress-based website. <\/span><\/p>\n

First of all, it\u2019s important to notice that in the 2018 study, nearly 40% of compromised WordPress installations were outdated. <\/strong><\/p>\n

Year after year, one of the leading causes of WordPress security compromises is a direct result of running outdated software. For some administrators, this might be a simple fact of negligence. After all, \u201cdon\u2019t fix what isn\u2019t broken\u201d philosophy certainly chimes well with many of us. However, there might be technological reasons which prevent running WordPress updates \u2013 such as plugin incompatibility \u2013 which brings us to the second point.<\/span><\/p>\n

Extensions are often the problem.<\/strong><\/p>\n

Running too many plugins on WordPress not only negatively impacts the resource use on our servers and slows our website rendering time, but also is responsible for the bulk of security breaches. Unfortunately, this is an intrinsic characteristic of plugins to begin with \u2013 after all, they are pieces of code made by developers world-wide with radically different development philosophies. As the plugins hook into our WordPress installation, they can have their way with out data. The rule of thumb is that if a plugin is compromised, WordPress is compromised.<\/span><\/p>\n

Last but not least, is lack of security-conscious installation and administration.<\/strong><\/p>\n

The model \u201cset it and forget it\u201d perhaps better suits operating a thermostat, rather than running a corporate website. Unfortunately, one of the main reasons for security compromises in WordPress is the lack of security hardening during and after install. This includes<\/span>\u00a0setting weak passwords, mis-configuring the back-end infrastructure, lack of SSL certificates on login pages and numerous other offenses.<\/span><\/p>\n

Takeaway<\/strong><\/h2>\n

Once again, the staggering numbers of compromised WordPress installations is not an indicator of inherent insecurity of the platform. Investing a little bit of time into running our WordPress-based site will definitely push our website outside of the 90% statistic. <\/span><\/p>\n

    \n
  1. Whenever possible, update your plugins and WordPress to the latest version.<\/strong><\/li>\n<\/ol>\n

    While there may be compatibility issues to be resolved, it\u2019s always best to be running the latest version of WordPress. Even though minor updates might not bring any visual changes (such as bringing Gutenberg editor), the changes in the back-end are nonetheless there and should not be ignored.<\/span><\/p>\n

      \n
    1. Minimize your reliance on extensions.<\/strong><\/li>\n<\/ol>\n

      Although the WordPress team takes plugin security very seriously by manually reviewing each plugin before accepting it to the WordPress Plugin Directory, new security holes arise each day. <\/span><\/p>\n

      Even after acceptance into the Plugin Directory, users can find and report plugin security issues, which are promptly dealt with by the WordPress Security Team.4<\/sup><\/span><\/span><\/p>\n

      With this level of attention to security, one might feel completely safe installing numerous plugins. However, no level of security consciousness can account for thousands of plugins and a plethora of configuration or mis-configuration options out there. As such, it\u2019s best to keep your website running as low on plugins as possible. First of all, your SEO ranking will definitely improve, as search engines prefer quick, responsive websites. Second of all, you minimize the risk of running into plugin incompatibility issues, which would prevent you from upgrading your WordPress instance.<\/span><\/p>\n

        \n
      1. When installing in production environment, consider your security options.<\/strong><\/li>\n<\/ol>\n

        From using strong passwords to moving your \/wp-admin URL to a different location, options are endless. If you are unsure about WordPress security hardening, there are numerous well-written tutorials online, starting with <\/span>Hardening WordPress<\/span><\/i> on WordPress.org. There are, of course, security-hardening plugins as well, which help you proactively block scripts and attacks. As mentioned above, it\u2019s best to use caution.\u00a0Last, but not least, consider looking into outside protection from DoS and other attacks by using\u00a0blacklisting and reverse-proxy services, which examine the incoming traffic before passing it onto your servers.<\/span><\/p>\n

         <\/p>\n

        If you got some questions or you’re unsure of how to implement the steps mentioned above? Contact us!<\/h3>\n

         <\/p>\n

          \n
        1. https:\/\/w3techs.com\/technologies\/history_overview\/content_management<\/a><\/li>\n
        2. https:\/\/sucuri.net\/reports\/Sucuri-Hacked-Report-2017.pdf<\/a><\/li>\n
        3. https:\/\/blog.sucuri.net\/2019\/03\/hacked-website-trend-report-2018.html<\/a><\/li>\n
        4. https:\/\/developer.wordpress.org\/plugins\/wordpress-org\/plugin-security\/<\/a><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

          Without a doubt, WordPress is our favorite Content Management System (CMS) in recent years. According to most recent statistics of W3Techs, WordPress accounts for roughly 60% of entire CMS market share in the first quarter of 2019. Other CMS platforms, such as Joomla and Drupal account for less than 7 per-cent together.1 Given its ergonomic […]<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"categories":[29,37],"tags":[],"class_list":["post-1133","post","type-post","status-publish","format-standard","hentry","category-security","category-guide"],"yoast_head":"\nWordPress. The most hacked CMS in the world - CyberForces<\/title>\n<meta name=\"description\" content=\"WordPress is the most popular CMS but using it can also cause some problems. How to prevent from falling a victim of an attack? Click to find out!\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WordPress - the most hacked CMS in the world\" \/>\n<meta property=\"og:description\" content=\"Read our guide and learn how to harden your WordPress-based website.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms\" \/>\n<meta property=\"og:site_name\" content=\"CyberForces\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/TestArmyCyberForces\/\" \/>\n<meta property=\"article:published_time\" content=\"2019-06-10T09:42:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-06-18T12:32:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cyberforces.com\/wp-content\/uploads\/2019\/06\/WordPRess-FB.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Pawe\u0142 Wa\u0142uszko\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pawe\u0142 Wa\u0142uszko\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms#article\",\"isPartOf\":{\"@id\":\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms\"},\"author\":{\"name\":\"Pawe\u0142 Wa\u0142uszko\",\"@id\":\"https:\/\/cyberforces.com\/#\/schema\/person\/12153b64ec1142a80a25bcc96b281a8e\"},\"headline\":\"WordPress. The most hacked CMS in the world and how not to become a part of the statistic.\",\"datePublished\":\"2019-06-10T09:42:44+00:00\",\"dateModified\":\"2019-06-18T12:32:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms\"},\"wordCount\":996,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/cyberforces.com\/#organization\"},\"articleSection\":[\"Security\",\"Guide\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms\",\"url\":\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms\",\"name\":\"WordPress. The most hacked CMS in the world - CyberForces\",\"isPartOf\":{\"@id\":\"https:\/\/cyberforces.com\/#website\"},\"datePublished\":\"2019-06-10T09:42:44+00:00\",\"dateModified\":\"2019-06-18T12:32:44+00:00\",\"description\":\"WordPress is the most popular CMS but using it can also cause some problems. How to prevent from falling a victim of an attack? Click to find out!\",\"breadcrumb\":{\"@id\":\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Strona g\u0142\u00f3wna\",\"item\":\"https:\/\/cyberforces.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WordPress. The most hacked CMS in the world and how not to become a part of the statistic.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cyberforces.com\/#website\",\"url\":\"https:\/\/cyberforces.com\/\",\"name\":\"CyberForces\",\"description\":\"Testy bezpiecze\u0144stwa z TestArmy CyberForces. Testy penetracyjne, hackowanie aplikacji webowych i mobilnych, testy socjotechniczne. Dowiedz si\u0119 wi\u0119cej!\",\"publisher\":{\"@id\":\"https:\/\/cyberforces.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cyberforces.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/cyberforces.com\/#organization\",\"name\":\"TestArmy Group S. A.\",\"url\":\"https:\/\/cyberforces.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cyberforces.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cyberforces.com\/wp-content\/uploads\/CyberForces-logo.png\",\"contentUrl\":\"https:\/\/cyberforces.com\/wp-content\/uploads\/CyberForces-logo.png\",\"width\":1210,\"height\":173,\"caption\":\"TestArmy Group S. A.\"},\"image\":{\"@id\":\"https:\/\/cyberforces.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/TestArmyCyberForces\/\",\"https:\/\/www.linkedin.com\/company\/cyberforcescom\/\",\"https:\/\/www.instagram.com\/cyberforces__\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/cyberforces.com\/#\/schema\/person\/12153b64ec1142a80a25bcc96b281a8e\",\"name\":\"Pawe\u0142 Wa\u0142uszko\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cyberforces.com\/wp-content\/uploads\/2019\/06\/Pawel_Waluszko-7-2-100x100.png?wsr\",\"url\":\"https:\/\/cyberforces.com\/wp-content\/uploads\/2019\/06\/Pawel_Waluszko-7-2-100x100.png?wsr\",\"contentUrl\":\"https:\/\/cyberforces.com\/wp-content\/uploads\/2019\/06\/Pawel_Waluszko-7-2-100x100.png?wsr\",\"caption\":\"Pawe\u0142 Wa\u0142uszko\"},\"description\":\"Business Development Manager i Ekspert ds. Bezpiecze\u0144stwa. Do\u015bwiadczony mened\u017cer w bran\u017cy IT, kt\u00f3ry swoje do\u015bwiadczenie zdobywa\u0142 m.in. w Dolinie Krzemowej; entuzjasta oprogramowania open - source.\",\"url\":\"https:\/\/cyberforces.com\/en\/author\/pwaluszko\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WordPress. The most hacked CMS in the world - CyberForces","description":"WordPress is the most popular CMS but using it can also cause some problems. How to prevent from falling a victim of an attack? Click to find out!","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms","og_locale":"en_US","og_type":"article","og_title":"WordPress - the most hacked CMS in the world","og_description":"Read our guide and learn how to harden your WordPress-based website.","og_url":"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms","og_site_name":"CyberForces","article_publisher":"https:\/\/www.facebook.com\/TestArmyCyberForces\/","article_published_time":"2019-06-10T09:42:44+00:00","article_modified_time":"2019-06-18T12:32:44+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/cyberforces.com\/wp-content\/uploads\/2019\/06\/WordPRess-FB.jpg","type":"image\/jpeg"}],"author":"Pawe\u0142 Wa\u0142uszko","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Pawe\u0142 Wa\u0142uszko","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms#article","isPartOf":{"@id":"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms"},"author":{"name":"Pawe\u0142 Wa\u0142uszko","@id":"https:\/\/cyberforces.com\/#\/schema\/person\/12153b64ec1142a80a25bcc96b281a8e"},"headline":"WordPress. The most hacked CMS in the world and how not to become a part of the statistic.","datePublished":"2019-06-10T09:42:44+00:00","dateModified":"2019-06-18T12:32:44+00:00","mainEntityOfPage":{"@id":"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms"},"wordCount":996,"commentCount":0,"publisher":{"@id":"https:\/\/cyberforces.com\/#organization"},"articleSection":["Security","Guide"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms#respond"]}]},{"@type":"WebPage","@id":"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms","url":"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms","name":"WordPress. The most hacked CMS in the world - CyberForces","isPartOf":{"@id":"https:\/\/cyberforces.com\/#website"},"datePublished":"2019-06-10T09:42:44+00:00","dateModified":"2019-06-18T12:32:44+00:00","description":"WordPress is the most popular CMS but using it can also cause some problems. How to prevent from falling a victim of an attack? Click to find out!","breadcrumb":{"@id":"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cyberforces.com\/en\/wordpress-most-hacked-cms#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Strona g\u0142\u00f3wna","item":"https:\/\/cyberforces.com\/"},{"@type":"ListItem","position":2,"name":"WordPress. The most hacked CMS in the world and how not to become a part of the statistic."}]},{"@type":"WebSite","@id":"https:\/\/cyberforces.com\/#website","url":"https:\/\/cyberforces.com\/","name":"CyberForces","description":"Testy bezpiecze\u0144stwa z TestArmy CyberForces. Testy penetracyjne, hackowanie aplikacji webowych i mobilnych, testy socjotechniczne. Dowiedz si\u0119 wi\u0119cej!","publisher":{"@id":"https:\/\/cyberforces.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cyberforces.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cyberforces.com\/#organization","name":"TestArmy Group S. A.","url":"https:\/\/cyberforces.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cyberforces.com\/#\/schema\/logo\/image\/","url":"https:\/\/cyberforces.com\/wp-content\/uploads\/CyberForces-logo.png","contentUrl":"https:\/\/cyberforces.com\/wp-content\/uploads\/CyberForces-logo.png","width":1210,"height":173,"caption":"TestArmy Group S. A."},"image":{"@id":"https:\/\/cyberforces.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/TestArmyCyberForces\/","https:\/\/www.linkedin.com\/company\/cyberforcescom\/","https:\/\/www.instagram.com\/cyberforces__"]},{"@type":"Person","@id":"https:\/\/cyberforces.com\/#\/schema\/person\/12153b64ec1142a80a25bcc96b281a8e","name":"Pawe\u0142 Wa\u0142uszko","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cyberforces.com\/wp-content\/uploads\/2019\/06\/Pawel_Waluszko-7-2-100x100.png?wsr","url":"https:\/\/cyberforces.com\/wp-content\/uploads\/2019\/06\/Pawel_Waluszko-7-2-100x100.png?wsr","contentUrl":"https:\/\/cyberforces.com\/wp-content\/uploads\/2019\/06\/Pawel_Waluszko-7-2-100x100.png?wsr","caption":"Pawe\u0142 Wa\u0142uszko"},"description":"Business Development Manager i Ekspert ds. Bezpiecze\u0144stwa. Do\u015bwiadczony mened\u017cer w bran\u017cy IT, kt\u00f3ry swoje do\u015bwiadczenie zdobywa\u0142 m.in. w Dolinie Krzemowej; entuzjasta oprogramowania open - source.","url":"https:\/\/cyberforces.com\/en\/author\/pwaluszko"}]}},"_links":{"self":[{"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/posts\/1133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/comments?post=1133"}],"version-history":[{"count":15,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/posts\/1133\/revisions"}],"predecessor-version":[{"id":1174,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/posts\/1133\/revisions\/1174"}],"wp:attachment":[{"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/media?parent=1133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/categories?post=1133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberforces.com\/en\/wp-json\/wp\/v2\/tags?post=1133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}