Secure WordPress websites for businesses

A WordPress website for a business or organization is, in principle, a safe choice. However, information security must be maintained at all times.

First and foremost, the website must be developed with security in mind, and its maintenance must also be ensured after launch. Outdated websites that have not been properly updated or maintained inevitably pose security risks. Security vulnerabilities, in turn, enable hackers to, for example, sabotage websites, hijacking the user database, installing credit card skimmers, spreading spam, using disk space to store criminal material, or even mining cryptocurrency.

Ensuring the security of websites is therefore of the utmost importance, as related breaches are constantly on the rise. Furthermore, the methods used to identify security vulnerabilities are becoming increasingly sophisticated. None of us has surely been able to avoid, for example, various phishing messages designed to trick the unsuspecting – or at least the news reports concerning security breaches. Nowadays, some of these scams are extremely difficult to spot as fraud – the messages are written in good Finnish, and websites designed to steal banking details, for example, are almost perfect copies of the originals.

How do we ensure data security when building WordPress websites?

We always build WordPress websites using the latest version of the content management system and code them in line with modern best practices. Furthermore, we only use plugins and themes that have been proven to be safe and reliable. When setting up a WordPress site, we always choose strong database credentials and, as an additional security measure, change the default prefix for the database tables. The default prefix is ‘wp_’, and, combined with the standard names of database tables, hackers attempt to gain access to the database by exploiting these familiar table names. We also prevent file editing in the WordPress website admin panel via the WP-config file.

Particularly for larger projects, we use local development environments as well as our own internal version control system (GitLab), which ensures that the change history of all files is stored from the start of the project and that changes can be traced back if necessary. In-house version control also means that no one else has direct access to the website’s source code, and changes can always be deployed without causing any downtime to the site. In addition to local development environments, these projects also utilize staging environments, through which clients can, for example, test new features themselves before they are published on the live site.

If you wish, we can also install plugins for your WordPress website – such as security and two-factor authentication plugins – if you want to take your security to the next level.

Of course, our developers also do their bit to ensure information security, for example by using strong passwords on their own computers and making sure that laptops are not left lying around in communal areas where thieves could get hold of them. In addition, Hurja’s office is, of course, equipped with locks and access control to ensure that unauthorized persons cannot enter the premises, and we know who is on site at any given time. Hurja also has separate wireless networks for staff and visitors, which ensure that no unauthorized devices are ever connected to the same network as the office computers.

The servers used by Hurja are secure

• The servers are located in Finland
• Automatic daily backup
  • backups are also backed up
• Automatic malware scan once a month
• Firewall
• Free, automatically installed SSL certificate
  • An SSL certificate is not included as standard in all providers’ hosting services; it is often available at an additional cost
• WAF (Web Application Firewall), i.e. filtering/blocking common vulnerabilities
  • Prevents, among other things, multiple login attempts and the most common OWASP vulnerabilities
• Regular operating system updates

Check out the websites and online stores we’ve created!

We audit WordPress websites with professional expertise

What if you’re not sure whether the security of your current WordPress website is up to date? Don’t worry, we’ve got a solution for that too! During a WordPress site audit, we’ll identify any technical issues with your site and suggest how to resolve them. When your site’s technical solutions and functionalities are implemented in line with best practice, your site will serve your customers better and also facilitate its future development. Our audit is divided into three parts, one of which is information security.

We will check the following areas of your WordPress site with regard to data security:

• Does the website adhere to current and recommended practices?
• Does the website contain any features that pose a security risk or any outdated plugins?
• Does the website store personal data, and how is the storage and processing of such data managed?

A WordPress website audit also covers other areas, and if you wish, we can extend the testing to cover the site’s accessibility through an accessibility audit or its search engine friendliness through an SEO audit. Read more about WordPress site audits!

Websites without maintenance pose a security risk

As we mentioned earlier, although WordPress websites are a secure platform, their security must still be looked after and security checks should be carried out at regular intervals. WordPress is constantly evolving, and it is important for the functionality, performance and security of the site that the technology is kept up to date. If a site is running a very old version of WordPress, it may be the case that plugins cannot be updated due to compatibility issues, or that updating them breaks the site. Failing to carry out updates can then lead to unpatched vulnerabilities on the site being exploited for malicious purposes.

At Hurja, we can automatically take care of maintaining your website’s security if you wish. Here at Hurja, we call this service the WordPress Maintenance Service. WordPress sites included in the maintenance service are regularly scanned using a security scanner, and we carry out a backup of your website once a day.

So, if you want peace of mind, it’s best to leave security matters to the professionals. This way, your WordPress website will remain technically up to date, fully functional and secure. Here at Hurja, we have several WordPress experts who will professionally manage the maintenance of your websites and homepages for you!