Top 7 CMS Security Tips.

Most CMS platforms tell you how easy it is to use them, but very few will mention how easy it is to hack them. Since content management systems like WordPress, Joomla and Drupal are used by so many websites, hackers now actively target them.

Fortunately, we’ve been web developers for over ten years, and today, we’re sharing our top 10 CMS security tips.

#1 - Protect Your Website Against Hacker Attacks with Regular Updates

Since most content management platforms are open source, there isn’t a single authority to ensure you’re protected. You must protect yourself, and the best way to stay safe is to update your CMS regularly.

(Yes, if you’ve been putting off that WordPress update for a while, now’s the time to install it.)

Since hackers constantly develop new exploits, regular CMS updates patch these “holes” and increase your website security

If you use WordPress, you should also regularly update your:

• Themes
• Plugins

Hackers have been known to use plugin vulnerabilities. In fact, just nine WP plugins exposed millions of websites to potential attacks this February. Similarly, hackers can find a way into your website via your theme. If you downloaded a WordPress theme, make sure the developers patch it regularly.

#2 - Use as Few Plugins as Possible to Protect Your CMS

You can’t get more functionality on WordPress without plugins, but the more you add, the more exposed you are to hacker attacks. It’s a zero-sum game.

Avoid adding unnecessary plugins. Before installing a plugin, ensure it’s kept up to date by the developers. If you see a plugin that hasn’t been updated in years, head in the other direction.

Depending on the level of custom functionality you need, it might be better to explore alternative solutions like headless CMS, allowing your developers to easily add more features.

#3 Don’t Negotiate with Hackers - Back up Your Data

Ransomware cases are on the rise. Hackers can use a security vulnerability to encrypt your website data. Then, they ask you to pay for ransom if you want your site back. If you backed up your data, you can restore your website to a safer version and mitigate the damage.

We typically recommend making weekly CMS and database backups. This way, you can restore your progress even in the event of a hack. You or your IT team can automate backups and store them in a safe location.

Backups are helpful in cases where updates go sideways, too. It’s always wise to have a copy of your freshest information on hand.

#4 Enable Two-Factor Authentication on Your WordPress, Joomla or Drupal Accounts

You’re likely as tired of hearing about strong passwords (and not writing them down on post-it notes) as we are. By all means, strengthen your passwords, but enable 2FA (two-factor authentication) too.

Some content management platforms offer 2FA natively. If not, you can download and regularly update a plugin.

With 2FA, every log-in will be authorised via the user’s phone number or an authenticator app. While it’s a bit of a hassle, it’s much better than the alternative: exposing your website to security risks.

A Word on Passwords for the Highest CMS Security

• Don’t share log-in credentials. Many hacks happen because hackers mimic your colleague’s email address and ask you to share the log-in information via email. If you do have to share, use a password manager.
• Make your passwords complex (and impossible to guess). Use a random string of letters, symbols, and numbers.
• Remove default usernames like “admin@” or “team@.”
  

#5 Configure Your CMS Firewall to Prevent DDoS and Malware Attacks

Every connection between your website and the server can be exploited in an attack. If your website is wide open to anyone, regardless of their IP address legitimacy, you’re increasing your chances of being hacked.

Instead, configure your CMS firewall or use a DDoS mitigation service like Cloudflare. Your firewall (or tool) will scan incoming IP addresses and prevent illegitimate traffic from poking around your website.

Your regular visitors will still be able to come through. You can safelist your team members' IP addresses if there are any glitches.

#6 Protect Your CMS Against SQL Injections

Website forms are another hacker's favourite. Often, they’ll try to infect your database by injecting SQL via the sign-up, contact, log-in or other forms. If they succeed, they can retrieve and change the data in your database.

The best ways to protect your CMS against SQL injections include:

• Scanning for vulnerabilities with a tool like WPScan
• Changing the database prefix (they typically start with ‘wp_’)
• Removing unnecessary DB functionality
• Using specific query parameters in your DB

Of course, keep your CMS, plugins, and themes updated. Backups will go a long way, too. If hackers circumvent your firewall and hold your website for ransom, you’ll be able to restore it.

#7 Maintain CMS Security Hygiene

Prevention is better than cure. Don’t cut costs with cheap hosting, unreliable backups, or the hassle of 2FA. If you have a dedicated IT team, make sure they perform regular maintenance and give them what they need to keep your website safe.

Educate the rest of your team (especially team members who use your CMS) on the proper security measures.

Finally, know your risk. If you run a marketing website with multiple plugins, 3rd party APIs, and integrations, you’re more exposed than someone with a simple WordPress blog.

Bonus Tip: Consider Moving Off of a Traditional CMS

In some cases (like the marketing website we mentioned above), a traditional monolithic CMS just isn’t suitable. Explore headless CMS solutions if you’re increasingly concerned about your website security (and performance).

Since headless CMS decouples your server and database from the website displayed to your visitors, your core won’t be constantly exposed.

In our experience, clients who switched from a monolithic CMS to a headless solution experienced faster loading times, improved performance, and heightened security. But don’t take our word for it: explore the case studies.

Decide if your website can do with a CMS security band-aid or needs surgery!

-

Are you ready to launch a website that lasts? Mawla builds next-generation JAMstack websites with optimised performance, workflow automation, and beautiful delivery to increase your revenue. Get in touch with us.