10 WordPress security mistakes you're probably making

[@KathyZant]

New! Take the WordPress Security Mini-Course. Introductory price at $39 until 4/30/24. Learn more here: bizsecured.com/wordpress-security-mini-course/

[@MustafaSheikh]

The most important video to watch on wp security. These are basic and essential measures (that one would think is common sense) can actually protect your site

[@KathyZant]

I appreciate your support! Security is always evolving with new threats and attacks, but there are some common things everyone can do to protect themselves.

[@DustinHyle]

Nice list Kathy 👍

[@KathyZant]

Thanks so much, Dustin!

[@visualmodo]

Truly good video =DD

[@KathyZant]

Thanks for watching!

[@derekshort]

Good video 👍🏻

[@KathyZant]

Thanks 👍

[@drmikeyg]

Cathy, Can your computer get hacked by clicking on a link in the comments section of a Wordpress site?

[@KathyZant]

I would recommend judicious clicking on any links, whether in comment sections or elsewhere. Please review the domain name of the site you're going to, and pay attention to what is being teased as a part of the link. Is it using a link shortener that hides the link destination? Even if it's going to a real site, that site could be undergoing a security event. So, even if it is a site you trust, a recent hack could mean it's serving up malware. Ad networks also have had a history of malicious ads in their networks that could cause problems on sites. Here's a recent article about Facebook ads pushing malware: www.bleepingcomputer.com/news/security/facebook-ads-push-new-ov3r-stealer-password-stealing-malware/ Antivirus programs will alert you to malicious activity, so please make sure your virus definitions are updated for additional protection. Thanks for your question!

[@kolovrat_scarves]

Great video - thanks a lot! Kathy, I am still puzzled: if I move my DNS to Cloudflare using all the great features in there (including Firewall) - do I still need a Security plugin for my website I keep with a hosting provider? Lots of thanks in advance for your kind reply.🙏🙏🙏

[@KathyZant]

There are certain functionalities you should be using in a security plugin such as 2-factor authentication. So I'd still use a security plugin for that. If your host isn't providing file integrity monitoring and vulnerability alerts, I'd also make sure you are using a plugin that does that for you, too. Solid Security does do both.

[@kolovrat_scarves]

@@KathyZant HUGE thanks, Kathy!!!!🙏🙏🙏 You are just the God-sent saviour on to my way of an ongoing battle for my website, which I am pulling out of the ruins. All the best wishes your way!❤‍🩹💛💙

[@KathyZant]

@@kolovrat_scarves You're welcome, and good luck with the website revival! Let me know if you have more questions.

[@KathyZant]

@@kolovrat_scarves send me an email at kathy -at- zant -dot- com and I can send you a security checklist to help you start off on the right foot!

[@klitos15]

Something not mentioned about the login forms is how much does it help to utilise recaptcha or even better hcaptcha on login?

[@KathyZant]

CAPTCHA isn't a failsafe and tuning it can be a pain. It might lessen attacks from bots, but it won't stop it altogether. They also can negatively impact the user experience (username, password, and CAPTCHA). If it's just your blog? Sure. Cloudflare's Turnstile is another alternative to CAPTCHA. For a site that requires users to login (commerce, LMS, etc.), that friction can be problematic. You want to make it super easy for users to register, login, and use the site. Best is something in front of the web server (Cloud WAF) that limits known malicious IP addresses from reaching the site.

[@klitos15]

@@KathyZant Thanks