Despite the marketing hype, there’s no such thing as “bulletproof” security. If someone (or something) has the desire and means to break into a system, they’ll likely be able to succeed. And the threat scales from the smallest blogs to the largest IT installations.
WordPress isn’t immune. Fairly or not, it carries a reputation of not being the most secure of platforms. That’s not due to the core software so much as it is a reflection of the theme and plugin ecosystem. Quality and security vary.
Ensuring the security of tens of thousands of different products is akin to trying to contain the ocean. Something is bound to get past whatever barriers you put into place.
This all puts freelance web designers who build with WordPress in a tough spot. We have to make informed decisions throughout the life of a project. And, once it launches, it’s on us to keep up with best practices and the latest security news.
It’s a tough job – but we’re up to the task! Let’s talk about how WordPress security impacts freelancers and explore some ways to keep things under control.
There’s Never a Dull Moment in WordPress Security
If you maintain websites for your clients, security can never be too far from mind. That’s because a WordPress install is an enticing target for bots and other assorted bad actors. They don’t rest. Thus, neither do we.
And there are so many areas that require our attention. Securing a website is an all-encompassing endeavor. It covers everything from web hosting, file permissions, the themes and plugins utilized, along with user habits. A weak link anywhere in this chain has the potential to wreak havoc.
This puts a lot of responsibility (and stress) on freelancers. It’s not enough to design and build something that works. Constant vigilance is required to keep the status quo. Or, at least that’s the hope.
The reality is that the more websites you manage, the more likely it is that you’ll face a security issue. It could be a hacked website. But it might also be a plugin vulnerability that needs an immediate patch or, worse yet, having that same vulnerability across multiple sites.
All told, security increases the cost of doing business. We spend more time putting out fires and our clients pay more as a result.
For those of us who dreamed of being our own boss, this was never part of the plan.
Take Control by Being Proactive
While this sounds daunting, there is some good news. You can defend both yourself and your clients from harm. In doing so, you’ll be able to rest a bit easier at night.
The following are some areas where you can be proactive when it comes to WordPress security. They won’t make your websites bulletproof. But they will provide a shield against some of the most common pitfalls.
Discuss the Risks with Clients
Client behavior can play a key role in website security. Actions such as using weak passwords, eschewing two-factor authorization (2FA), or installing unnecessary plugins only increase risk.
Communicating the importance of security and best practices is a good first step. For the most part, when people know better, they do better. A little education in this area can go a long way. Plus, it can lead them to willingly invest in keeping their website safe.
Consider Security When Starting a Project
It’s never a bad idea to start on the right foot. In this case, it means thinking about security as your new projects get off the ground.
Start with a web host you trust. Ideally, they’ll be proactive in keeping their servers secured with the latest software patches. And it’s also great if you can easily reach out to their technical support and receive a prompt response.
From there, utilize plugins and themes that are well-maintained. Popularity can play a role here, but it’s also worth looking at changelogs to determine how often updates occur and what types of problems they resolve. No software is perfect. But knowing that the author is staying on top of any issues brings peace of mind.
Finally, don’t install anything that isn’t essential to the website’s core mission. Sometimes that requires some tough decisions, and perhaps a conversation with your client. But it could save you a lot of trouble down the road.
Use Tools That Keep a Watchful Eye over Your Website
Even the most caffeine-boosted among us can’t keep a 24/7 watch over client websites. Thankfully, there are tools available that can do it for us.
A content delivery network (CDN) can serve as a great first line of defense. A CDN with firewall capabilities will allow you to block suspicious traffic and even limit access to the WordPress admin to specific IP addresses. The accompying boost in site performance isn’t bad, either.
There are also a wide variety of WordPress security plugins on the market. They’ll defend against brute-force login attempts, scan for malicious code, help you manage users, and lockdown vulnerable files. Find one or more that work for you.
Create a Maintenance Routine
Maintenance is a critical part of keeping your WordPress website secure. And while you don’t necessarily have to apply updates every day, it is worth creating a weekly or bi-weekly routine. This will help to prevent something major from slipping past you.
Yes, WordPress has auto-update functionality. There’s nothing inherently wrong with taking advantage of it. But it doesn’t replace the act of logging in and having a look around to make sure everything’s in working order.
If you have a lot of websites to manage, there are several services out there to help you do so from a single dashboard. The added convenience will make the chore slightly less painful, and prompt you to keep up with new releases.
Regardless of how you apply updates, do so regularly.
WordPress Security Can’t Be Ignored
Both freelancers and website owners ignore security at their own peril. Truth be told, it has become a big part of our job description. Designers and developers aren’t just here to make cool stuff. We must also keep things as secure as possible.
Nothing is guaranteed. However, a proactive approach will help you manage the inevitable ups and downs. Even better is that it might prevent you from being reactive to news that a website has been hacked. That alone makes it worth doing.
That’s it for today’s episode, if you enjoyed please share it on your social media, leave us a review on Apple Podcasts or Podchaser. Don’t forget to share share share this episode with others and jump on the mailing list 👇
Consider Supporting The WP Minute
The WP Minute is an experiment in community journalism for WordPress. If you want to support me, my team, and all of those that contribute – head on over to buymeacoffee.com/mattreport.
Buy us a digital coffee for as little as $5 OR better yet! Join our community of WordPress newsies, get access to our Discord server, private podcast, behind the scenes on how the news is made, and get your voice heard on the podcast.
