5 Common Mistakes That Cause WordPress Infections

Want to learn more on how to deal with WordPress infections?

We complete about 50 to 100 WordPress Infection Cleanups each week and get asked all the time by our customers, “What caused this infection?”. Now it is not always easy to tell exactly where an infection comes from or how it got into the site but below are the 5 very common things that can surely allow some nasty stuff into your site.

These are also things you can check right away to make sure your site is safer. WordPress Infections are not a nice thing so prevention and education is key to safeguard your site.

1. Multiple Installations of WordPress
So often when a WordPress site is built, you may develop the site on a sub domain or in another folder other that the live location your production site runs. Then once the site is complete you clone it to the live location and never remove the installation you used to build it. Another scenario is setting up a test site where you use it to make changes before you make those changes on your live site.

The problem here is that these installations can be forgotten about and never updated leaving them vulnerable to WordPress infections and hackers. If these other installations get infected, there is a high chance that your live production site can become infected as well.

2. Pending WordPress Updates
That little circled number in your WordPress dashboard means something and should be taken very seriously. WordPress is awesome because they are constantly making improvements to it and changing it as the web changes. A massive part of most updates are security releases.

If these updates are not performed in a timely manor, you are leaving holes in your site for those nasty things out there that hackers love to do to your beautiful site. Don’t be afraid to update and if you are just run a complete back before you do. Check out this post about on our favorite WordPress Backup Plugin.

3. Mismanaged Users
When was the last time you took a look at the list of users on your site and verified that they are meant to be there and that they have the appropriate access level? Some WordPress Infections that we have seen allow users to be created or promoted on your site and once they are able to get in, they can really reek havoc.

Another area with sensitive user information that you may not even know existed is your list of FTP users inside of your hosting account. FTP is the server access to all the files your site runs on and these users should only ever be ones you know and trust 100%. It is so important you audit all users as they relate to your WordPress site and verify they are meant to be users for your site.

4. Weak Login Credentials
We just talked about users and this is the next very important mistake many WordPress users make. Strong login credentials make it much harder for hackers and hacking software to gain access to your site and inject WordPress Infections. Never use “admin” as a username or “password” as the password.

You would think most people would already make sure their login details are strong, but studies have shown that over 80% of WordPress users are actively using very weak login credentials. Here is an article we wrote on how to select strong passwords.

5. Outdated Server PHP
WordPress has specific server requirements to run as it should and keep things safe. One of those requirements for the current version 4.4.2 is a server running PHP version 5.6 or higher. Now with that said, WordPress will still run on lower versions of PHP but doing that will cause security issues that weaken your site and make it more prone to infection attacks.

Running a WordPress site on an outdated PHP version will also cause plugin and theme issues and may even limit functionality of your site. See all server requirements for most current version of WordPress.

So now please take steps to go through each one of these 5 common mistakes that cause WordPress Infections and you will be more protected that the majority of WordPress sites. If you do ever get infected or are infected now, we can help you clean it out with our WordPress Infection Malware or Virus Removal service.

Let us know below if you have any questions at all about any of this.