Translated from our Japanese archive. Dates, product names and examples reflect the original article; this is not an updated product or service recommendation.
WordPress sites have been targeted by hacking and tampering around the world. This is not intended to frighten you: I have seen several incidents among people around me. Client sites, company sites and personal sites can all be targets.
What happens when a site is compromised?
An intruder may make your website inaccessible or erase its information. The damage can be serious.
What if it happens to my site?
Before considering recovery, recognise that waiting until an incident occurs is too late to prepare. Always keep backups of both the WordPress files and the database’s SQL file. If you cannot do this yourself, ask your web production company to make regular backups.
The original article recommends BackWPup for backups. Having both the files and database lets you restore the site. Backups also matter for other incidents, such as a hosting company accidentally deleting a database.
Where can an attack come from?
The entry point is not always WordPress itself. Malware on your computer may steal FTP credentials and use them to access the site. In that situation, the infection on the computer must also be removed.
What should you do?
The original article advises changing the FTP password immediately after discovering tampering. Simple passwords can be cracked quickly. It links to a password generator and recommends a long password containing uppercase letters and symbols. FTP passwords can be changed through the hosting provider’s control panel.
Preventive measures
Some plugins restrict dashboard access to specified IP addresses. The original article links to an IP address lookup and recommends Better WP Security.
Do not choose easily guessed dashboard usernames or passwords, and prepare for the possibility of an incident.
