WordPress remains THE most popular platform for blogging and content management, with a a full 30% of websites on the internet using it.
As a result of this popularity, hacking attempts and other instances of cybercrime, especially ransomware attacks, are on the rise.
Starting in 2017, analysts began to see an increase of the EV Ransomware virus infecting WordPress installations and putting real user data in jeopardy. As the number of these instances increases, so does the financial ransom that the cybercriminals attempt to extort.
This article will provide an overview of how ransomware viruses can affect WordPress installations and a guide for defending your own website against such an attack.
Basics of Ransomware Attacks
[image 1]
Before a hacker can execute a ransomware attack on a company or organization, they first have to find a way to install their malicious virus. This most often occurs through social engineering or a phishing scam, where the attacker gains access to a computer or network component.
For example, the hacker may send out a bulk email message urging recipients to click on a link and enter their corporate credentials into the web form that opens. Even if only a single user in a large organization performs this action, it can spread damage throughout the network.
At this point, the hacker installs the malware onto the compromised computer and then tells it to transfer to other network nodes. Once a certain threshold is reached, users will be locked out of their workstations and may see a message on screen demanding a ransom.
This type of cybercrime dates back to the early days of the world wide web, with the first known ransomware virus being deployed in 1989 against the healthcare industry. Such attacks have grown more intricate over the years, but fortunately so have the methods of defense.
WordPress Attacks
[image 2]
System administrators may assume that WordPress installations are not vulnerable to outside attacks given that they mainly host text and image content. However, ransomware viruses are now targeting WordPress because of the platform’s connection to the open internet.
Recent attacks have originated as the result of compromised passwords within the WordPress console. If users are not required to maintain strong WordPress passwords and change them on a regular basis, then all content stored on the platform is vulnerable to attack.
After gaining access to the WordPress admin console, a hacker can upload malicious files directly to the organization’s main web directory. In the past, ransomware viruses were usually deployed through a rogue EXE file, but nowadays WordPress installations are being brought down by PHP files.
When one of these malicious PHP packages is uploaded to a WordPress directory, the software begins encrypting all other data located in adjoining folders. Original files are deleted and replaced with objects that have a different extension.
When normal users attempt to access the WordPress console, they find themselves locked out and redirected to a page demanding a ransom payment, typically in the form of Bitcoin or another cryptocurrency.
Most experts agree that such a ransom should not be paid by the affected organization, as there is no guarantee the attacker will ever unlock the data they’ve encrypted.
Ransomware Protection
[image 3]
The first step towards defending your WordPress installation against ransomware attacks should be educating users about the threats and risks involved. It’s important to emphasize that such hacks propagate through a single infiltration point, often via email spam or rogue hyperlinks.
Virtual Private Network (VPN)
One good preventative solution is to use a VPN. Growing in popularity as websites continue to suffer an ever-evolving onslaught of vulnerability probes, a VPN works in conjunction with your ISP. When deployed properly, it encrypts both ends of an internet connection, leaving hackers gazing at gobbledygook and (hopefully) moving on to easier prey.
When evaluating VPNs it’s important to know that not all are made equal. Lucas Johnson of Privacy Australia has some great vpn reviews based on logging, speed, country or establishment and also P2P file transfer policy.
Download from Official Sources
When you first set up a new WordPress installation, whether it is hosted locally or through a cloud provider, you should take precautions when it comes to cybersecurity.
WordPress themes are the configuration files that give your website its color pallet and general design structure. Some website owners will develop their own theme, but most obtain one from a third-party.
Beware of any WordPress themes that are offered as free downloads, as these may contain malicious files that could spawn a ransomware virus once installed. Instead, focus your theme search in the official WordPress community directory, which offers a range of options that have been verified as safe to install. The same precautions should be taken when adding plugins and other WordPress customizations.
Embrace Regular Updates and Backups
If you are running your WordPress instance on a local server environment, keep back-end systems up-to-date. Operating systems are patched regularly to protect against new cyber threats and the same goes for the WordPress software itself. You can check your WordPress version through the admin console and set up automatic update installation.
Data files are typically the main target of ransomware attacks. If your WordPress system falls victim to such a hack, you may lose all of the information in your website’s directory.
Keeping daily or hourly backups is the best practice to take if you want to minimize data loss and downtime. Experts agree that you should store WordPress backups in both local and outside locations, which is made easier with cloud storage solutions.
Conclusion
Organizations of all sizes are at risk of being infiltrated by a ransomware attack. But those who are prepared and diligent will be able to block the hack and bounce back quickly.
To keep your WordPress website fully secure, consider investing in a full-scale security solution that will protect your data and monitor your network for network-based threats. These may add a cost to your bottom line, but ensuring the security of your data will save you a lot of frustration in the long run.
