One of the most frequently asked questions we get is how to protect a WordPress website from ransomware. It is a two part answer. First keep your site software updated to reduce the possibility of known bugs that hackers will exploit. The second part, and this is very important, keep a backup copy of your website.
What Is WordPress Ransomware?
Let’s start with the definition of ransom:
Ransom: a sum of money or other payment demanded or paid for the release of a prisoner.
In the case of ransomware, the prisoner is your website. Ransomware is a type of malware that scrambles the content of your website. The only way to recover your site is to pay the hackers a fee for them to undo the damage. We are talking real money, perhaps thousands of dollars.
How is Ransomware Installed?
The most common way ransomware is installed on a WordPress site is through a bug in wordpress or a wordpress plugin. Which one you may ask? The real answer is that it’s a moving target.
WordPress updates are released to fix bugs. If you aren’t applying these updates, then you could be leaving a known security hole in your website. It’s very important that you stay current on the security fixes released for WordPress, your plugins, and your theme.
If the number of updates to your website is overwhelming, we recommend subscribing to a WordPress Support Services so that specialists can do the WordPress updates for you on a regular basis.
Should I Pay the Ransom?
Experts disagree whether paying the ransom is a good idea. When you send money to these unscrupulous criminals, there is no guarantee they will follow through and decrypt your website. The most obvious reason is that they are bad dudes. They have your money so why would they care to do extra work?
The second reason is that when hackers use free email addresses like gmail, yahoo, or hotmail, known as throw away accounts, the abuse teams at the email providers disable malicious accounts to stop the criminals from collecting income. You are caught in the middle of having paid to an anonymous overseas bank account but have no contact with the criminals to get the unlocking code.
Can My Website Be Fixed Without Paying Ransom?
YES, there is a solution! Your website can be restored from a backup. The major caveat to this answer requires you to be performing regular backups before your website gets hacked. There are free backup plugins to help with this. We recommend UpdraftPlus.
Here is the second important point. Your backups should be offsite. This means your backups should not be stored on the same server as your website. If the hackers can mess up your website, they can mess up any file in your account, including your backups. By sending your backups to dropbox, google drive, or amazon S3 storage, you put your backup copy out of reach from the ransomware program.
The folks at WordFence agree of the need for off-site backups in this post:
Ransomware Targeting WordPress – An Emerging Threat
It is important that you don’t store your backups on your web server. If, for example, they’re stored in a ZIP archive on your server, then if your site is taken over by this ransomware, the backups will also be encrypted and will be useless.
Who Can Help Me?
As you have read, there are a lot of considerations that need to be made to keep your website secure. We understand not everyone is a WordPress security expert. OnSiteWP has developed our WordPress maintenance service to provide businesses with the essential security, updates, and backups needed for responsible website ownership. A lot of time and money has went into building your website. Protect that investment with one of our WordPress maintenance service plans. We take care of the technical IT issues so that you can focus on your business.
Get more info on our WordPress Support Services here:
Buy Now – Stay Secure
Author: Brian Murphy
Brian Murphy is co-founder of OnSiteWP, a WordPress website maintenance company. His professional experience of working within enterprise IT, communication departments, startup companies and freelancing provides a unique, well rounded perspective on the issues business owners face.