Over the holidays, Mark received a series of alarming emails from Google Search Console: hacked content detected on his websites. Not one site, not two — seventeen WordPress sites on a single server had been completely compromised. In this episode, Mark walks through exactly what happened, how he recovered, and the straightforward security steps every WordPress site owner should implement immediately to prevent this from happening to them.<\/p>\n
Mark describes receiving Google Search Console notifications during his holiday break alerting him that multiple sites had been hacked. Hackers had compromised his server and injected a massive amount of content, using his sites as bots and driving the CPU and disk usage through the roof. His wife's blog was also affected, showing “This site has been hacked” warnings in Google search results.<\/p>\n
Because the sites were hosted on SiteGround<\/strong>, Mark was able to submit a support ticket and have the entire server restored from a backup taken before the hack occurred. SiteGround handled this quickly, even in the middle of the night. Mark notes this approach does not always work — sophisticated hackers sometimes plant dormant code and wait for weeks so that all available backups are already compromised.<\/p>\n After restoring the server, Mark needed to harden all 17 sites to prevent re-infection. He presents a checklist of nine straightforward security measures<\/strong> that require no advanced technical knowledge.<\/p>\n First, ensure you have reliable recurring backups<\/strong>. Server-level backups from your hosting provider are the most reliable and easiest to restore. Second, keep WordPress core updated<\/strong> to the latest version, as every release patches known security vulnerabilities. Third, keep all themes and plugins updated<\/strong> and consider enabling automatic updates. Fourth, delete unused themes and plugins<\/strong> — inactive code that is not being updated provides attack vectors. Fifth, minimize plugin usage<\/strong> overall, because every line of third-party code is a potential point of entry.<\/p>\n Sixth, never use “admin” as a username<\/strong>. This is the default WordPress username and gives hackers half the login puzzle. Create a new admin account with a unique name and demote the original admin to subscriber. Seventh, use strong passwords and consider two-factor authentication<\/strong>. Eighth, choose reputable WordPress-managed hosting<\/strong> where the provider actively monitors for security threats. Ninth, register your site with Google Search Console<\/strong> so Google can alert you to hacks and malware. As a bonus, Mark recommends installing a security plugin like Wordfence<\/strong>, which provides firewall protection, malware scanning, and alerts when software is out of date.<\/p>\n Mark recorded this episode in January 2017, and WordPress security has evolved significantly in the years since.<\/p>\n WordPress auto-updates are now built in.<\/strong> Since WordPress 5.6 (December 2020), WordPress core includes the option to enable automatic updates for plugins and themes directly from the dashboard. This addresses one of Mark's key recommendations without requiring any additional configuration or plugins.<\/p>\n Managed WordPress hosting has become the standard.<\/strong> In 2017, managed WordPress hosting was a premium option. Today, providers like SiteGround, Cloudways, WP Engine, and Kinsta offer WordPress-specific security hardening, automatic backups, staging environments, and server-level firewalls as standard features. The hosting landscape has shifted heavily toward managed solutions that handle much of the security Mark describes manually.<\/p>\n Two-factor authentication is now widely available.<\/strong> In 2017, 2FA required a separate plugin. Today, many hosting dashboards and WordPress security plugins include 2FA as a built-in feature. Passwordless login options using hardware keys or authenticator apps have also become more common.<\/p>\n Application-level firewalls<\/strong> from services like Cloudflare<\/strong> (which offers a free tier) can now block many common attacks before they reach your server. Cloudflare's Web Application Firewall and bot management tools provide a layer of protection that did not exist as a free option in 2017.<\/p>\n The threat landscape has intensified.<\/strong> Automated attacks on WordPress sites have increased dramatically. Bot networks now scan the entire internet for vulnerable WordPress installations within hours of a vulnerability being disclosed. This makes the urgency of Mark's advice even greater — the window between a vulnerability being discovered and being exploited has shrunk from weeks to hours.<\/p>\n If you found this episode helpful, you might also enjoy:<\/p>\n Listen to Late Night Internet Marketing on Apple Podcasts<\/a> or subscribe at latenightim.com\/internet-marketing-podcast\/<\/a>. Have a question for Mark? Call the digital recorder at 214-444-8655 or drop a comment below.<\/p>\nKey Takeaways<\/h2>\n
\n
What's Changed Since This Episode<\/h2>\n
Resources Mentioned<\/h2>\n
\n
Related Episodes<\/h2>\n
\n
Listen and Subscribe<\/h2>\n