Website Security Checklist: 36 Tips to Complete Your Website Security Check

It pays to be paranoid in today’s online world with all the potential website security threats because the bad guys REALLY are out to get you…Check your website security often!

We were hacked not long ago. And let me just confirm, it’s no fun.

But this time, it wasn’t so bad because we had systems and tools in place to shut down the hacker fast.

First, evverything is ok. No data was destroyed nor was any customer information revealed. But it was a close call. This is what we call a teaching moment. And since that is what we do best, I wanted to help as many of you as possible make sure that you have the right website security in place.

Stay tuned and we’ll give you a simple, but thorough website security checklist to help protect you from the bad guys.

Here's what happened to us.

Last week, during the Insiders Club call, Jen (my daughter and company manager) tried to login to the Learning Center to show people how to find a specific product.

She couldn't. She was locked out.

I couldn't log in. I was locked out.

None of the rest of our team could login. We were all locked out.

And we began getting support tickets - customers were locked out too. And that’s a really bad thing.

Website hacking is rampant. We all have to be incredibly vigilant because there’s a group of ne’er-do-wellers out there (and they seem to be growing) who would much rather do damage than do good.

This was the second time we’ve been hacked. The first was many years ago.

During our semi-annual workshop in February, a threatening message on the site homepage read:

“David Perdew, you owe me money and I will expose your database to the world if you don’t pay $15000.”

Of course, we had no idea the identity of this mysterious - and extraordinarily dumb hacker - since there was no contact information or payment instruction.

We called the FBI (zero help by the way) and hired a team of cyber sleuths to rectify the hack.

The damage was done though because it forced us to shut down the site for six weeks to clean up and harden the site. Basically, it was a complete rebuild costing us about $75,000 in lost revenue and expenses to get back up and running.

Ten hours after we discovered the attack, we figured out that a person in Jordan, who had signed up for one of our products, used his login and technical know-how to invade the system and plant a malicious file.

Even though our system is much more secure, no computer is foolproof.

So, when we were hacked again recently, I flashed back to that costly previous experience praying that we’d done a better job this time of backing up our systems, putting our WordPress security plugin software in place, configuring it properly, and working with our hosting company to be ever vigilant.

But our system, like yours, gets hit thousands of times a day by hackers and bots trying to find a simple and easy vulnerability to exploit.

If you think about this too long, you could think that doing business online just may not be worth the trouble. Luckily, there are simple ways to ward against 99.9% of the threats.

This time, when we saw the issue, Jen jumped on with LiquidWeb, our host, and they confirmed that they could see a rogue account with an IP from Tunisia that accessed our server and was in the account. They could see where he was and what he was doing.

And because of the unusual server activity, our WordPress security plugin, iThemes Security Pro, did it's job and shut down the entire site until we could stop the strange behavior in the server.

We'd caught a hacker in the act.

My first thought in a situation like this is about the backups. “Where's our backups?"

Website backups are not something we think about often, but when we do, it’s usually as the result of some tragedy. And while we never want to use the backups, we must have them in case we do.

One of the reasons our first hacking experience shut us down for 6 weeks many years ago was because our backups had consistently been overwritten with new backups that had become infected with the malicious sleeper file. That allowed the hacker to trigger his activity at a later date.

Rebuilding the site was our only option.

One backup isn’t enough. We like to have a couple of months of backups just in case. Yes, that’s probably overkill, but when you have unlimited cloud storage from a reputable company like Google, data space is not an issue.

Unlimited backup space seems like it would be really expensive, but it isn’t at all. About 18 months ago, I made a very small one time investment in a product called Unlimited Cloud Storage.

All of our backups are loaded on that Google drive account with multi layered 2 factor authentication security. We used those to restore our sites by suppertime and get everything back to normal with very little downtime.

After this episode, I begged the developer to give our community a special promotion code to get $10 off. If you’re interested in Unlimited Cloud Storage, be sure to use the promo code NAMS10.

Tools, tips and tricks to enhance your security with a site security checklist

But unlimited cloud storage is not the only website security best practice we use.

We’ll go through a few of the best practices we use and a few of the tools we like to implement those below.

Domain Registration/ Hosting

Even though this is so important, too many people overlook this simple step. For example, someone may register their domain Godaddy and decide to get hosting there as well. Their entire business can then be shut down by Godaddy if they don’t like your business for any reason.

If you register your domain in one location like Simple Niche Domains (our Godaddy reseller account), and host your domain with a separate company like A2 Hosting (we recommend highly with very reasonable rates for medium to smaller sites), you’ll be in control.

Register your domain in a different place than where you host your site!
Use a hosting company with a good reputation and good support plans

WordPress Admin Structure/Plugins/Themes

Never use admin as your username
Delete any account using admin as the username
Always use a strong password - we recommend 20 characters with AT LEAST 1 Symbol, 1 Number and Upper and Lower Case
Periodically remove admin accounts set up for support of your plugins or products
Alway check for abandoned plugins. These are plugins that have had no updates recently (within the last year)
Don't be a plugin hoarder. Make sure you delete plugins that are no longer being used or that are duplicates of another product.
Never allow additional plugins to be added to your site without permission
Avoid free plugins unless the company has an upgrade path.
Always make sure you're updating your WordPress theme. If your theme has not had updates recently, change themes! (child themes can be hacked too so if your child theme is outdated, it may be time for a newer one)
Keep your WordPress core software updated. Be sure you backup first before updating and if possible run the updates on a test site or server
Do NOT use free themes

Backups

You can schedule backups to run directly with your hosting company. These are not always the easiest to access but are good to have running as a backup of your backup system - or a redundancy.
Make sure backups are running on all of your sites frequently. At least daily. If you add a lot of content to your site, we recommend backing up multiple times per day. We back up every 12 hours and load to our Unlimited Cloud Storage.
Make sure your hosting company is running a Cpanel Backup as well. This does not have to happen as frequently as cpanel changes should be minimal.
Make sure you have a cloud storage account for your backups
Make sure you are deleting old backups, especially if you are paying for storage space.
Use a WordPress Backup Plugin - These are super easy to configure and use. We use Updraft and recommend BackupBuddy as well.

Connect your backup plug in to your cloud storage and make sure to add extra security on your backup folder. Password protect the folder OR put 2 factor authentication on the folder

Security Plugins

Use a WordPress security plugin. A paid version with good support is best. That’s why we use and recommend iThemes Security Pro.
Configure your security plugin correctly
Remember your security plugin will protect your site from bad players but sometimes can flag innocent customers and users. You can automatically whitelist or remove a blacklist on a customer IP address in your security settings.
Use recaptcha or two step optins to ensure you're not getting hammered by bots and bad sign ups

Password Manager

Use a password manager tool. There are several out there but we prefer LastPass because we can share access with our team members without sharing passwords. And we can use the mobile app to access anything from our phone as well.

Use A WordPress and Security Company

Amy Bair - eHemisphere
Paul Taubman - Digital Maestro
Debra Lloyd - WP WebWorks

We'll send it right over to your inbox!

Get more leads and make more money with the LEAD System

Finding Your Home in the Online Jungle

The 5 Mistakes That Guarantee Your Business Never Gets Off The Ground – Part 2

The 5 Mistakes That Guarantee Your Business Never Gets Off The Ground

This is My Story

Are you a ‘Starter’ or a ‘Finisher’?

Bill Sefton

"I just finished reading your Endless Affiliate Profits - Lots of Golden Nuggets that extend beyond the Affiliate universe...I'll be spending my weekend implementing them..."

Percy Miller

NO ONE else is doing things online like you guys are doing it...You guys are building and teaching what I want to learn how to do with my online efforts...Today I saw the future!"

Shelley Merchant

I have wandered around blindly for over 4 years wondering why things weren't working...the things y'all teach are not being taught elsewhere. Instead, the advice is vague and leaves you feeling stupid because you're not figuring it out.

I cannot say enough good things...the only problem is that there's so much good stuff that I don't want to sleep b/c I want to learn it all.

I'm beginning to feel like a plan is forming and that I might actually make things work.

David Perdew is the CEO and founder of NAMS - the Novice to Advanced Marketing System. He’s a journalist, consultant, and serial entrepreneur who has built one of the most successful and fastest-growing business training systems online today called the MyNAMS Insiders Club.

The Novice to Advanced Marketing System is a step-by-step system focusing on Team, Training and Tools to help novice to advanced business people build a Simple, Scalable and Sustainable business.

He took a year off in 2003 to personally build a 2200 square foot log cabin in north Alabama where he and his wife and two dogs and a cat live on 95 acres of forest with four streams and 60-foot waterfall.

The NAMS team includes his daughter, Jen, who is an email marketing and automation specialist. Jen runs the day to day business and is one of the primary trainers in our MyNAMS Insiders Club.

Having a Plan Is Key, but Consistently Executing a Plan Is Even More Important. In 1987, I ran my first Peachtree Road Race 10K in Atlanta, GA. Just divorced, I was only 35 and skinny. Three weeks prior to the July 4th event, I decided to run the race. Without any training–at all, I thought, […]

Click Here To Read More

Thanks For Signing Up For The NAMS Business Growth Strategies Summit Access is headed to your inbox. (Please check spam, promotions and junk folders) If You’re Interested In Becoming An Affiliate Marketing Powerhouse Keep Reading As I Share How A Single Affiliate Promotion Put $12K in My Bank Account in 5 Days Click Below For […]

Click Here To Read More

Is Email Marketing Dead? Or Alive and Thriving? This is the 3rd part of a 5-part series outlining the 5 essential skills to create a successful business online. They are listed below. And if you miss any of the posts, just click the link to open in a new window: 1) The Entrepreneurial Mindset2) List […]

Click Here To Read More

How to Build an Email List with a Quality Lead Magnet Today, we focus on email list building, basic list management, and list building strategies while focusing on how to build an email list with a quality lead magnet. If you missed the first part of this series, you can see the post about about […]

Click Here To Read More

How to Develop an Entrepreneurial Mindset… We love to teach… And frankly, we’re good at it. When it comes to building an online business, folks we deal with every day have a lot of questions about building their businesses online. Many of those who approach us are just getting started with their businesses. Or they […]

Click Here To Read More

Thanks For Signing Up For The Marketing Trends EncoreAccess is headed to your inbox. (Please check spam, promotions and junk folders) If You’re Interested In Becoming An Affiliate Marketing PowerhouseKeep Reading As I Share How A Single Affiliate Promotion Put $12K in My Bank Account in 5 Days Click Below For Your Copy Of “5 […]

Click Here To Read More

Finding Your Home in the Online Jungle

By Jen Perdew 6 Comments

Finding Your Home in the Online Jungle

Do you ever feel like an explorer trying to find your way while building your business? Being an online entrepreneur is hard and finding good coaching for entrepreneurs is even harder! I know. There's alot of hype out there that says it isn't.

It takes work. It takes commitment and there's no magic button.

Not even when you see online "entrepreneurs" teaching how they made $20,000 yesterday in a business they started last week.

What's fact? What's fiction? Who can you trust?

There are so many pieces to creating a business that focusing in one area can mean ignoring another. But ignoring any area of your business is detrimental to its success as a whole.

It can feel like a never ending merry go round spinning so fast you can't get off. Until you get some solid ground under your feet.

So how can you create a solid foundation for your business?

You have to find support. You have to have someone you trust to talk to about issues and how to fix them. But this can't just be anyone. You wouldn't talk to a roofer about a problem with your car, right?

Having different levels of peer support is essential.

Why is that?

Have you ever been to a workshop or a class and you were scared to ask questions in front of the room. You felt a little embarrassed or unsure because of what you didn't know? (By the way we've all been there). It felt alot easier to seek out someone who you felt was in the same place as you, right?

You just created an alliance with someone else and things feel a little less scary.

But two people who are inexperienced still need the right answers. You still need some direction but you aren't going to walk right up to the teacher and ask for one on one help yet. That's ok.

Coaching For Entrepreneurs

Now you find someone who's at the next level and willing to lead you to right places. You still have to do the work, but they're showing you which door to open. These are the best people to know. These are the people who make the introductions, the people who "know people", the folks who are really working in their business and creating something successful.

Next, you have your mentors. These are the people you resonate with. They have your same values and you see their business as a model for how you'd like your own to run. Now remember, your mentors aren't necessarily people in your own niche. Any business owner regardless of their product can fall into this category. This is someone you follow and you've become active in their community; enough that you can ask a question and get an answer, a trusted answer.

Then you have your coach or strategist or consultant...whatever the term is in your industry. These are the people you pay to be part of your support team. You want to pay someone to help you elevate your business. Believe me, if someone is paying me to be on their team, it's in my best interest that they succeed.

This group is important because as your business grows, it becomes necessary to have a solid strategy for your future in place. A strategy based on your core values, beliefs and vision long term. These are the people who see "outside" your business and who can help you stay on the right path. These are also the people who help you reach a place where you are working "on" your business, not "in" your business. There's a really big difference here. Every successful person I know has someone they pay to coach, strategize or consult with.

I think belonging to a community is the single most important thing you can do for yourself and for your business. As we sit behind our computer screens, we are isolated and many times overwhelmed. Your community becomes a sounding board for your ideas or problems, as a place to find testers, a place to find specialists to do work for you, or sometimes just a place to goof around and have fun.

We all need that. Even the most introverted and shy people can come out of their shell a bit in an online setting.

I've spent alot of time talking about community but there are also two other required areas when trying to establish a solid business foundation.

You Must Have Trusted Training

Everyone needs training in something. No matter who you are. But the challenge is figuring out if you need training on an a concept or business strategy or if you need specific training on a technique. For example, building a long term social marketing plan for your business is conceptual. Why is it a concept? Because things change quickly in this area. Once you understand how the marketing plan works, you then start tackling the techniques to make that happen. What if you built your entire marketing plan around Instagram for example? Then Instragram made major changes to their business structure and all of the sudden that platform was no longer where your customers were. Now what do you do?

If you have the conceptual understanding of how a social marketing plan works, all your eggs wouldn't be in this one basket. In fact, you'd easily be able to scale your efforts in another area to make up for your losses.

It's easy to become overwhelmed with all the things you need to do for your business. But having basic business foundations allow you to build and scale your efforts easily because you know the processes.

Here's an example - every business owner regardless of their niche has to know how to build a list, how to drive traffic, how to manage business operations, right? Once you have mastered the concept of building a list, you can then apply those concepts to learning different techniques. The technique for building a list on Facebook is different than building a list using email. But the concept is the same. The structure, the pieces you need to do it are the same.

I know this can be hard to wrap your mind around but building foundations based on concepts and strategies allow you reduce the bright shiny object overwhelm.

Your Business Needs Tools

Tools are the things that allow you to operate. Your hosting platform is a tool. Your video player is a tool. Your auto-responder is a tool. Merchant services, graphics editor, page builders, advertising tracking solutions...

All these things are tools. They are what allow your business to operate day to day and should be something that pushes you to be more automated. But alot of us have tools we just knew we needed and have never even opened. Having someone test tools for you and give you honest opinions about them is priceless ( look, we're back to community).

Website Security Checklist: 36 Tips to Complete Your Website Security Check

The 5 Mistakes That Guarantee Your Business Never Gets Off The Ground – Part 2

The 5 Mistakes That Guarantee Your Business Never Gets Off The Ground

This is My Story