Warning: Don’t Make This Stupid Website Security Mistake

One of my less than happy memories as a blogger is from a couple of years ago.

It started with an email from a kind reader. Sadly, it was the sort of email that no blogger wants to receive, titled “Chrome is warning people off your site.” The reader alerted me to a malware message appearing when he tried to visit my site Aliventures.

Not great news at any time … but I was right in the middle of running an ecourse on my site, and about to head off for a weekend conference.

After a long struggle to find out what was wrong and how to fix it, I learned that the malware had got in through an outdated plugin on an old website, running an old version of WordPress, that I’d not looked at in years.

And the reason the malware had infected my main site, Aliventures, was because I’d (unknowingly) made a really stupid mistake.

I kept all of my sites under a single FTP user account, with one username and password. I thought because the password was strong, and I was the only person who accessed the sites, this wouldn’t cause any problems.

Wrong. Once the malware got in, it could affect any of the sites under that user account – including sites I hosted for friends, family and even a few clients.

Thankfully, a great security company, Sucuri, cleaned up the mess. (I have a monthly subscription to their service now, just for peace of mind.)

I learned an important lesson – if you run multiple websites, don’t put them all under the same FTP account.

(Oh, and keep all your WordPress installations – including plugins! – up to date too.)

Have you ever faced a situation like this? What caused it, and what did you learn? Share your tips with us in the comments…

If you enjoyed this post and wish to be informed whenever a new post is published, then make sure you subscribe to my regular Email Updates. Subscribe Now!

Kindly Bookmark and Share it: