Website Security

BUMMS – Website Security Preparation for Today

Posted on 07.03.25 | Jim Walker | 5 Comments

Today’s Website Security Reality

Website security isn’t just about prevention — it’s about preparation.

Strong passwords, security plugins, and even DDoS protection are important. But none of these alone will stop a hack—just like window bars don’t stop a determined burglar.

Real protection comes from planning ahead and staying vigilant. Let’s break it down with a simple framework I call BUMMS — a five-part approach to preparing your website for whatever comes your way.

B – Backup

Backups are your safety net. If your site gets wiped or compromised, this is how you bounce back.

Store backups offsite — cloud-based is ideal.
Keep full backups every two weeks for at least a month.
Database backups? Daily for at least five days.

U – Update

Over 80% of WordPress hacks happen because of outdated plugins and themes. Updates are your easiest win.

Log in monthly to check for updates.
Apply all security patches right away.
Set a schedule or use a managed service if needed.

M – Maintenance

Outdated staging sites and unused PHP scripts are hacker magnets. Especially in shared hosting environments.

Delete old directories like /demo, /test, or /old.
Clear out inactive WordPress plugins and themes.
Treat your plugin list like your bedroom: keep it clean to avoid “bed bugs.”

M – Monitoring

Without monitoring, hacks can go unnoticed for weeks. By then, the damage is done.

Use plugins to track file changes, login attempts, and dashboard activity.
Here’s a shortlist of helpful tools.
Also use external services like ChangeDetection.com or Google Alerts to watch for content changes.

S – Segregation

Still hosting multiple websites under one cPanel account? That’s a recipe for disaster.

One site gets hacked — they all go down.
Separate each domain into its own account with its own FTP access.
Segregation is the new security baseline, not a luxury.
Here’s why shared hosting can hurt.

Your BUMMS Checklist

Backups – Offsite and automatic

Updates – Plugins, themes, core

Maintenance – Tidy up old scripts and tools

Monitoring – Internal and external alerts

Segregation – Isolate apps, isolate risk

Your BUMMS are your best protection.

Website Security Planning for Today.

Why Is My Church or Non-Profit Website a Target for Hackers?

Posted on 04.22.25 | Jim Walker | Leave a Comment

I’m asked these questions quite often: “Why was my church’s website hacked?” And, “Why would a hacker want to hack my little non-profit WordPress website?”

First of all, if your non-profit-related website has been compromised, try not to take it personally. In my experience at HackRepair.com having worked on thousands of hacked websites over the years, I can tell you that it’s almost never personal.

In this article, I’ll cover the basics of website account security and describe how you can greatly increase the security of your non-profit’s website today. Topics are:

Why do website hackers hack websites?
So how do website hackers break into a website’s account?
Why is segregated website hosting important?
I update my website password often. Isn’t that enough?
What should I look for if my website has been compromised?
What is a backdoor script?
What are some common website hacking related terms?
How can I help prevent my website from being hacked?

Why do website hackers hack websites?

Well, believe it or not, hacking websites is big money according to security researchers. Some hackers make more than $80,000 a month.

Church and non-profit websites are often targeted by hackers for a variety of reasons. Some of those reasons are:

Non-profits are more often maintained by part-time volunteers with limited WordPress expertise.
Well maintained religious-based websites have better-than-average domain authority, credibility, and readership, which is especially appealing to black-hat SEO hackers.
Non-profit websites’ donation forms are appealing targets for harvesting credit cards.

So how do website hackers break into a website’s account?

You may think your website is secure because your web designer is reputable and experienced. In my own experience over the past decade over 80% of all the compromised websites I’ve helped clean and secure after being hacked were the result of hackers taking advantage of exploits through either:

1. Outdated plugins.
2. Outdated themes.
3. Or poor “key control.”

The majority of exploited website accounts I’ve encountered were then compromised in one of two ways:

1. The hacker either injected files into the website account.
2. Or the hacker injected text or code into posts or web pages.

And once hackers have a foothold into a website’s account they rarely give it up easily, often hiding their back-door scripts in various placed throughout the hosting account. I’ll cover back-door scripts a bit later.

Why is segregated website hosting important?

There’s a common misunderstanding among website owners about the dangers of hosting multiple websites within a single shared account.

Many people have fallen prey to unlimited shared hosting account services. While on the surface it seems like an unlimited shared hosting account is an efficient and low-cost way to host multiple websites within a single website account. In actuality, this type of service is akin to renting office space where all of the internal office doors share the same front door key.

If you are hosting multiple WordPress websites within a shared hosting account, your risk of being compromised is exponentially greater than a website hosting account with a single WordPress installation.

For this reason, segregating each website into its own separate hosting account is an important long-term website security strategy.

I update my website password often. Isn’t that enough?

Now back to my earlier note about poor “key control.” Non-profit organizations, in particular, are susceptible to password “leakage.” Because the roles of volunteers within a non-profit organization may change regularly, both real-world physical security and website password security can be a challenge.

For instance, a single segregated website account may have dozens of sub-passwords, each being a potential entry point for hackers. If you are working to improve your organization’s password management I recommend locating and periodically updating each of the below passwords at least every few months:

1. 1. Your web hosting company’s “billing” login password.
  2. Your web hosting company’s website control panel (cPanel, Plesk, et al.).
  3. All FTP passwords within your website’s hosting account control panel.
  4. All WordPress administrative user account passwords.
  5. Your organizations social media accounts as well (Twitter, Facebook, et al.).

While reviewing a client’s list of WordPress user accounts, look at what I stumbled upon:

What should I look for if my website has been compromised?

Example list of hacker files littered throughout a compromised website. — Click to View

A website hacker’s modus operandi is injecting malicious code or text into files or web pages. This injected code can do any number of things, like redirecting site visitors to other websites; advertising text or links; or harvesting visitor data.

Today’s websites can be a mix of thousands of files. That’s a lot of hiding places to consider when reviewing a compromised website account. And nearly all of these files, from text files to PHP files and even images, may harbor malicious code.

Hacker files or code injections most often fall into one of three categories:

1. Backdoor PHP scripts.
2. Malicious text or code injected into legitimate files or databases.
3. Or a combination of backdoor and malicious text or code injections.

When reviewing a recently hacked website I always start by sorting the directories and files within a website by date. With code injections, it’s often possible to quickly identify compromised files by viewing the text within the most recently changed files.

Theme files like the 404.php, functions.php, and header.php are commonly exploited files, example below:

**What is a backdoor script?**

Backdoor scripts are files or code injected into legitimate files that give hackers access to add or edit files or databases within a website hosting account.

Once in place within a website, these files or code injections may allow hackers unrestricted access to an account until they’re removed.

And with all of the places a hacker may hide malicious code within a website, you can’t assume anything when it comes to locating and removing backdoor scripts within a website’s account. Every file and directory must be carefully reviewed for signs of malicious content.

In the case of WordPress, even the latest malware monitoring security plugins often miss or misidentify these files. Written by financially-motivated black-hat hackers, backdoor scripts often require a bit more effort to identify than running an off-the-shelf malware scanner. Human eyeballs haven’t yet been automated out of this job (at least not yet).

Below is an example of hacker code injected into a legitimate WordPress file, which allows the hacker to pass commands along to another file added by the hacker:

What are some common website hacking related terms?

Since you are reading this article, I suspect you are hoping to better educate yourself about website security. Below are a few of the commonly used terms associated with the website hacking “business”:

Phishing is the fraudulent practice of masquerading as a reputable company in order to trick you into revealing confidential information.

SEO spam, also known as spamdexing or injected backlinks, is an attempt to manipulate search engines by including links or content within a legitimate website to help increase the search engine position of another website.

Black-hat SEO hackers inject SEO spam within legitimate websites to improve the search engine position of less legitimate websites.

Harvesting credit cards may be possible by injecting code into a payment page in order to “sniff” credit card information while information is being entered.

Badware or drive-by downloads refer to the unintentional download of malicious code into a computer or mobile device. The scary part is that a click or other action may not be required to inject the malicious code into the device.

DDoS attacks or “distributed denial of service” attacks may involve surreptitiously using the processing power of a number of unsuspecting websites against another website in order to interrupt the services of a specific target website.

Ransomware is a form of virtual blackmail, where malicious software is employed to lock data until a ransom fee is paid.

Malware is a term used to describe malicious code that may cause harm to a website, it’s reputation, or devices connecting to a given website.

Website defacing most often refers to someone changing the content on a website with malicious intent.

A quick Google search on any of these phrases will bring up hundreds, if not thousands, of stories describing the criminal behavior relating to each of these website security-related terms.

How can I help prevent my website from being hacked?

Below are four actions you can take today that will greatly improve the security of your website account and decrease the likelihood your website will be compromised by hackers tomorrow.

Backups. Maintain a weekly automated backup of your website to a cloud service account like AWS, Google Drive or Dropbox.
While you may not be able to monitor your website every minute of every day, a solid backup program will help turn a potential disaster into a one-click-to-recover insurance policy. For WordPress, try one of these plugins: UpdraftPlus, BackupBuddy or JetPack Backups.
Updates. With content management systems like WordPress, the regular updating of your website’s plugins, themes, and WordPress are required steps in improving the security of your website and hosting account.
Monitoring. If your website was built with WordPress, there are a number of well-regarded security plugins to choose from. WordPress security plugins are not foolproof but they may help reduce the impact of bad bots and automated intrusion attempts by monitoring and notifying you of bad behavior on your website as it happens.
Management. And lastly, use a secure password management system to save passwords. This is a great way to reduce our very human tendency to use the same password for every website we password protect.

Have questions?

If you have comments, suggestions or questions, Jim Walker may be reached at [email protected].

“A thing done well is rarely done alone.”
And many thanks to the following good folks who helped in proofreading and editorial review: Joyce Walker; Mike Dudas @tvcnet; Mark Glover @servingwithamission; and others.

Jim Walker, Website Security Professional
I am a website security professional, with HackRepair.com, where I’ve been helping non-profits and businesses recover from compromised website situations and have been helping to secure websites against hackers for over 20 years.

How to Fix a Hacked WordPress Website: My Experience and Insights as The WordPress Hack Repair Guy

Posted on 06.11.24 | Jim Walker | Leave a Comment

How to fix a hacked WordPress site by Jim Walker As someone who’s been fixing WordPress security issues for over two decades, I’ve seen up close how a hacked WordPress site can wreak havoc on companies and people. I’m Jim Walker, but folks know me as “The WordPress Hack Repair Guy.” My company HackRepair.com, focuses on quick and reliable fixes for hacked WordPress websites.

Why am I writing this article on how to fix hacked websites?

I started writing a detailed guide for myself about fixing hacked websites. As I wrote, I realized I had enough info to make a full article about WordPress security. So here it is: my outline and steps for fixing hacked websites are now online. I hope you find this website security article helpful.

My Background and Expertise in WordPress Security

I’ve been in the WordPress security industry for over two decades, during which time I’ve honed my skills in quickly solving complex WordPress website issues. I take a lot of pride in my ability to explain technical jargon in an easy-to-understand way, which helps put my clients at ease during the stressful experience of a WordPress hack cleanup project.

Over the years, several organizations have recognized my work, and I’ve teamed up with some of the top WordPress hosting companies. These companies often suggest my services to their own customers.

Signs That Your WordPress Website is Hacked

In my experience, several red flags may indicate your WordPress website has been compromised:

WordPress homepage/content is modified or vandalized
Web traffic is redirected to sketchy websites
You are locked out of your WordPress dashboard, your login credentials no longer work, and you are unable to reset your password
The WordPress site displays ads for counterfeit or illegal products
A sudden drop in speed and performance of your WordPress site
Google, McAfee, Avira, or other reputation services website have flagged or blacklisted your WordPress site
Google Analytics shows your WordPress site ranking for unrelated keywords

If you notice any of these warning signs, it’s crucial that you act quickly to minimize the damage to your WordPress site. Contacting an experienced WordPress professional can help resolve these issues more quickly.

My Process for Fixing and Securing a Hacked WordPress Website

Pinpointing the WordPress Attack and Identifying the Cause

1. Identifying the WordPress Attack and Determining Causes

When a client comes to me with a hacked WordPress website, I first conduct a thorough WordPress security check. Here’s how I do it:

Comprehensive WordPress Malware Scanning: I start by using my own security tools to scan the website, along with Google Safe Browsing, URLVoid, and others to scan the WordPress website for any signs of malware, blacklist warnings, or other security issues. These tools help me identify the presence of known WordPress malware signatures, suspicious scripts, or unauthorized redirects. I don’t just scan the public-facing pages; after login I also check all the WordPress website’s files, including the WordPress core files, themes, plugins, and databases, to ensure a complete analysis.
Manual WordPress Code Review: Besides automated scans, I manually review the WordPress website’s source code, especially the core WordPress files, themes, and plugins. I look for any recent modifications that seem suspicious or out of place. This includes checking for obfuscated code, hidden iframes, or unfamiliar external links within the WordPress files. My years of experience with WordPress architecture and common vulnerabilities allow me to spot subtle signs of a hack that automated tools might miss.
Assessing WordPress Security Status: If the WordPress website has been flagged by Google or other security monitoring service, I use their diagnostic tools to get more information about the specific issues they’ve detected. For example, Google Search Console provides details about the type of malware found, the affected WordPress pages, and the date Google detected the issue. This information helps me understand the extent of the WordPress hack and plan my cleanup strategy accordingly.
Identifying the WordPress Hack’s Signature: Based on the scans and manual review results, I work to identify the specific type of hack that has affected the WordPress website. Common types of WordPress hacks include SEO spam, malicious redirects, phishing pages, or complete WordPress site takeovers. Every kind of WordPress hack has its own unique signatures and behaviors. By identifying the specific WordPress hack, I can tailor my cleanup approach to be most effective and ensure I remove all traces of the malicious activity from the WordPress site.
Determining the WordPress Entry Point: As part of my investigation, I also try to determine how the hackers gained access to the WordPress website in the first place. This could be due to outdated WordPress core files, themes, or plugins with known vulnerabilities, weak WordPress admin passwords, insecure WordPress hosting configurations, or even a compromised web hosting account. Identifying the entry point is crucial not only for cleaning up the current WordPress hack but also for preventing future breaches by addressing the underlying security weaknesses in the WordPress setup.

2. Cleaning the Hacked WordPress Website

Once I’ve identified the issues, my WordPress cleanup process is thorough to ensure the hacked WordPress website is completely clean and secure. Here’s how I do it:

Stopping running malicious processes on the WordPress site: I start by identifying and terminating any active malicious processes or scripts that may still be causing damage or allowing the hackers continued access to the WordPress site. Using advanced tools and techniques, I locate these processes, whether running on the WordPress hosting server or within the WordPress website’s files, and shut them down to prevent further abuse.
Replacing or removing hacked and suspicious WordPress files: Next, I meticulously review the WordPress website’s files, including WordPress core files, themes, and plugins, comparing them to clean backups or original versions if they are available. I look for any WordPress files that have been modified, added, or injected with malicious code. Once identified, I carefully remove these corrupted WordPress files and replace them with clean versions. This process requires attention to detail and a deep understanding of the WordPress file structure to ensure no legitimate WordPress files are accidentally removed.
Cleaning and restoring compromised WordPress databases: Hackers often target WordPress databases to steal sensitive information or manipulate data. I use specialized tools to scan the WordPress databases for any signs of malicious entries, suspicious user accounts, or unauthorized changes. If I find any compromised data, I carefully clean the WordPress database, removing the malicious elements while preserving the integrity of the legitimate WordPress data. In some cases, I may need to restore the WordPress database from a clean backup to ensure it’s completely free of any remnants of the hack.
Detecting and removing hidden backdoors in the WordPress site: One of the sneakiest tactics hackers use is creating hidden backdoors that allow them to regain access to the WordPress site even after it’s been cleaned. These backdoors can be well-disguised within legitimate WordPress files, themes, or plugins. Using my knowledge of WordPress hacking techniques and signatures, I thoroughly scan the WordPress website for any signs of these backdoors. When I find them, I remove them without disrupting the normal functioning of the WordPress site. This step is crucial to prevent future re-infection of the WordPress site.
Removing suspicious WordPress user accounts: Hackers often create new WordPress user accounts or compromise existing ones to maintain their access to the WordPress site. I carefully review all WordPress user accounts, looking for any that seem suspicious or unauthorized. This includes checking for WordPress accounts with unusual permissions, strange usernames, or accounts that were created around the time of the hack. I remove any WordPress accounts that I believe were created or compromised by the hackers. I also recommend that all legitimate WordPress users change their passwords to strong, unique ones to prevent further unauthorized access to the WordPress site.
Requesting reviews from security monitoring companies for the cleaned WordPress site: Once I’ve completed the WordPress cleanup process, I take the extra step of requesting reviews from the WordPress website’s hosting company, as well as security monitors like Google Safe Browsing, Avira, and others that may have flagged the WordPress site as dangerous due to the hack. I submit the cleaned WordPress website for their review, providing evidence of the thorough cleanup. This helps get the WordPress website removed from blacklists and regain its reputation as a safe, trustworthy site.

Throughout this WordPress cleanup process, I like to keep my clients informed of my progress and findings. My goal is not just to fix the damage caused by hackers but also to give my clients peace of mind by ensuring the security of their WordPress websites. Following this step-by-step process, I can efficiently and effectively clean up compromised WordPress websites, minimizing downtime and restoring them to normal functioning as quickly as possible.

3. Securing the WordPress Website from Future Hacks

Fixing the immediate issues is just the first step in the WordPress website recovery process. To truly protect my clients’ WordPress websites from future hacks, I always emphasize the importance of implementing strong WordPress security measures. Here’s how I secure WordPress websites to prevent future breaches:

Updating WordPress Core, Themes, and Plugins: One of the most common ways hackers gain access to WordPress websites is by exploiting vulnerabilities in outdated WordPress core files, themes, and plugins. To combat this, I ensure that all WordPress components are updated to their latest versions. I start by updating the WordPress core and methodically updating all WordPress plugins and themes, paying particular attention to those with known security issues. If any WordPress plugins or themes are no longer maintained, found to be nulled themes and plugins, or have unpatched vulnerabilities, I work with the client to find secure alternatives or remove them altogether from the WordPress site.
Strengthening WordPress User Access Controls: Weak WordPress passwords and improperly configured user accounts are another common entry point for hackers. To address this, I enforce strong password policies for all WordPress user accounts associated with the website. This includes requiring complex passwords that include a mix of uppercase and lowercase letters, numbers, and special characters. I also recommend enabling two-factor authentication for WordPress whenever possible to provide an extra layer of security. Additionally, I carefully review all WordPress user accounts and their permission levels, ensuring that each user only has access to the features and areas of the WordPress site that they absolutely need. This principle of least privilege helps minimize the potential damage if an individual WordPress account is compromised.
Implementing Secure WordPress Backup and Recovery Processes: Having regular, secure backups of the WordPress website is crucial for quick recovery in case of a future hack or other disaster. I work with my clients to implement automated backup systems that create complete copies of their WordPress files and databases regularly, typically daily or weekly, depending on the WordPress site’s needs. I ensure that these WordPress backups are stored securely off-site, either on a remote server or in the cloud, to protect them from any issues affecting the main WordPress hosting. I also regularly test the WordPress backup restoration process to ensure that the backups are viable and can be used to quickly restore the WordPress site if needed.
Conducting Ongoing WordPress Security Scans and Monitoring: Even after the initial WordPress cleanup and security hardening, I believe in the importance of ongoing monitoring. I set up regular security scans of the WordPress website using my proprietary malware checking and monitoring scripts and online services like VirusTotal, Google Safe Browsing, Norton Safe Web, and others to detect any new malware or suspicious activity on the WordPress site. I also monitor the WordPress website’s traffic and user behavior for any signs of unusual activity, such as sudden spikes in traffic from unfamiliar sources or multiple failed WordPress login attempts. If I detect any potential issues, I proactively investigate and address them before they can escalate into full-blown WordPress security breaches.
Implementing Web Application Firewall (WAF) Protection for WordPress: For an added layer of security, I often recommend that my clients implement a Web Application Firewall (WAF) designed explicitly for WordPress. A WordPress WAF acts as a barrier between the WordPress website and incoming traffic, filtering out malicious requests and protecting against common WordPress attack vectors like SQL injection, cross-site scripting (XSS), and DDoS attacks. Based on their specific WordPress website needs and budget, I help my clients choose and configure a suitable WordPress WAF solution, such as Cloudflare, or Wordfence. I then monitor the WAF’s activity and adjust its rules to ensure it effectively blocks WordPress threats without interfering with legitimate traffic.
Providing Ongoing WordPress Security Support and Maintenance: Securing a WordPress website is not a one-time event but an ongoing process. To help my clients maintain a strong WordPress security posture, I offer ongoing support and maintenance services tailored to WordPress. This includes regular WordPress core, plugin, theme updates, WordPress security scans, and access to my expertise for any WordPress security-related questions or concerns. I also keep my clients informed of any new WordPress security threats or recommended best practices, helping them stay proactive in protecting their WordPress websites. By providing this ongoing WordPress support, I aim to give my clients peace of mind, knowing that their WordPress website security is in capable hands.

By following this comprehensive approach to WordPress security, I assist my clients in recovering from WordPress hacks and preventing future breaches. My aim is to establish long-term relationships with my clients, serving as their trusted partner in maintaining a secure and resilient WordPress online presence.

Why Choose HackRepair.com for Your WordPress Website?

Why Select HackRepair.com for Your WordPress Website Needs?

At HackRepair.com, my team and I are dedicated to providing exceptional WordPress security services, including:

Personalized approach with direct communication and tailored WordPress solutions
Fast response times, often the same day, even for after-hours WordPress emergencies
Comprehensive knowledge of WordPress security, spanning preventive measures to post-incident recovery
Commitment to customer satisfaction, with calm and capable WordPress support to put clients at ease
Flat-rate transparent pricing for WordPress services, with no hidden charges
Extensive WordPress experience, with thousands of hacked WordPress websites repaired over 20+ years

I’m proud of the reputation I’ve earned in the WordPress community, with pages of 5-star reviews from satisfied customers across various platforms. On Trustpilot, customers consistently praise my ability to quickly and efficiently clean up their hacked WordPress sites. Many clients have also left glowing testimonials on the HackRepair website, expressing their gratitude for my friendly and proactive approach to WordPress security. Sitejabber is another platform where I’ve received numerous positive reviews, with clients commending my diligence in providing thorough, long-term WordPress security solutions. On Facebook, you’ll find even more 5-star reviews from satisfied customers who appreciate my calm and capable WordPress expertise in their time of need.

Watch a Short Video Describing this Article

Frequently Asked Questions (FAQ)

Do you offer any guarantees on your WordPress security services?

Yes, at HackRepair.com, we stand behind our work with a 100% satisfaction guarantee. If you’re unsatisfied with our WordPress security services, we’ll do everything possible to make it right. Additionally, we offer a 30-day warranty on our WordPress hack repair services, ensuring that your site remains clean and secure after we’ve completed our work.

What WordPress security services does HackRepair.com offer?

At HackRepair.com, we provide a comprehensive range of WordPress security services, including:

Emergency WordPress hack repair and malware removal
In-depth WordPress security audits and vulnerability assessments
WordPress malware scanning and monitoring
WordPress security hardening and prevention measures
WordPress security consulting and training
Ongoing WordPress maintenance and support

Can I call Jim Walker at HackRepair.com to discuss my WordPress security needs?

Absolutely! I welcome the opportunity to discuss your specific WordPress security needs and concerns. You can easily schedule a consultation with me by visiting our website at HackRepair.com or by calling me directly at (619) 479-6637. During the consultation, I will take the time to understand your WordPress setup, address any questions you may have, and provide personalized recommendations to ensure your WordPress site remains secure.

My Thoughts

Protecting your WordPress website from hacks requires a proactive approach and expert intervention when breaches occur. By choosing HackRepair for your WordPress security needs, you benefit from my decades of experience, personalized service, and dedication to securing your WordPress site.

For more information on how to secure and repair your hacked WordPress website call me directly at (619) 479-6637. Let my calm and capable WordPress expertise put your mind at ease and get your hacked WordPress website back on track quickly and reliably.

I hope you’ve appreciated this article. Before you move on, please consider buying me a cup of coffee as a thank you. It takes a good bit of time to put together helpful articles, not to mention the energy required to write when I’m not focused on helping people with their hacked websites or security concerns.

Thank you for caring!

Jim