AOD Logo - home

  • (A)I Made This: What Could Go Wrong?

    (A)I Made This: What Could Go Wrong?

    I have been building WordPress themes for about 16 years now. I started with child themes, then builders, and then moved into custom development with Underscores. But I’ve never really delved (I think we can use this word again, right?) into plugin development. I taught myself to code in olden times, using BBEdit and Dreamweaver. I never picked up (nor was I interested in) build processes, React, tooling (gross). What I do know, and am interested in, is how the web is supposed to work for people: the conventions that we rely on, what makes an experience inclusive and accessible, and what a given use case technically requires versus opting for the shiniest solution.

    With the help of AI, those years of practical experience were all I needed to start building my own plugins, first with Claude and now with Studio. There have been small utilities I’ve wanted for various sites over the years, and usually the plugin I found in the WordPress Repository often felt like overkill (a multi-tool, plus an upsell!). With Studio’s AI agent, I’ve been able to build the simple, single-purpose versions myself: an accessible promotion banner that can display on specific pages and be dismissed, a small SVG shape generator for when a design needs to be less boxy, an admin utility that alerts me when a client’s domain is about to expire, so I can send a reminder before I get the “my site is broken!” email.

    I know what I want these tools to do, how I think they should do it, and what requirements to check for. Without AI, it is unlikely that I would have made it through the plugin-architecture learning curve on my own. I can do anything, but not everything, as David Allen might remind me.

    This is the positive outcome of what’s happening with AI right now. But the other side of this new capacity we all have is the tendency to get caught up in the machine’s momentum and accept what gets created at “It works! (P.S. I’m clearly a genius.)”

    (A)I Made This

    Someone recently shared a calendar tool a volunteer had built to embed on their website. It looked polished (if a tad Design By Claude). Attractive layout, categorized events, a clever interface. They’d built it with an AI agent platform, start to finish, without writing a line of code by hand. Impressive!

    I noted that font size was a bit small and then tried to tab through it with my keyboard.

    It didn’t work. No focus states, no logical tab order, interactive elements you couldn’t reach. A visitor using a screen reader or navigating without a mouse would have been locked out entirely. The client had been visually wowed and both they, and the volunteer, had no idea that what they had made was completely inaccessible. Not only did this person not write the code, they didn’t really have the code, not to debug, maintain, or explain. They had a working demo hosted within an app that they didn’t own.

    Making things is exciting

    Look, I know the thrill of making something work with your own bare hands. I don’t want to be the kind of elitist knowledge worker that says, “Only real developers can touch code”. The whole World Wide Web is founded on universal access. Making things means exploring, testing assumptions, screwing it up. That’s how we learn.

    For years, “this looks a little rough” was a decent proxy for “this was made by someone still learning, proceed with caution.” Sloppy code usually looked sloppy. But the clues that told us things weren’t working in the past are (almost) gone. What many AI tools produce is clean, conventional, reasonably well-structured code that works like magic.

    From convivial tool to … weapon of capitalism?

    For most of the twentieth century, things were built to be opened. You could pop the back off a radio, replace a tube, and figure out what was happening in there even if you weren’t the one who built it. Over time, that stopped being true.

    The Phoebus cartel famously agreed to cap lightbulb lifespans in the 1920s specifically to keep people buying replacements. Cars went from machines that a relatively handy person could tune up in their driveway to rolling computers that lock diagnostics behind proprietary tools. Farmers had to fight John Deere for the legal right to fix their own tractors, because the software wouldn’t let anyone but an authorized dealer touch it. The right-to-repair movement exists because manufacturers found that making things un-fixable was a durable business model.

    The philosopher Ivan Illich had a term for an alternative long before the advent of “smart” anything: a convivial tool, one people can understand, adjust, and repair themselves, versus an industrial tool that makes us dependent on someone else to keep it running. The internet of things pushed a lot of ordinary objects (thermostats, doorbells, light switches) into IP controlled territory. You don’t fix a smart lock. You wait for a firmware update, and hope the company still exists, or you replace the whole thing.

    The web was designed to be on the convivial side of that line. View source is right there in the browser. An entire generation of self-taught developers (Hello, world!) learned by looking at how other people’s pages worked, taking them apart, and making changes. That openness is why the web, like the printing press, was able to connect people and become a defining technological and cultural force.

    An AI-generated product you can’t read or maintain is problematic. In this case, it’s not that people sat down and decided to make plugins or apps un-fixable, but that’s a possible future when the barrier to producing drops at a speed well past comprehending what the heck you are doing.

    You may enjoy my article, “Harder, Better, Faster, Stronger: AI Anxiety Ain’t New“. Learn what “workism”, Lord Alfred Tennyson, and bananas have in common.

    Right now, a lot of AI tooling is priced like a loss leader. It’s cheap or free while companies fight for market share and habit formation. Once enough of us are building things we can’t maintain without the tool that built them, the pricing has room to move, and we won’t have much leverage. It’s not so different from the printer-and-cartridge model, or the appliance you can’t repair without the manufacturer’s proprietary part: the dependency is built in before anyone’s paying attention to what it’ll cost once we’re locked in.

    And I can’t leave this section without saying it: none of this is truly free or cheap. Every plugin an AI generates for you, every draft, every image — it’s not fluffy and weightless. It’s server farms, drinking water for cooling and burning power at a scale most of us never have to look at (yet). Read more about the energy use and climate footprint of big tech.

    With great power, comes great responsibility

    AI has genuinely expanded what a solo developer or a small in-house team can produce. That’s a tangible benefit, an objectively good thing. Someone with no coding background can now build a tool that solves a real life problem they have without a huge budget or a developer on staff.

    Between the eureka moment of “It works!” and understanding enough about how it works to be responsible for it, lies a world of complex unknowns.

    As I’ve said previously about web accessibility, ignorance of the law does not grant you immunity from its rules. Whether you are a developer, a volunteer, or a business owner — if you ship it to the public, you own it. Can your product or app be maintained by you, or is “ask the AI to fix it” the only path forward when something breaks? Does it work as intended for every visitor, not just the ones who are most like you? Does it meet whatever bar the project is held to — WCAG for a government or public-facing site, HIPAA-adjacent handling for a healthcare client, basic security hygiene for anything touching user data?

    Asking questions is still the strongest tool in your toolbelt

    This applies whether you’re evaluating a plugin from the WordPress repository or something you built yourself with an AI assistant. Before it goes live — especially in front of the public, or anywhere near sensitive data — ask:

    • Can someone here actually read and maintain this code? Can a genuine human on your team open the file, understand it, and change it without starting from scratch.
    • Has it been tested with a keyboard and a screen reader? Visual polish tells you nothing about whether it’s usable. Tab through it. Try it with a screen reader.
    • What happens when the person who built it moves on? If the answer is “no one else can touch it,” you don’t have a tool, you have a liability with a deadline.
    • Does it actually meet the compliance bar this project requires? A government contract, a healthcare client, an accessibility commitment — these aren’t optional extras layered on top of “does it work.” They’re part of what “done” means, and AI has no idea what your project’s specific obligations are unless someone tells it, checks its work, and keeps checking.

    These are the kinds of questions we ask ourselves as developers before shipping something. When AI makes it possible to sail past the friction of decision-making and still end up with something that looks finished, the burden is on us as creators to push back and do some due diligence.

    Featured image: A scene from ReBoot, an awesome Canadian animated series that was briefly on TV on Rochester, NY during my youth. Characters exist in the “mainframe,” a computer generated world, and had to keep the universe safe from the evil viruses known as Megabyte and Hexadecimal.

    Emily Rapport

    , ,

  • WordPress Updates: Why they Matter for Your Website Security

    WordPress Updates: Why they Matter for Your Website Security

    If you’re running a WordPress website for your business, you’ve probably noticed those update notifications that pop up in your dashboard. Maybe you’ve wondered if they’re really necessary, or if you can put them off until next month when things aren’t so busy.

    Keeping your WordPress site updated is one of the most important things you can do to protect your business online. Think of your WordPress site like your office building. You wouldn’t leave the back door unlocked overnight, right? Updates are like changing the locks when someone loses a key, or fixing a window that doesn’t latch properly. When you skip them, you’re leaving points of entry open for anyone who happens to walk by.

    WordPress security updates

    WordPress is open-source software, which means its code is public. This openness is a good thing. It means smart people are constantly checking for problems and suggesting improvements. Because testing and updates are frequent, and so many people are working to address issues, you can argue that open source is more secure than proprietary software, not less.

    When security researchers find a weakness, they report it so it can be fixed. WordPress releases an update to patch that hole. Once that fix becomes public, the weakness also becomes public. Bad actors may start looking for websites that haven’t updated yet to exploit the known security flaw.

    This is why you’ll sometimes see an update come through that WordPress marks as a security release. These updates should be made when released and most hosting companies make them automatically. If you site doesn’t update right away, check the automatic Wordpress update settings allowed on your web hosting account (where these can be found may vary by hosting provider). There is usually an option to allow minor security releases to auto-update. You can also choose to skip the major core version updates and do those manually.

    “But my site works fine, why risk breaking it?”

    This is probably the most common pushback I hear about updates. It makes sense on the surface. If your site is working, why mess with it?

    “Working” and “secure” aren’t the same thing. Your site can look and function just fine while having security holes that won’t be obvious until someone exploits them. By the time you know there’s a problem, the damage is done.

    Your smoke detector batteries might be dead, but you won’t know until there’s a fire. Updates are like testing those batteries monthly. Yes, climbing up on the ladder is a minor hassle. But it’s a lot easier than dealing with a fire.

    The risk of breaking something with an update exists, but it’s unusual unless your working with a lot of customization or plugin updates that may have “breaking changes”. Maintaining backups, and testing those backups, should be part of your update process. The risk of getting hacked because you didn’t update is real and the consequences are much worse and harder to fix.

    Updating WordPress manually: understanding what needs to stay current

    Your WordPress site has several parts that need regular updates:

    • WordPress core is the application. This is the basic software that makes everything run. The WordPress team releases updates regularly, including small maintenance releases and larger feature updates. The security team is particularly active, pay attention to those update notifications in your WordPress dashboard.
    • Your theme controls how your site looks and often adds features specific to your design. If you’re using a theme from a reputable commercial developer, they’ll release updates when WordPress changes in ways that affect themes, or when they find bugs and security issues. Watch out for WordPress themes from outside of the WordPress theme repository – these commercial themes often have plugins bundled within that theme that may also require licenses and updates and can impact the security of your website – Revolution Slider and WP Bakery are common bundled plugins that have had some issues in the past.
    • Plugins add extra functionality. Contact forms, galleries, SEO tools, backup systems, you name it. Support and quality varies widely here. We’ll talk about how to decide what plugins to add to your site in the next section.
    • PHP is the programming language that WordPress runs on. Your web host controls which version of PHP your site uses. This is often overlooked but critically important. Older PHP versions stop receiving security updates, just like old versions of WordPress. WordPress and many plugins will not be backwards compatible with older versions of WordPress – the minimum recommended version is 7.4 but you should try to get the most current, stable version if you can – 8.2 or 8.3 (as of the writing of this post).

    These parts all work together. Sometimes a WordPress core update changes something that affects how themes or plugins work. A responsible theme or plugin developer will test their product with new WordPress versions and release an update if needed. This is why you might see a theme update right after a major WordPress release, the developer is making sure everything stays compatible.

    How to tell if a plugin is still safe to use

    Not all plugins are maintained equally. Some developers abandon their plugins, stop responding to support requests, or just don’t have the bandwidth to maintain an open source plugin. Using an abandoned plugin is like installing a smoke detector with no way to change the batteries.

    • Last updated more than a year ago. Check the plugin’s page in your WordPress dashboard or on WordPress.org. If the last update was over a year ago, be cautious.
    • Not tested with recent WordPress versions. You’ll see a notice like “This plugin hasn’t been tested with the latest 3 major releases of WordPress.” This doesn’t automatically mean it’s broken, but it means the developer might not be actively maintaining it.
    • Lots of unresolved support questions. Look at the plugin’s support forum. If people are reporting problems and getting no response from the developer, that’s a red flag.

    If you’re using a plugin with these warning signs, start looking for a replacement. Don’t wait until it breaks or creates a security problem. Finding and testing a replacement while things are working is much less stressful than doing it in an emergency.

    What could break when you update (and why)

    Updates don’t usually break things, but when they do, it’s helpful to understand what went wrong:

    • Plugin conflicts happen when two plugins try to do something that conflicts with each other, or when a plugin update changes how it interacts with other plugins. This is more common on sites with lots of plugins.
    • Theme incompatibility occurs when WordPress adds new features or changes how things work, and your theme hasn’t been updated to match. This is why theme updates often follow WordPress core updates.
    • Custom code problems are tricky. If someone added custom code to your site (maybe in your theme’s functions file or a custom plugin), that code might rely on WordPress features that changed or were removed. This is the most frustrating type of break because it requires a developer to fix the custom code.
    • The white screen of death is what people call it when your site stops loading entirely and just shows a blank white screen. This usually happens when there’s a fatal PHP error. It sounds scary, but it’s fixable with access to your site’s files.
    • Memory limit issues can show up after updates if the new version of WordPress or a plugin needs more server memory than you have available. Your host can usually increase this.

    Most of these problems can be caught and fixed before they affect your live site if you’re testing updates properly.

    Automatic updates: when they help and when they don’t

    WordPress can update itself automatically. By default, it handles minor updates (like going from version 6.9 to 6.9.1) on its own. You can also enable automatic updates for major versions, themes, and plugins.

    When automatic updates make sense:

    • WordPress minor/security updates (usually safe to automate)
    • Simple sites with well-maintained, popular plugins
    • Sites where you have good backups and monitoring in place

    When to avoid automatic updates:

    • Sites with custom code or themes
    • Sites using plugins that often have compatibility issues
    • Sites where a few hours of downtime would cause serious problems
    • Major WordPress version updates (worth testing first)

    If you enable automatic updates, you still need monitoring. Set up alerts so you know when updates happen, and check your site afterward to make sure everything works.

    Test major core updates and plugin that warn of breaking changes on a staging site first.

    What does it mean to test an update? (staging sites explained)

    When I say “test updates on a staging site,” I mean creating a copy of your site where you can try things out without affecting your live site. This copy is called a staging site or development environment.

    You wouldn’t remodel your store while customers are shopping. You’d close for renovations, or at least work on a section at a time. A staging site is like having a complete copy of your store in a back room where you can test changes before customers see them.

    Many web hosts now include staging environments as part of their hosting plans. You click a button, they create a copy of your site, and you can update and test on that copy. If everything works, you push those changes to your live site. If something breaks, your live site wasn’t affected.

    Staging sites cost different amounts depending on your host. Some hosts include them free, others charge $5-20 extra per month. If your host doesn’t offer staging, a developer can set one up for you, though this may involve additional costs.

    For small business sites, staging is worth it if:

    • You have a complex site with business-critical plugins like WooCommerce
    • You have custom code or an older theme
    • Your site is critical to your business (you can’t afford downtime)
    • You’re several versions behind on updates and need to catch up

    For very simple sites with just a few well-maintained plugins, you might be okay with good backups and manual testing on your live site during off-hours.

    How to make a backup

    Before any update, you need a current backup.

    • Check if your host does automatic backups. Log into your hosting control panel and look for backup settings. Many hosts backup your site daily, but check:
      • How often they run
      • How long they keep them (30 days is good)
      • How to restore them if needed
    • If your host doesn’t backup, use a plugin. Free options like UpdraftPlus or BackWPup can create backups and save them to cloud storage like Google Drive or Dropbox. Install one, configure it to backup both your files and database, and set it to run at least weekly.
    • Test your backups occasionally. A backup you can’t restore is useless. Every few months, try restoring a backup to make sure the process works. Many people find out their backups are broken when they desperately need them.
    • Before updating, create a fresh backup manually. Don’t rely only on automatic backups. Create a new one right before you update, so you have a restore point from minutes ago, not days ago.

    If this all sounds complicated, it’s one of the main things a good maintenance plan handles for you.

    What to do when you can’t make an update

    Sometimes you’re stuck. Maybe a plugin update won’t work with your hosts PHP version or you have a custom coded site that might not be compatible with a major core release.

    • Make a plan to fix it. If you can’t update now, when can you? Put money in the budget for next quarter to rebuild that custom feature properly, or to migrate to a modern theme. Don’t let “I can’t update right now” turn into “I haven’t updated in three years.”
    • Consider a rebuild. Sometimes starting fresh costs less than trying to update a very old site. If your site is 5+ years old with an outdated theme and abandoned plugins, rebuilding with modern tools might be smarter than patching holes forever.

    Make sure you have some other security measures in place:

    • Use a web application firewall. Services like Cloudflare or Sucuri can block many attacks before they reach your site. This isn’t a substitute for updating, but it adds a layer of protection.
    • Lock down your login page. Use a security plugin to limit login attempts, require strong passwords, and enable two-factor authentication. Most attacks start by trying to guess your password. While we’re here, please use a password manager and don’t reuse your passwords.
    • Monitor activity. Use a service that watches for changes to your files or signs of compromise. The faster you catch a problem, the less damage it does.

    What to look for in a maintenance plan

    If you’re hiring someone to handle updates, a good maintenance plan should include:

    • Regular update schedule, not just when something breaks. Most professionals update sites weekly or bi-weekly for plugins and themes, and within 24-48 hours for WordPress security releases.
    • Testing before updates go live. Your maintenance provider should have a staging copy of your site where they can make sure the update doesn’t break anything. A good provider won’t just click “update all” and hope for the best.
    • Backups before changes. If an update does cause a problem, you want to be able to roll back to exactly how things were before.
    • Monitoring after updates. Sometimes problems don’t show up immediately. Your maintenance provider should check that your forms still work, your pages still load, and nothing looks broken.
    • Clear communication. You should get reports on what was updated and whether any issues came up. Radio silence isn’t good customer service.

    Ask potential providers these questions:

    • What happens if an update breaks something?
    • How quickly will you respond if my site goes down?
    • Do you test updates in staging first?
    • What’s included in your monitoring?
    • How do you handle PHP version updates?

    Warning signs: If someone offers maintenance for $10 a month, they’re probably just running automatic updates without testing or monitoring. If they can’t explain their process clearly, or if they say updates aren’t that important, find someone else.

    When updates are urgent (and when you have time)

    Not every update needs to happen immediately. A plugin that adds a new feature or fixes a minor display issue can usually wait a few days while you make sure the update won’t cause problems with your specific setup.

    Immediate updates recommended for:

    • WordPress security releases
    • Plugin updates marked as fixing security issues
    • Updates that patch actively exploited vulnerabilities (WordFence and PatchStack maintain a WordPress vulnerability database you can subscribe to.)

    Update within a week or two for:

    • WordPress major version releases
    • Theme updates (unless your theme is highly customized)
    • Plugin updates from reputable developers

    Can probably wait a bit, but don’t forget:

    • Feature additions
    • Minor bug fixes
    • Performance improvements

    The danger in waiting is that updates pile up. If you skip a few rounds, you might find yourself several versions behind. At that point, updating becomes riskier because you’re making bigger changes all at once. It’s easier to update from version 1.2 to 1.3 than to jump from 1.2 to 2.0.

    Taking action with less stress

    If you’re managing your own site, start small. Set aside 30 minutes once a week to log into your WordPress dashboard and check for updates. If you see a security update, make it happen that day. For other updates, you can take a bit more time to research if other users are reporting problems, but don’t let things pile up.

    Before you update anything, make sure you have a current backup. Check that your host’s backups are running, or set up a backup plugin if they’re not.

    If this sounds like too much extra work, hire a professional. Your time is valuable, and maintaining a website isn’t your main job. Finding a reliable professional to handle updates is usually less expensive than you’d think, often $50-100 per month depending on your site’s complexity, and far less expensive than recovering from a hack.

    Your website is often the first thing potential clients see when they look for your business. People judge your credibility partly on whether your site works well and looks professional. A hacked or broken site sends exactly the wrong message. Keeping WordPress updated is the simplest way to protect that investment.

    Resources:

    Emily Rapport

    ,

  • Welcome to the WWW: How to Avoid Phishing Emails, Fake Domain Renewals, & more!

    Welcome to the WWW: How to Avoid Phishing Emails, Fake Domain Renewals, & more!

    Online security tips for small business owners

    Email scams are common because they work. They cast a wide net, are easy to implement, and they exploit common fears like missing a domain expiration date or receiving a warning of a fraudulent charge. These emails usually include real logos, brand colors, and even the required unsubscribe footers that appear to link to a corporate headquarters. If you’ve ever hesitated over an email or felt uncertain about a renewal notice, trust your instincts.

    When scams succeed, the damage is real:

    • You could lose access to your website
    • Your domain could be transferred without your knowledge
    • Financial information could be stolen
    • Your email could be compromised, enabling further fraud

    If you’re not certain where your domain is registered or which services renew when, don’t panic. A little organization and an audit of your online security habits will help protect you from most threats. I’ll show you how to recognize the patterns and verify what’s real.

    Teach a scammer to phish

    Phishing emails and texts: the most common threat

    You’re likely inured to the well-known Nigerian Prince email requesting advance funds in exchange for a reward – but that just means scammers have become more sophisticated. Phishing emails trick you into revealing sensitive information or making fraudulent payments by impersonating real companies you do business with:

    • Domain registrars (GoDaddy, Namecheap, Google Domains)
    • Hosting providers (Bluehost, SiteGround, WP Engine)
    • Email services (Google Workspace, Microsoft 365)
    • Banks and payment processors

    Recognize the tells

    • Manufactured urgency – “Your account will be suspended in 24 hours” or “Immediate action required” are classic pressure tactics.
    • Mismatched sender addresses – The display name says “GoDaddy Support” but the email comes from [email protected]. Notice the missing “d”? That’s intentional.
    • Suspicious links – Hover over any link without clicking. If it doesn’t go to the official domain (like godaddy.com), it’s fake. Watch for variations like godaddy-renew-support.com or godaddy.secure-login.net.
    • Poor quality control – Legitimate companies proofread. Scammers often don’t. Look for odd spacing, grammatical errors, or inconsistent branding.
    • Unexpected attachments – Real service providers rarely require you to download files to verify your account.

    Recognize and avoid phishing attempts, via Consumer.FTC.gov.

    How to verify a suspicious email

    1. Check the full sender address — not just the display name
    2. Hover (don’t click!) over links — see where they actually go before clicking
    3. Log in manually — open a new browser tab and go directly to the official website
    4. Compare with previous emails — search your inbox for legitimate messages from that company
    5. Ask someone — your web designer, IT person, or a tech-savvy colleague

    What NOT to do:

    • Don’t click links in suspicious emails
    • Don’t reply to the message
    • Don’t call phone numbers listed in the email
    • Don’t download attachments
    • Don’t enter passwords or payment information from an email link

    If you aren’t sure, STOP. Verify through official channels.

    Timing matters: holiday email scams

    small business website security

    Scammers know when you’re distracted. Phishing attempts spike around major holidays -Thanksgiving, Christmas, New Year’s – when business owners are juggling personal commitments and may not scrutinize emails as carefully. They’re also aware of business cycles: end-of-quarter deadlines, tax season, and the chaos of Q4.

    An “urgent domain renewal” email that arrives December 23rd isn’t coincidence. Someone is betting you’ll click quickly to clear your inbox before heading out for the holidays. During busy periods, be extra skeptical of anything demanding immediate action.

    Fake domain renewal notices (including physical mail)

    Phishing doesn’t stop at your inbox. Scammers still use postal mail, and these letters can be remarkably convincing. I’ve received official-looking notices with urgent language like “Final Notice” and “Domain Expiration Warning,” complete with professional formatting and what appears to be an invoice.

    These letters are designed to look like legitimate renewal notices. But read the fine print. Often they are authorizing a domain transfer, not a renewal. Pay their “invoice” and you’ve just agreed to move your domain to their registrar, often at inflated prices with auto-renewal you can’t easily cancel.

    How to protect your website and your business from fake renewal scams

    • Know your registrar Where is your domain actually registered? GoDaddy? Namecheap? Squarespace? If you’re not sure, look it up at ICANN’s domain lookup tool.
    • Log in directly Don’t trust renewal dates in emails or letters. Sign into your actual registrar account and check there.
    • Ignore unfamiliar companies If you’ve never heard of them, you don’t do business with them.
    • Enable auto-renewal Most registrars offer this. It prevents your domain from accidentally expiring while eliminating the pressure tactics scammers rely on.
    small business website security

    This phishing tactic targets website owners with fake copyright infringement claims. These emails claim you’ve used an image without permission and demand immediate payment or proof of licensing.

    A client received an official-looking email from “COPYTRACK” alleging unauthorized use of an image on their website. The email stated the image belonged to a photographer (with a legitimate-sounding name) and demanded proof of license or a settlement payment. Luckily, they recognized it as a phishing attempt.

    The email may include:

    • Professional formatting and legal language
    • Specific image filenames or URLs from your actual website
    • A deadline creating pressure
    • Settlement amounts ranging from hundreds to thousands of dollars

    Many business owners can’t immediately recall the source of every image on their website, especially if someone else built the site or if it’s been around for years.

    Real copyright enforcement happens, but scammers imitate the process. Here’s how to tell the difference:

    1. Don’t panic or pay immediately — legitimate copyright claims follow a formal legal process, not email demands with tight deadlines
    2. Research the company — search for “[company name] + scam” to see if others have reported it
    3. Verify the image claim — use reverse image search (Google Images) to check the image’s actual source and licensing
    4. Check your image sources — if you purchased the image from a stock photo site, locate your receipt or download history
    5. Consult a lawyer — if you believe the claim might be legitimate, speak with an attorney before responding or paying anything
    • Demands for immediate payment via email
    • Threats of lawsuits with unrealistic timelines
    • Requests to pay directly to individuals rather than through legal processes
    • No official legal letterhead or case numbers
    • Pressure to settle before “lawyers get involved”

    If you receive a copyright claim and aren’t certain about your image licensing, reach out to your web designer or the person who built your site. They should be able to help you trace where images came from and whether you have proper licensing.

    small business website security

    Security best practices

    Keep records organized

    Maintain a simple document (offline) or password manager entry with:

    • Domain registrar name and login
    • Hosting provider and login
    • Email/workspace provider
    • Renewal dates for each service
    • Official support contact information

    Important: If you’re keeping this information in a document (rather than a password manager), store it offline. Keep it in a physical notebook, a printed document in a secure location, or on an external drive that’s not connected to your computer. If your computer is compromised, any document saved on it, including password lists, can be accessed by attackers.

    Using a password manager is absolutely critical these days (see FAQ below). It includes end-to-end encryption and storage in an encrypted data vault. Only YOU have the master password to this vault, which acts as your decrypt key. This is not stored anywhere. Password managers also notify you of data breaches and allow you to bulk change login details. Saving passwords to your browser does not secure your password and should be avoided.

    Use multi-factor authentication

    You may think this is a pain to do. Yes, it is another step – but it’s the lesser evil here. What’s worse: a teeny, tiny extra step to secure your access or dealing with ransomware that has hijacked your entire device? Enable 2FA for domain registrar, hosting, and email accounts. Even if someone gets your password, they can’t access your account without the second factor. Most services support authenticator apps like Google Authenticator, Authy, or the built-in authenticators in password managers like 1Password and Bitwarden.

    Back it up!

    Backups aren’t just for web developers. If things do go south, you need a way to recover. Use Time Machine if you’re on Mac, or a third-party backup service like Backblaze, Carbonite, or IDrive. Regular backups mean that even if your website is compromised, you can restore it without paying ransom or losing years of work.

    You can also find more resources about securing your online presence at FTC.gov: https://consumer.ftc.gov/search-terms/cyber-security

    Frequently Asked Questions

    Should I click on the links?

    Absolutely not. Never click links in suspicious emails.

    If you receive an email that might be legitimate but you’re not sure, here’s what to do instead:

    – Open a new browser tab
    – Type the company’s official website address directly (like godaddy.com or bluehost.com)
    – Log into your account there
    – Check your account dashboard for any real notifications or issues

    If there’s a genuine problem with your account, you’ll see it when you log in directly. The email link is never necessary and clicking it when it’s a phishing attempt can:

    – Install malware on your computer
    – Take you to a fake login page that steals your password
    – Track that your email address is active (leading to more spam)
    – Start a download you didn’t intend

    When in doubt, never click. Go directly to the source instead.

    How do I know if an email is spam or legitimate?

    Check three things: the sender’s actual email address (not just the display name), where links go when you hover over them, and whether the message creates artificial urgency. Legitimate companies don’t threaten to suspend your account in 24 hours. When in doubt, don’t click anything in the email—go directly to the company’s website and log in there. If there’s a real issue, you’ll see it in your account dashboard.

    What should I do if I think I clicked a phishing link?

    Change your password immediately for any account that might be affected. If you entered payment information, contact your bank or credit card company. Enable multi-factor authentication if you haven’t already. Monitor your accounts closely for the next few weeks. If the phishing attempt targeted your domain or hosting account, contact your provider’s support team directly and let them know what happened.

    Run a full virus scan immediately. If you’re on Windows, use Windows Defender (built-in) or other antivirus software. Mac users also need antivirus protection! I recommend Bitdefender but there are other security options too. Don’t assume you’re safe just because nothing seems wrong. Malware often runs silently in the background.

    After scanning, change passwords for important accounts from a different device if possible, or at minimum after confirming your computer is clean. If you downloaded and opened an attachment, disconnect from the internet until you’ve completed a scan.


    How can I check if my email has been compromised?

    Visit haveibeenpwned.com and enter your email address. This free service checks if your email appeared in any known data breaches. If it has, change your password immediately. And change it on any other accounts where you used the same password. This is why password managers and unique passwords for each account matter.

    Cybercriminals often obtain email addresses through data breaches, public sources, or purchased databases.

    If your email shows up in multiple breaches or you’re concerned about your personal information being widely available online, consider using a data removal service like DeleteMe or Incogni. These services scan data broker sites (the companies that collect and sell your personal information) and submit removal requests on your behalf. While they can’t remove everything, they significantly reduce your digital footprint and make it harder for scammers to target you with personalized phishing attempts. These services typically cost $100-200 per year and handle the tedious work of contacting dozens of data broker sites.

    Keep in mind: data removal services focus on legal data brokers, not the dark web or illegal data dumps. They’re preventive tools that reduce your exposure to future scams, not emergency response for active fraud.

    Should I report spam and phishing emails?

    Yes. Most email services have a “Report Spam” or “Report Phishing” button. Using it helps improve filters for everyone. Learn more about how to protect yourself and report phishing emails to the Federal Trade Commission at ReportFraud.ftc.gov or report them at [email protected] (an address used by the Anti-Phishing Working Group). If the email impersonates a specific company (like your hosting provider), forward it to their abuse or security team, most have a dedicated address for reporting phishing attempts.

    If you got a phishing text message, forward it to SPAM (7726).

    What’s the difference between a domain registrar and a hosting provider?

    Your domain registrar is where you registered your domain name (like GoDaddy or Namecheap). Your hosting provider is where your website files actually live (like Bluehost or SiteGround). Sometimes they’re the same company, but often they’re not. Scammers exploit this confusion by sending fake renewal notices that mix up these services. Knowing which company handles what makes suspicious emails easier to spot.

    How often should I check my domain and hosting renewal dates?

    Check at least twice a year, and always enable auto-renewal with a valid payment method. Most registrars send legitimate renewal reminders 30-60 days before expiration. If you suddenly get a “final notice” for a domain that isn’t expiring for months, it’s almost certainly a scam.

    Should I use a password manager?

    Yes. Password managers are one of the most effective security tools available, and they’re easier to use than trying to remember dozens of passwords. They generate strong, unique passwords for every account and store them securely. Popular options include 1Password, Bitwarden, and Dashlane.

    If you reuse the same password across multiple sites and one of those sites gets breached, scammers can use that password to access your other accounts. A password manager solves this by creating a different complex password for each site—passwords you’ll never need to remember or type.

    Most password managers also store other sensitive information securely (credit cards, secure notes, software licenses) and can alert you if any of your passwords appear in known data breaches. Many of these services have free versions or a small annual cost – well worth it for the security and convenience.

    How do I secure my WiFi network?

    I’m so glad you asked! An unsecured WiFi network is an open door for attackers who can intercept your data, access your devices, or use your connection for illegal activity.

    Start with these basics: change your router’s default admin password (never leave it as “admin/admin”), use WPA3 encryption (or WPA2 if your router doesn’t support WPA3), and create a strong WiFi password that’s at least 12 characters long.

    Don’t broadcast your network name to neighbors. You can hide your SSID in your router settings. If you work from home or handle sensitive business information, consider setting up a separate guest network for visitors so they’re not on the same network as your business devices. Finally, keep your router’s firmware updated. Manufacturers release security patches regularly, and outdated firmware is a common vulnerability.

    If you’re not comfortable accessing your router settings, your internet service provider can often help you configure these security measures.

    Protection starts with preparation

    Where there is opportunity, there will be exploitation. Learn the patterns scammers use, keep your accounts organized, and pause when something feels threatening or demands immediate action.

    An ounce of prevention is worth a pound of cure:

    • Antivirus software (Windows Defender, Malwarebytes)
    • Password manager (1Password, Bitwarden, Dashlane)
    • Multi-factor authentication on critical accounts
    • Auto-renewal on domains to eliminate expiration pressure
    • Backup your data

    Security is about creating barriers to entry, making yourself enough of a challenge that scammers move on to easier targets. With these practices in place, you’re no longer low-hanging fruit.

    If you aren’t sure about a renewal notice, need to sort out your domain and hosting accounts, or need help implementing security practices, reach out.

    Emily Rapport

    ,

  • You Don’t Need Social Media, Social Media Needs You

    You Don’t Need Social Media, Social Media Needs You

    You’ve probably heard that social media is essential for business success. Mantras like “Social media is free marketing” or “If you’re not on social, you don’t exist” have acquired the common familiarity of truthiness1.

    Marketing (and SEO) myths persist partly because confident proclamations tend to be louder than nuanced analysis, and ‘you must be on social media’ sounds more authoritative than ‘it depends on your specific situation.’

    Think about what people are doing on Facebook today. They’re keeping up with their friends and family, but they’re also building an image and identity for themselves, which in a sense is their brand. They’re connecting with the audience that they want to connect to. It’s almost a disadvantage if you’re not on it now.

    Mark Zuckerberg

    We may have a president who is a horrible person, live on a planet ready to eviscerate itself like a sea cucumber, all while eagerly embracing the tools of our oppressor in a rapidly unfolding AI hellscape, but we do still have free will, damn it. People have been “connecting with their audience” and building relationships long before Facebook2 existed: through phone calls, letters, face-to-face meetings, hollering, and countless other means. The real connector isn’t Facebook. It’s you. Your relationships, your expertise, your service, your authentic presence in the world. A platform doesn’t create connections, people do.

    So, why this FOMO-driven pressure to embrace social media in order to become a more successful business? Successful businesses may be on social media, but that doesn’t mean social media made them successful. Marketing agencies sell social media services. Social media sells your data. Without businesses and users creating posts, sharing updates, and engaging on their platforms, these companies don’t make any money. Every piece of content you create is unpaid labor that generates billions in ad revenue for them.

    More insidiously, these platforms encourage us to think from the outside-in. If we accept the malformed notion that we are ‘brands’ performing for an audience instead of people exploring what genuinely matters to us, we feel compelled to produce content for external validation rather than pursuing our deeper human interests and questions. This addiction to external metrics (likes, shares, comments) disconnects us from our authentic selves and the meaningful relationships that actually sustain a business and our own mental health.

    Businesses can thrive without Meta platforms like Facebook and Instagram, or X (formerly Twitter). Remember, you own your content. Aligning your marketing with your values can only create stronger, more sustainable connections with your audience in the real world.

    The always on myth of social media

    The pressure we feel to “be everywhere” is an intentional, designed aspect of social media. In reality, the majority of sales and lasting customer relationships for small businesses come from owned channels3: your website, email marketing, word-of-mouth referrals, and direct engagement.

    While social media can surface your business to new audiences, the perceived risk of leaving may be much greater than any actual business impact. My point isn’t that everyone should quit social media immediately. Rather, we can approach these platforms as consumers making informed choices instead of people standing in line at a grocery store that only sells one brand of canned meat.

    Are your social media followers becoming customers? Or are you spending hours creating content that gets lost in the infinite scroll?

    The ethical case for conscious platform choices

    Beyond business metrics, there’s a deeper question: Do you want your business to support platforms that don’t share your values?

    Platform ethics

    The concept of ‘platform ethics’ is something of an oxymoron. These are corporations designed to maximize profit, not moral entities (ie. people) with genuine ethical frameworks. Meta, parent company of Facebook and Instagram, has recently faced significant scrutiny for allowing AI chatbots to engage in inappropriate conversations with children, with internal guidelines that permitted “romantic or sensual” interactions with minors. This policy was approved by Meta’s legal, engineering, and ethics teams before being quietly removed following media exposure.

    Similarly, X has seen significant content moderation challenges since Elon Musk’s takeover. Research found that X “fails to act on 99% of hate posted by Twitter Blue subscribers,” with only 1 out of 100 reported hate speech posts being removed after four days.

    Platforms like X, Facebook, TikTok, et al. also use AI-driven algorithms that can perpetuate bias, amplify misleading information, and manipulate user behavior. In a capitalist society, the consumer is the product, and the prioritization of engagement and profits over user wellbeing is not wholly surprising. But, it is still a little bit disappointing.

    What this means for your business

    When you create content for social platforms, you’re not just building your audience. You’re also contributing to systems that may conflict with your values. For therapists focused on mental health, artists creating meaningful work, or retailers building trust-based relationships, this misalignment can be particularly troubling.

    “Does social media work for my business?” isn’t the right question. On deeper analysis we should be asking ourselves, “Do I want to build my business on a foundation I don’t believe in?”

    “But what about my followers?”

    social media

    This is often the biggest concern when considering stepping back from social media. You’ve spent time building an audience, won’t you lose all that effort?

    If you do have thousands of followers, that’s YOUR audience. They’re following YOU, not the platform. Consider what a difference it would make if you directed that cultural influence toward channels you can control and/or aren’t actively amoral. Think of changing platforms like a little Spring Clean; you’ll lose some bots (and maybe some real followers) but you can start fresh and align your presence with platforms that don’t promote a toxic stew of ignorance.

    Self-assessment selfie

    73% of small businesses worldwide aren’t sure their current marketing strategy is working.4

    Are you actually getting meaningful engagement right now? If you have 500 followers and get 2 likes per post, what are you gaining from that platform?

    If your posts regularly get few likes, minimal comments, and rarely convert to actual business inquiries, you’re already not reaching your audience there. Your time as a small business owner is one of your most valuable assets. Spending hours crafting social media content that reaches a handful of people and generates zero sales is a poor ROI.

    Please, like me

    You might have 1,000 followers but only consistently reach 30 – 50 people per post. Meanwhile, an email list of 200 engaged subscribers can generate more in actual business.

    • 2025 marketing benchmarks show average email marketing conversion rates for B2C hovering between 2.8% and 8%, depending on industry and campaign quality. Social media conversion rates are generally lower, often around 1–3% on average.
    • Email beats social and paid ads yielding an average ROI of $36 for every $1 spent, compared to $2.80 for social media.
    • 72% of consumers prefer to receive branded communications by email versus only 17% via social media.

    Remember when you learned as a child that your real friends will like you for who you are? The people who value your work will find other ways to stay connected when you provide clear alternatives:

    • Announcing your transition: Let your current audience know where they can find you (your website, email list, alternative platforms)
    • Offering incentives: Provide exclusive content or resources to encourage people to join your email list
    • Maintaining relationships: The connections that matter most—your actual customers and genuine supporters—will follow you to platforms that better serve both of you

    Your website as a source of truth

    Owned channels (website, email, direct messaging) provide brands far greater control over content, customer journey, and engagement than paid or social media platforms. Unlike social media posts, your website content:

    • Builds SEO value over time
    • Provides complete control over user experience
    • Creates a professional, trustworthy presence
    • Serves as a comprehensive resource for your audience

    Email marketing

    Email newsletters create direct, personal relationships with people who actively chose to hear from you. This owned channel is:

    • Less vulnerable to external platform changes
    • More reliable for reaching your actual audience
    • Ideal for nurturing long-term customer relationships
    • Measurable and controllable

    Good, ol’ website content

    Blog posts, resources, and educational content on your own site build authority and attract customers through search engines. Well-structured content on your own site, like detailed FAQs, how-to guides, and comprehensive resource pages, becomes increasingly valuable as AI search tools like ChatGPT and Google’s AI overviews pull from authoritative sources to answer user questions. When your content is properly organized and answers real questions your audience has, it positions you as the expert source that AI systems reference and recommend.

    Social platform alternatives

    Decentralized platforms

    Unlike Meta or X, which can change algorithms, policies, or even shut down overnight based on corporate decisions, decentralized platforms distribute control across multiple servers and communities. This means your content isn’t sold for ads, more transparent governance, and the ability to maintain your connections even if one server goes down.

    • Mastodon offers open-source, decentralized social networking focused on authentic conversations without ad-driven algorithms.
    • Bluesky provides a user-friendly alternative designed around user control and data ownership.

    Creative networks

    • Tumblr touts itself as a creative haven for artists and writers, with less platform interference and more “old internet energy”, although moderation continues to be a challenge.

    Authority-building platforms

    • LinkedIn allows you to publish longer-form articles that can establish professional authority, and can provide meaningful professional connections for service-based businesses, especially when used for genuine networking rather than constant posting.
    • Reddit communities offer opportunities to share expertise and build credibility in niche areas through genuine participation.

    Local and direct engagement

    Networking events, partnerships with complementary businesses, and community involvement often generate more qualified leads than social media ever could.

    The medium is the message and the message is YOU

    Is there an authenticity cap on social media and brand interactions with people or are corporations corporeal enough for audiences to suspend their disbelief?

    In the 1964 publication “Understanding Media: The Extensions of Man,” communication theorist Marshall McLuhan describes the “content” of a medium as a juicy piece of meat carried by the burglar to distract the watchdog of the mind. The medium itself shapes and controls “the scale and form of human association and action”.

    What does your audience need and want from a business like yours? I would suggest that it’s not being on brand that appeals but the personal, authentic, and useful expertise you have to share.

    As individuals and small businesses we have much more flexibility to respond directly to client needs and adapt to trends. We are in an excellent position to gain a local advantage through social networking if we take the time to cultivate our readers5.

    Podcasts, YouTube channels, email newsletters, and your own blog let you cultivate audiences without the accessibility, permanence, and visibility problems that come with creating content for platforms you don’t own. Your blog post from 2019 is still findable and useful; your Facebook post from 2019 is buried in an algorithmic graveyard.

    Alternative platforms can help you connect with audiences and demonstrate expertise, but they still don’t replace building authority on your own domain where you have complete control. I’m not just saying this because I build websites. I say this as a content creator who believes in the intellectual copyright I have on my own work. When you post your ideas or art to social media, you’re essentially leasing that away. You are giving platforms the right to use, modify, and profit from your work6 while hoping their algorithm decides to show it to (the right) someone.

    Case study: me

    As someone who helps businesses build their online presence, I made some of these changes myself in 2024. I closed my X/Twitter account and, while I initially missed some professional connections, I quickly found them, and often better interactions, on LinkedIn, BlueSky and in Slack communities.

    Leaving Facebook was an easy decision. Despite maintaining a business page there for years, no one interacted with my content except my mom (thanks Mom!).

    I still have Instagram because it connects me with other artists and arts professionals. I’ll be exploring Tumblr to see if I can build a similar creative community on a platform with less problematic roots.

    Did leaving those platforms result in a drying up of new business leads? Nope. I’m more focused on the channels that actually work and enjoying writing articles again. Bonus: I am wasting less time scrolling through ads that target me as a woman of a certain age.

    There’s a whole world outside that walled garden

    Consider where you want to spend your time and who you are spending it with.

    1. Dip a toe in. Pause a social media account for one month. See if it impacts your business in any meaningful way.
    2. Audit your current results. Which platforms actually drive business? Which align with your values?
    3. Invest in owned channels. Strengthen your website, start an email list, create useful, original content you control.
    4. Test alternative platforms. Try engaging in niche communities or values-aligned networks relevant to your industry.

    As your owned channels grow, you can step back from platforms that don’t serve you.

    You’re the fuel, not just the feed

    As you consider your social media channels and whether they’re actually benefiting your business, invest that same critical thought into your website and email marketing. These two channels belong to you and will benefit from your care and attention.

    1. Truthiness is a term coined by Stephen Colbert to mean something that is believed to be true because it sounds accurate, not due to any evidence. Synonyms: ignorant assertion, bald-faced lies. ↩︎
    2. Which, let’s not forget, was created to rate the attractiveness of classmates and quickly pivoted to become a “student directory” when it received criticism. ↩︎
    3. “Having an established web presence correlates to higher revenue businesses: 66% of businesses with no website have revenues of $100,000 or less; of businesses with a website, 45% have revenues of $100,000 or less.” – Small Business Majority, 2023 Report ↩︎
    4. Resilience and Adaptability: The SMB Marketing Playbook for 2025 ↩︎
    5. Readers being an audience that is actively engaged vs a follower who is a passive consumer. ↩︎
    6. Meta’s financial success relies almost entirely on user-generated content to keep people engaged, gather behavioral data, and sell targeted advertising at massive scale. Their business model turns every user’s post, like, and interaction into valuable ad inventory, resulting in well over $100 billion of annual revenue purely from ads placed around content people create for free. ↩︎

    Emily Rapport

    , ,

  • The Panama Papers & WordPress Plugin Security

    The Panama Papers & WordPress Plugin Security

    Well, I’ll just leave my keys in the car door tonight. They’re so heavy and jangly. Carrying things is hard.

    Someone

    It’s a Big, Bad, World Wide Web. Is Your Website Secure?

    The absurdity of the above example is not that different from complaining that your password is too hard to remember or hosting a bunch of inactive, outdated plugins on your WordPress site. When it comes to the security of your website, it’s definitely worth the time spent to fortify its defenses.

    And, hey, guess what? Trying to remember all of your unique, strong passwords is impossible! Scrap that password spreadsheet you keep on your computer (which, if hacked, becomes a liability) and use a password manager to safely generate, store, and share strong passwords.

    How The Panama Papers Leak Affects You

    Some list confirming that a bunch of world leaders and celebrities have secret stashes of untaxed money shouldn’t exactly concern you on a personal level, right?

    Well…

    The vulnerability that led to the largest data leak of all time actually stems from something we all use regularly, whether you’re a business owner, developer, or a consumer — Wordpress. It’s almost difficult to believe, but a widely-used plugin just so happened to spark the collapse of …well, the entire world. (Or, at least, it has definitely changed how the global public handles its leaders and the rest of the 1%.)

    Let’s review how a failure to update a WordPress plugin very quickly turned into a worst-case scenario and PR nightmare for Mossack Fonseca, a Panamanian law firm that is known to be, wait for it… a “leading global provider for legal and trust services.”

    Last week, WordFence, a software engineering team and makers of the Wordfence WordPress Security plugin, broke the story of a massive Mossack Fonseca breach, citing a vulnerability in the firm’s version of the Revolution Slider plugin.

    That particular vulnerability was actually old news; the exploit was published in September of 2014 and the Revolution Slider plugin had since been patched and updated multiple times.

    Many commercial WordPress themes come bundled with Revolution Slider and other cool plugins. These themes generally require a renewal payment every 6-to-12 months to maintain access to updates and support. But, if your web developer doesn’t hang around to keep your site updated, or worse, installs a theme that THEY purchased and own the license to, you could have a problem down the road.

    Top 5 Reasons Web Sites Get Hacked

    Many website owners may not even be aware that they are hosting similar vulnerabilities simply by not maintaining their website frameworks, plugins, themes, browsers, and operating systems. Yes, that’s right — even browsers and operating systems.

    #1) Failure to Update

    WordPress.org and its community of developers all agree that failure to update is the leading cause of hacked sites.

    In a quick follow-up article to the Mossack Fonseca breach, WordFence described how the Panama Papers debacle was likely a lateral move for the hackers, explaining: “Once you gain access to a WordPress website, you can view the contents of wp-config.php which stores the WordPress database credentials in clear text. The attacker would have used this to access the database.”

    By hosting known vulnerabilities you’ve essentially given away the keys to your car, left your address on the dash, your apartment door wide open, and your bank card and pin number under a plate of cookies in the kitchen. Thanks!

    Hackers aren’t sitting around trying to guess YOUR password as Matrix code cascades across several monitors. The majority of attacks are automated and impersonal. Their aim is to identify easy access points (known vulnerabilities) that offer the greatest ROI.

    Secure your site to protect not only your information, but that of your customers and business partners, too.

    If you site is compromised, other plugins that you might be using, like the popular WP SMTP Mail (which gives you the ability to send mail from your website via a mail server), can now also be accessed and reveal not only your email and password but also provide hackers access to everyone in your address book.

    To see just how prevalent this is, you can view a cool animation of real-time attacks on the WordFence website, which shows a mere 4% of the 10,963 attacks happening per minute.

    #2) Cheap, Insecure Web Hosting

    If you are in business, invest in your infrastructure. You can pay $25/month for WordPress managed hosting.

    This is not just about your data, it is also about your clients’ and customers’ information. If you are building a site with WordPress, look for managed WordPress hosting like WPengine or SiteGround. Read this article by Joost DeValk about recommended web hosts for WordPress websites.

    While you are at it, secure your site with HTTPS://. Most web hosting companies provide free auto-ssl certificates these days. Google prefers it and it is part of a larger HTTPS Everywhere movement to make the web more secure.

    #3) Your .htaccess Permissions Are Set to Read/Write All

    Lock down your file permissions. Folders like /wp-admin and /wp-includes should not be writable by anyone but you. You can do this in your .htaccess file and there are also some good WordPress plugin solutions that can also do the job.

    More information about hardening WordPress can be found in the WordPress codex.

    If you wouldn’t make copies of your house keys for everyone on your block, why would you want to give everyone who uses your website Administrator level access?

    Hacking is most often an exploit of ease and opportunity. The more Administrators you have, the more possible points of access to your website or other accounts.

    Understand who needs what privilege when it comes to doling out the editing and content creation roles. And, please don’t email your login information. Email is not secure. Try sharing access with a tool like LastPass.

    Have an internet safety process in place. Make sure that people with access to sensitive accounts aren’t using free WIFI connections or sharing their unique logins with others. Use a secure, modern browser (like Chrome, Firefox, or Safari) and make sure that you have some type of anti-virus protection installed on your computer as well as a separate backup method. Don’t rely on time machine alone.

    #5) Using Default Usernames and/or Weak or Duplicate Passwords

    Everyone knows this now, right? The default username in WordPress is “admin”. Don’t use the default username on your WordPress site.

    • An 8-character password can be cracked in less than an hour.
    • Use a passphrase instead of a password.
    • Use a password manager and make sure you have unique passwords for your online accounts.

    WordPress does use strong passwords by default, but people still like to simplify their lives and create passwords that are easy to remember. 2-factor authentication is recommended if you can get people to activate it.

    Do’s and Don’ts

    • Do not store passwords in your BROWSER. If you lose your computer, you also lose your passwords. If your computer gets hacked, your Keychain Access is EVERYONE’S Keychain Access.
    • Email is not secure. Do not share logins or other sensitive data via email. If you sign up for LastPass (it’s free by the way) you can share passwords with other LastPass users without revealing your login. Then, remove access when your collaboration is over.
    • Use unique, randomized passwords. Always.

    Ignorance may be bliss but it’s not a website maintenance plan

    If you are part of a large organization, maybe you inherited a system that has seen many makers and is now too convoluted to update without breaking needed functionality. Or, you are a lone business person just trying to find time to add a new blog post and are waiting until you can afford a site redesign to make updates.

    Unfortunately, “not knowing” is not a defense against malicious attacks or exploits. Just like owning a car, we may not understand exactly how everything works, but we do accept a basic awareness and responsibility for its use and maintenance. As website owners, and daily users of technology, we would be wise to note that the probability of attacks increase in direct proportion to the popularity and market share of the given product.

    WordPress and your “virus-proof (not!)” Mac are glowing red targets because of their ease of use and popularity with consumers. That doesn’t make them bad technology solutions. In fact, open source applications like WordPress benefit from having an active community of dedicated programmers constantly finding bugs and patching them. It just means you have to be proactive.

    Although exploits in the wild WWW will always exist, the best practices outlined above are mostly common-sense and really don’t change at all when it comes to securing your website and online accounts. This doesn’t mean that you will never suffer a hack or data-loss, but awareness and good online habits in the areas that you do have control over will make you a less-likely target.

    Don’t assume that your web developer (or your best buddy who’s building your website for free) is taking care of the site’s maintenance and security. Take ownership of your technology. Ask your developer, “Will you maintain my website security once my site is launched and what best practices have you put in place?”

    Need help with your WordPress website? Ask me about affordable WordPress maintenance services.

    Further reading

    The following links can help you learn about site security and take action to strengthen your site’s defenses:

    Emily Rapport

    , ,