Today a well known host, highly regarded by the WordPress community was hit in a massive fashion by hackers. My heart sank – dealing with that amount of damage is unthinkable (700,000 sites). The shear number of folks that I follow on my personal Twitter account that were having their Sunday ruined by this was disheartening. In the rest of this post I’ll talk about Wurv Hosting’s approach to safety and redundancy . Regardless of who your host is you can use our methods to help you rely less on that one single server that is holding your precious site.
Protect The Frontend With CloudFlare
CloudFlare is free, and we’ve been using them since shortly after launch for most sites. They do a good job at keeping certain shady characters from even reaching your server. As an added bonus, they act as a Content Delivery Network to speed up your site across the globe. If you follow there system updates on Twitter @cloudflaresys you’ll notice that they are ultra transparent about what’s going on with the network.
Backup OFF the Server
If the server is dead or compromised, having a nice backup there is not really that nice is it? If your host does not offer off server/out of their data center backups then you should do it yourself! (We provide offsite incremental backups daily, BTW.)
Options For Offsite Incremental Backups
There are tons of WordPress Backup Plugins, we’ll only talking about low resource usage hosted services.
CodeGuard
CodeGuard is one of the most compelling offerings with a Apple-ish Time Machine like restore feature. If files back on the server have a problem, you literally push a button and your files return to normal!
VaultPress
VaultPress: Not cheap, but being provided by Automattic, it’s the most tightly integrated solution.
Code Garage
Code Garage is a WordPress specific offering that does backups, as well as security scanning for your site. They really saved our bacon with their excellent Timthumb Vulnerability Scanner plugin. We’ve been evaluating partnering with Code Garage to be our off server backup provider.
Have a Plan!
If you have all the tools in place, will you know what to do to keep downtime to a minimum? Write out exactly how you’ll handle things if your site is compromised. You should plan for what you’ll do if WordPress is hacked, and what to if the server is down or hacked as well.
Plan For:
- WordPress Hacks
- Server Hacks
- Server Down
- Hosting Issues
Why Wurv Hosting isn’t just hosting…
(And how we handle these issues.)
Who’s involved?
If you are a current client, or we’ve talked on Twitter, you might think that I’m the only one around here. I respond to most support requests and reach out to the public whenever possible. We are a small niche company, so I’m able to stay very involved with everyone. While I’d love to have the cash flow that 700,000 sites would bring us I love that I know every site on our network. The total number of sites we host is well under 1,000. Yes you read that right – we are very small – but it’s for a reason. Quality over quantity!
Who’s at the datacenter?
That’s what makes us unique. We don’t own any. We’ve partnered with some of the best network providers to bring your sites to life. This allows us to provide 24/7 support to keep the network going, while letting the rest of us focus on the added things that make us unique.
Everybody to the party!
All sites are setup with these things to keep you safe and quickly recoverable.
- Added to the CloudFlare network.
- Added to daily incremental offsite/cloud backups.
- Added to our updates dashboard so we can trigger WordPress core and plugin updates.
When we are attacked…
It’s a scary world, so it’s not IF attacked, it’s when.
WordPress Compromised
If WordPress is compromised we delete the site completely and restore from the latest backup. It’s off server so it will be a unaltered version of your site. We restore the database as well to make sure it’s clean.
Server Down
If you are on CloudFlare, no problem. CloudFlare will serve a copy of your site until we fix the issue. Zero Downtime.
Server Hacked
This is what happened today at the large host that was hit. In this case the server worked, but was serving a “you’ve been hacked” page. This is worse than just having a server down! In this scenario we would take the server offline so CloudFlare will begin to serve the cached version of your site.
In Closing…
We hope that this post will help you take measures to keep things safe and easily fixed. All in are there are 3 major things your site should have:
- A Great Webhost
- Front end protection/malware scanning.
- Offsite backups.