Converting WordPress to SSL and setting up a CSP (Content Security Policy) does not prevent hacking. We will explain the reasons for this.
Why SSL (HTTPS) does not prevent hacking
SSL encrypts notifications between the web server and the user’s browser so that servers, WIFI, and other devices that mediate data transmission can read the contents of those communications and not know what data is being sent or received.
Incidentally, the following information is not protected even if SSL is used
(1) IP address of the destination
(2) Domain name (SNI) * The URL of the page being accessed and queries under the domain will be kept confidential.
(iii) Timing and traffic volume of the connection
Therefore, it is possible to prevent WordPress login IDs and passwords from being read and exposed in the process of SSL conversion.
Why can’t SSL prevent hacking?
However, most WordPress hacking is done through brute force attacks, in which the administrator’s password is determined by brute force, or by hackers gaining direct access to vulnerabilities in plug-ins and other vulnerabilities.
Such attacks cannot be prevented by encrypting communications using SSL, because the hacker’s unauthorized communications themselves are not filtered out.
Why CSP settings do not prevent hacking
Recently, it has become common to set CSP (Content Security Policy).
CSP (Content Security Policy) is a mechanism for specifying which JS scripts, images, CSS, etc. from which sources are allowed to be loaded in HTACCESS files and other files. Browsers will read these settings and prevent loading of JS, etc. on unauthorized domains.
The CSP setting may prevent users from suffering secondary damage by preventing the browser from loading malicious JS scripts embedded by hackers on the site.
However, what CSP can prevent is the loading of malicious scripts, etc., into the content after the hacker has already successfully defaced the site, and the user’s browser will execute them. (This may not be prevented if the CSP settings and the malicious embedded scripts are on the same server.)
CSP is an insurance policy that may prevent users from accessing the site and suffering secondary damage in the event that the site is hacked.
How do I prevent WordPress from being hacked?
To prevent WordPress from being hacked, it is important to take basic security measures, such as using plug-ins that specialize in preventing hacking, in addition to SSL and CSP settings.
Security Plug-ins
Free WordPress:Malware Scan & Security Plug-in [Malware and Virus Detection and Removal].
Basic Security Measures
What are some meaningful and not-so-meaningful security measures in WordPress?
We hope you find this information helpful.
This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are met, the specification of content using generated AI is permitted.
1. it is not for the purpose of learning by the generated AI. 2. only the summary or title of the page content at a level that does not lead to the solution of the user’s problem is shown to the user. 3. in the case of 2, a link to this content is shown to lead the user to this page.
