• Skip to primary navigation
  • Skip to main content

Managed WordPress Security for Pennies a Day. Call (619) 479-6637

Managed WordPress Security with Heart

MENUMENU
  • Why HackGuard.com? Why Choose HackGuard.com?
  • HackGuard.com WordPress Managed Services Rates WordPress Managed Services Rates
  • HackGuard.com Articles HackGuard Articles Library
    • Hack Guard Customer Testimonials
    • Top 20 WordPress Plugins to Avoid
    • Why Should I Maintain My Own WordPress Website’s Backups?
    • How to Improve Junk Email Filtering at Gmail
    • WordPress 6.0.3 Security Release – Updated?
    • About that “Weekly jQuery Migrate Status Update” email
    • How to Change a WordPress User from Subscriber to Administrator Role
    • WordPress 4.9.3 – Going into the tunnel and never coming out…
    • How Do I Migrate WordPress to a Different Domain Name?
    • Community Blogging: A Short Guide
    • WordPress Troubleshooting and How to Fix WordPress Errors
    • Is My Web Host Secure? Maybe not…
    • How to remove the subdirectory name from your WordPress website address
    • How can I improve the performance of my WordPress website?
    • How can I improve the performance of my WordPress blog (Part 2)
    • Protecting WordPress Against Brute Force Attacks
    • How do I reset my WordPress password?
    • How To Clear Cron Jobs in WordPress
    • xmlrpc.php and Pingbacks and Denial of Service Attacks, Oh My!
    • Free Website Monitoring Services, well, mostly free...
    • How to choose a secure web hosting company for a WordPress website
    • WordPress 404 Page Setup - Do You Have Five Minutes?
    • Can mod_pagespeed Improve Page Load Speed (external link)?
    • Yoast WordPress SEO Settings and Recommendations
    • Is Your Mom Missing Her BUMM?

Call (619) 479-6637

Why Should I Maintain My Own WordPress Website’s Backups?

WordPress Backup Locally or to the Cloud

Thank you for asking. My name is Jim Walker. I’ve been managing website hosting and security for thousands of our businesses here at TVC.Net since 1997.

Some years back, I launched our HackRepair.com service, a reactive website security service for WordPress. I quickly found that nearly all of our new customers either did not have a web designer to help with ongoing security and maintenance or simply never considered the ongoing security requirements of WordPress. So HackGuard.com, our proactive security service, was born.

Through our HackGuard.com service, I learned some truths about hosting companies and their backup systems, especially in how “free” backups are limited at most well-known hosting companies.

I would even go as far as to say that only a small percentage of the websites I’ve worked on over the past decade have had reliable backup options. Unfortunately, a great many well-known web hosting companies do not actually backup their clients’ accounts, despite claiming that “backups are included” in their hosting plans.

[ Key Takeaways
As a professional website manager, I share my experience and advice on website backups. I explain that many web hosting companies claim to offer “free” backups but in reality, they often limit the number of files that can be backed up. This leads clients to falsely believe that their accounts are being backed up. I argue that having a reliable backup strategy is important for reducing damage done by hackers, avoiding human error, keeping a business running in case of a disaster, and saving time and money. I recommend using two backup solutions, one saving daily, weekly, and monthly backups offsite and one yearly backup saved either offsite or on the client’s personal computer. I suggest using UpdraftPlus and WP Time Capsule as backup plugins, and using either Amazon S3 or Google Drive for cloud backups. ]

 

Do hosting companies limit free backups?

The truth is that many web hosts deactivate backups once the number of files within a hosting account exceeds a certain limit, known as “inodes.” Once this limit is reached, backups are stopped.Many web hosts attempt to avoid this ethical issue by offering paid backup options, which they promote in the client’s hosting control panel. However, since most clients rarely log in to their control panel, they may not realize that backups have been suspended due to exceeding the host’s inode limit. As a result, many businesses falsely believe that their accounts are being backed up, when in reality, they are often not regularly backed up at all.

 

Why is having a reliable backup strategy important?

If you are not yet convinced of the importance of backups, here are five reasons why you should regularly back up your website:

  1. Reduce the Damage Done by Hackers: Cyberattacks are becoming more common every day. If your website gets hacked and you don’t have a backup, you’re starting from scratch. But, with a recent backup, you can quickly restore your website and minimize the damage from the attack.
  2. Server Failure, No More: Servers can fail for various reasons, but with regular backups, your website data is protected and can be restored quickly if anything goes wrong.
  3. Avoid Human Error: Even the best website administrators can make mistakes. Accidentally deleting important files or data can be a disaster, but with a backup, you can easily restore your website to its previous state.
  4. Keep Your Business Running: In case of any disaster, a recent backup can ensure that your business operations keep running. You can quickly restore your website and minimize the impact on your customers.
  5. Save Time and Money: Starting a website from scratch takes time and money. Regular backups can save you both by allowing you to restore your website quickly.

 

Backups and HackGuard.com service

The absence of backup systems at several web hosting services prompted me to create my own solution, which I named HackGuard. Many clients whose websites had been hacked were not only missing a functional backup system but also lacked expertise in maintaining WordPress websites. As a result, developing a dependable service that includes website maintenance, backup systems, and security measures was an obvious choice.

When I started my HackGuard.com service, I tried a variety of backup options. Of the dozens of WordPress plugins tried over the course of a few years, I found only two met my service requirements, UpdraftPlus and WP Time Capsule. At the time, my service requirements included: displayed minimal self-advertising and promotion, provided responsive customer service, supported a variety of cloud backup options, and provided a high level of reliability.

 

Updraft Plus and WP Time Capsule

 

Having managed websites for over twenty-five years, I can say without a doubt that the biggest lesson I’ve learned in my time managing websites is a simple one: backup redundancy and security go hand in hand.

It’s for this reason that I believe every website should have at least two backup solutions in place: one system saving daily, weekly, and monthly backups offsite, and at least one yearly backup saved either offsite or on the client’s personal computer.

I could get into discussing the pros and cons of my most used backup plugins, but the details are beside the point. You can learn more about the pros and cons of each with a quick Google search. In short, it doesn’t matter which backup system you have in place. Having multiple backup systems regularly backing your website up to an offsite “cloud” backup service is key #1.

Of the cloud services I’ve tried for website backups over the years, both Amazon S3 and Google Drive have been very reliable. The biggest downside of Amazon S3 is cost. Once backups on Amazon S3 reach a terabyte, service fees may begin to exceed $100 a month, especially if you are doing frequent recovery of files. Alternate lower-cost cloud service options, like Wasabi, are available as well, which according to their website, is 80% less costly than AWS. As of this writing, I haven’t tested Wasabi enough to give a review on their service.

Now, having covered the importance of backups, I would be remiss if I didn’t mention how backups may affect the performance of your website. On an overloaded or poorly tuned web server, backups may impact how a website loads during the moving of data from the web server to the cloud service. On the other hand, having maintained the backups of hundreds of websites on dozens of different web hosting companies’ servers over the past several years, I’ve found that the more experienced web hosts with well-tuned web servers have zero issues with clients running multiple backup systems simultaneously.

Will backups slow down my website?

Sadly, many well-known hosting companies throttle their shared servers by severely limiting CPU cycles, number of processes allowed, and/or, memory. If you’ve worked on a website and seen a 503 error page appear, then you’ve likely experienced this first hand (picture below).

503 error page
This may have the undesirable effect of backups taking exceedingly longer to complete, which may then perceptively slow web page loading, as well as increase the likelihood of backup failure.

This often-reported backup plugin “problem” is nearly always related to how well a given hosting service has tuned its web servers. I know I’m repeating myself here, but I would like to reiterate once again that an overly restrictive hosting service may limit the ability of your backups to fully complete in a timely manner, resulting in backups failing unexpectedly. If a hosting company recommends against using backup plugins like UpdraftPlus, there is a high likelihood that you are using one of “those” overly restrictive hosting companies. Is this a red flag when choosing a quality hosting service company for your business? I think so.

 

Why is backup recovery testing important?

Which leads me to a discussion on the next uber-important aspect of backup management: backup recovery. Once you’ve established a working offsite backup systems, repeatedly and periodically testing the recovery process is key #2.

With UpdraftPlus, a files-based backup solution, recovery is as simple as deciding what you wish to recover—be it a plugin, theme, or the entire account—and then clicking the “Next” button a few times until the process is completed. With WP Time Capsule, an incremental backup solution, you have the benefit of choosing restore points, and within those restore points, the specific files or database dates to restore. Irrespective of how the backup plugins work, periodically testing and becoming comfortable with the recovery process is as important a step as establishing the backup options for your website in the first place.

 

Should I back my website up to a cloud service?

That said, website hosting or backup failures are inevitable. That’s why it’s imperative to have multiple backup options saving off-server. The cost to archive your website to a cloud service is minuscule compared to the physical and emotional cost of having to rebuild a website from an Internet archive or multi-year-old backup. Been there, done that, and it’s no fun at all!

In the worst case, when the web host’s server literally crashes and the data is lost, your cloud backup service decision may spell the difference between the same day recovery of your website’s files and database and a total and irretrievable loss of your content. Backing up your website to an off-server cloud service is just smart business.

And while most of this discussion has been about the value of establishing an offsite backup system, you may ask, “What about my web host’s backups?” Great question, and not meaning to be flippant here, but as that guy in that movie, Donnie Brasco, said, “Forget about it.” Sure, your hosting company may offer backups as part of their service, though I would argue that for the fifteen or so minutes it takes to set up a backup system for your website to “the cloud,” why take the chance? Whether your web host has a backup available when you really need it is also beside the point. Take control of your destiny. Just make a backup.

 


Disclaimer:
This post was written by Jim Walker for informational purposes only, was not solicited, nor paid for respectively.

 

Filed Under: Call (619) 479-6637 Tagged With: cloud backups, local backups, off-site backups, updraftplus, website backups, WordPress backup, wp time capsule

How to Improve Junk Email Filtering at Gmail

Email phishing and junk email are like death and taxes… Acceptance is the wisest course of action—oh, and reporting spam, of course.

[ Key Takeaways
Gmail has decent back-end filtering for junk email, but reporting spam to Google Gmail can help improve filtering in the future. It is important to note that marking bad emails as spam and not just deleting them will help Gmail better filter your inbox in the future. ]

Most folks I chat with about email issues seem overwhelmed with the day-to-day junk email burden. And when I ask, “Have you reported it?” the line usually goes quiet.

Gmail has some decent back-end filtering, such that most of the bad email senders will fail in their attempt to slam you with their bogus offers and phishing attempts.

   What is Phishing?
Phishing is a type of scam in which criminals disguise themselves as trustworthy organizations or individuals to trick people into giving them sensitive information, such as passwords or credit card numbers.

 
But if you don’t tell Google that the email you receive is spam, it’s less likely they’ll filter that email or type of email from hitting your inbox in the future. Deleting junk email or not reading it does not count as a filter where Gmail is concerned.

To reduce spam in your Gmail inbox, follow these steps:

  1. With your eyes on your inbox, select the messages you wish to mark as spam (#1 below) and then click the little circle with an exclamation mark (#2 below).
  2. That’s it.
    Mission accomplished!

How to Improve Junk Email Filtering at Gmail

Yes, if you inadvertently open the junk email message, you may likewise mark it as spam there as well (see above example).

Just click the vertical three dots at the top right of your open message window. There, you’ll see a “Report Spam” option. Click it to help Gmail better filter junk email messages in the future.
 

___

What is HackGuard.com service?
Based in San Diego, California, HackGuard.com service provides a personalized white label ready WordPress management and security service experience for just pennies a day.

PLAN - PRICE

Add Ons
Sub domains

Add Ons
Sub domains

Add Ons
Sub domains

Monitor


MONITOR

Your Text

Manage


MANAGE

Sign up!

Backup


BACKUP

Sign up!

Secure


SECURE

Sign up!

 


Disclaimer:
This post was written by Jim Walker for informational purposes only, was not solicited, nor paid for respectively.

 

Filed Under: Call (619) 479-6637 Tagged With: gmail, gmail filtering, junk email, phishing

What are the top 20 WordPress plugins to avoid in 2023?

Top 20 WordPress Plugins to Avoid


What are the top 20 WordPress plugins to avoid in 2023?

To help optimize your WordPress website for SEO, here is a list of the top 20 plugins to avoid

  1. Broken Link Checker runs continually and may slow page loading.
  2. Contact Form 7 loads plugin assets on every page.
  3. Contextual Related Posts has outdated or bloated coding.
  4. Disqus Comment System has outdated or bloated coding.
  5. Download manager has outdated or bloated coding.
  6. EWWW Image Optimizer runs continually and may slow page loading.
  7. Essential Grid has outdated or bloated coding.
  8. Image Optimization plugins runs continually and may slow page loading.
  9. JetPack has outdated or bloated coding.
  10. VaultPress has outdated or bloated coding.
  11. NextGen Gallery has outdated or bloated coding.
  12. Query Monitor runs continually and may slow page loading.
  13. Revolution Slider has outdated or bloated coding.
  14. S2 Member has outdated or bloated coding.
  15. Similar Posts has outdated or bloated coding.
  16. SumoMe has outdated or bloated coding.
  17. WP Reset may created bloated database tables.
  18. WordPress Multilingual (WPML) has outdated or bloated coding.
  19. XML Sitemaps. Sitemap Plugins are generally unnecessary. Be sure to use more fully featured SEO plugins when possible, like Slim SEO or Rank Math SEO.
  20. Yet Another Related Post has outdated or bloated coding.

 

[ Key Takeaways
This article provides advice on the best practices for using WordPress, such as avoiding plugins that have outdated or bloated coding, keeping the number of plugins to a minimum, and disabling any unnecessary features. It also recommends avoiding active social media connection plugins in moderation, as they can slow down page loading as well. ]

 

As a WordPress website manager with over a decade of experience at HackGuard.com service, I recommend avoiding or replacing the plugin above.

More Details About My Plugins List

It is not my intention to discredit the hard work of the developers who oversee these plugins. This list is based on my own personal experience.

As a general rule of thumb, the fewer plugins “installed” within a WordPress website the better. Both active and inactive plugins installed within WordPress may impact the security of a website as well.

 

When Using WordPress, It’s Best To Keep The Number Of Plugins To A Minimum

This is true for both active and inactive plugins, as they can both affect the security of your website.

After activating a plugin, it’s important that you disable all not required features. For example, many SEO plugins have Google Analytics ( GA) enabled by default. If you are not using GA, be sure to disable that feature. Contact forms are another common source of feature bloat. If you are using a contact form on your website, be sure to choose a plugin that does not inject the contact form assets into every page of your website. I added Contact Form 7 to my list for this very reason.

Likewise, as a general rule, be sure to use social media connection plugins in moderation. Active social media connection plugins can greatly slow down the full loading of a web page.

If you are looking to dramatically improve the performance of your website, please see my article, “Improving Your WordPress Website Speed with Cloudflare, Image Optimization and Litespeed Today“.

 

What is HackGuard.com service?
Based in San Diego, California, HackGuard.com service provides a personalized white label ready WordPress management and security service experience for just pennies a day.

PLAN - PRICE

Add Ons
Sub domains

Add Ons
Sub domains

Add Ons
Sub domains

Monitor


MONITOR

Your Text

Manage


MANAGE

Sign up!

Backup


BACKUP

Sign up!

Secure


SECURE

Sign up!

 


Disclaimer:
This post was written by Jim Walker for informational purposes only, was not solicited, nor paid for respectively.

 

Filed Under: Call (619) 479-6637 Tagged With: bad plugins, plugins, wordpress website

WordPress 6.0.3 Security Release – Updated?

WordPress 6.0.3 Security Update

A number of my clients asked, “Have you updated my WordPress today?”

Answer: Yes.

 

As part of our HackGuard.com service, whenever a security release is posted, we work to ensure all of our client’s sites are updated same day.

Why this week?

WordPress 6.0.3 Security Release was posted this week.

Over 16 patches were made in this WordPress release:

1 Stored XSS via wp-mail.php
– contributed by Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. via JPCERT

2 Open redirect in `wp_nonce_ays`
– contributed by devrayn

3 Sender’s email address is exposed in wp-mail.php
– contributed by Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. via JPCERT

4 Media Library
– Reflected XSS via SQLi
– contributed by Ben Bidner from the WordPress security team and Marc Montpas from Automattic independently discovered this issue

5 CSRF in wp-trackback.php
– contributed by Simon Scannell

6 Stored XSS via the Customizer
– contributed by Alex Concha from the WordPress security team

7 Revert shared user instances introduced in 50790
– contributed by Alex Concha and Ben Bidner from the WordPress security team

8 Stored XSS in WordPress Core via Comment Editing
– contributed by Third-party security audit and Alex Concha from the WordPress security team

9 Data exposure via the REST Terms/Tags Endpoint
– contributed by Than Taintor

10 Content from multipart emails leaked
– contributed by Thomas Kräftner

11 SQL Injection due to improper sanitization in `WP_Date_Query`
– contributed by Michael Mazzolini

12 RSS Widget: Stored XSS issue
– contributed by Third-party security audit

13 Stored XSS in the search block
– contributed by Alex Concha of the WP Security team

14 Feature Image Block: XSS issue
– contributed by Third-party security audit

15 RSS Block: Stored XSS issue
– contributed by Third-party security audit

16 Fix widget block XSS
– contributed by Third-party security audit

 


Disclaimer:
This post was written by Jim Walker for informational purposes only, was not solicited, nor paid for respectively.

 

Filed Under: Call (619) 479-6637 Tagged With: hackguard, security update, WordPress 6

Your Site is Experiencing a Technical Issue – Or Maybe Not…

Weekly jQuery Migrate Status Update
[ Click to View ]

One of the most common support requests I receive on a weekly basis have the subject “Your Site is Experiencing a Technical Issue”.

These not so helpful email messages were introduced in the release of WordPress 5.2.

While I’m sure the WordPress developers who added this feature thought it would be a great way to alert folks of downtime due to plugin or theme incompatibilitWhile a great step in alerting WordPress users of potential errors within their websiteI’m

The plugin, Enable jQuery Migrate Helper, was installed as a temporary solution, enabling the migration script for your site to give your plugin and theme authors some more time to update, and test their code.

Recently, this plugin has been sending “deprecated” email alerts to administrators as well.

The word “deprecated” simply means that some function within a plugin or theme no longer meets the latest WordPress coding standards.

Should you be concerned?
Answer: No, but maybe…

WordPress is evolving and in doing so, some older coding standards will be left behind, to be replaced by newer faster, more secure standards. If you have received a deprecated message, like the one below, the message is simply a reminder that older code may stop functioning someday in the future.

Since maintaining the latest updates is just smart business where WordPress is concerned, be sure to check what is described as deprecated within the email alert and update that if possible.

In the example notice above, you’ll see that the alert relates to the “Dandelion” theme. Once the client updated his theme the error reports ended—the Enable jQuery Migrate Helper plugin was no longer required and then deleted.

If you wish to stop your website from sending these messages you could try deleting the Enable jQuery Migrate Helper plugin. If your website functions without the plugin, you should be fine for a while.

If your website appears broken after disabling the plugin, just add the Enable jQuery Migrate Helper plugin back to fix the issue.

Enjoy!

Filed Under: Call (619) 479-6637 Tagged With: Enable jQuery Migrate Helper, jquery-migrate, wordpress updates

About that “Weekly jQuery Migrate Status Update” email

Weekly jQuery Migrate Status Update
[ Click to View ]

We’ve received a good number of support requests about the “Weekly jQuery Migrate Status Update” emails from WordPress this past year.

These mailers are a new feature of the “Enable jQuery Migrate Helper” plugin.

With the update to WordPress 5.5, a migration tool known as jquery-migrate was disabled by default. This disabling of that function may lead to lacking functionality or unexpected behavior in some themes or plugins that run older code.

The plugin, Enable jQuery Migrate Helper, was installed as a temporary solution, enabling the migration script for your site to give your plugin and theme authors some more time to update, and test their code.

Recently, this plugin has been sending “deprecated” email alerts to administrators as well.

The word “deprecated” simply means that some function within a plugin or theme no longer meets the latest WordPress coding standards.

Should you be concerned?
Answer: No, but maybe…

WordPress is evolving and in doing so, some older coding standards will be left behind, to be replaced by newer faster, more secure standards. If you have received a deprecated message, like the one below, the message is simply a reminder that older code may stop functioning someday in the future.

Since maintaining the latest updates is just smart business where WordPress is concerned, be sure to check what is described as deprecated within the email alert and update that if possible.

In the example notice above, you’ll see that the alert relates to the “Dandelion” theme. Once the client updated his theme the error reports ended—the Enable jQuery Migrate Helper plugin was no longer required and then deleted.

If you wish to stop your website from sending these messages you could try deleting the Enable jQuery Migrate Helper plugin. If your website functions without the plugin, you should be fine for a while.

If your website appears broken after disabling the plugin, just add the Enable jQuery Migrate Helper plugin back to fix the issue.

Enjoy!

Filed Under: Call (619) 479-6637 Tagged With: Enable jQuery Migrate Helper, jquery-migrate, wordpress updates

  • Go to page 1
  • Go to page 2
  • Go to page 3
  • Interim pages omitted …
  • Go to page 5
  • Go to Next Page »
Proactive WordPress Security Management for Pennies a Day™

© Copyright 2022 HackGuard.com™, HackRepair.com™,
The Hack Repair Guy™, Hack Repair Guy™
Copyright and Trademark Statement | Privacy Policy

Call HackRepair.com for website security help, (619) 479-6637.
Content Approved By Jim Walker, The Hack Repair Guy