Why should you add two-factor authentications (2FA) to your WordPress site?

Once you have created your WordPress site, there are several factors you need to consider to keep your new site safe, whether it’s making sure your site is secure, you have regular backups scheduled or that your plugins are up to date.  

If you are establishing your business and brand in the online world, it is important to ensure that your site is not vulnerable to hackers and cyber attacks.  

According to Security Magazine:  “Every day, there are over 2,200 cyberattacks – which is nearly one every 39  seconds.”

• 43% of small businesses have no cybersecurity defense plan in place. 
• 60% of small business owners do not think their business is a target for cybercriminals.
• 74% of small business attacks were executed by external actors, as opposed to internal employees
• 84% of small business attacks focused on the monetary gain with 8% focused on espionage and the remainder focused on hacking for fun or grudges
• 22% of small businesses transitioned to remote work without a cybersecurity plan in place.

To minimize and limit your site’s vulnerability and risk of cyber-attacks, WordPress provides you with the ability to install and use two-factor authentication on your website.

In 2021, it was reported that only 57% of businesses around the world will use some form of online Multi-Factor Auth (MFA) as a method of authentication, designed to add an extra layer of protection on top of users’ login credentials. Of those employees using MFA, 95% reported using a software-based 2 factor authentication tool (such a mobile phone app), while 4% have a hardware-based 2 factor authentication solution, with roughly 1% using biometrics.

What is Two-Factor Authentication and how does it work? 

2FA refers to the process by which the person has to complete an extra level of login security verification to show that they have the necessary permissions required to access the site, documents, applications, sales information etc.

What are authentication factors?

While all sites will have at least one login process to access your account, there are several ways in which a user can be authenticated using an additional authentication method. Most authentication methods typically rely on the user’s knowledge factors, which includes login information such as traditional passwords. By adding an additional 2 factor authentication method, this forces the user to give extra information, which is either a possession factor or an inherence factor.

Knowledge Factor – This refers to the typical username/passwords and pin codes through which you can access a website account. No matter what type of password you select; including numbers,  words, symbols, uppercase, and lowercase, it will still be considered ‘basic security’. 

Personal/Possession Factor – This level of security factor refers to something that the user has in their possession. Examples of this can include your ID card, a previously answered security question, a one time password sent to your smart device, smartphone app verification etc. 

Biometric Factor – This can also be known as an inherence factor and is a security factor inherent in the user’s physical self. Typically, these are identified as unique personal physical characteristics such as fingerprint, facial, voice recognition or behavioral biometrics, including keystroke dynamics, gait or speech patterns.

While most two-factor authentication methods will only rely on the first three methods of authentication, there are systems that require further and more detailed security and will require further multifactor authentication (MFA), which requires two or more independent credentials for more secure login/authentication.

Location and Timing Factor – Some sites containing sensitive and personal information that you may try to log into, such as Facebook and Google, are  designed to notify the owner if they register a user attempting to log into your account from a suspicious location or at an unusual time. If this occurs, the sites send an email to the owners to notify them of the login discrepancies. This method can be enforced by limiting authentication attempts to known user specific devices (such a model of their mobile phone), or by tracking the geographic source of an authentication attempt based on the source Internet Protocol address or some other geolocation information, such as Global Positioning System (GPS) data, derived from the user’s mobile phone or other device.

By using these 2FA methods,  multiple layers of protection can protect your website from  phishing attacks by hackers and other cyber-security problems.

Is 2FA fool proof and can it be hacked? 

2FA can go a very long way in making your site secure. But no matter how thorough and safe your security login process is, nothing can make it 100% safe. Even recently, the popular crypto currency trading exchange Coinbase was hacked by actors who were able to bypass the user’s two factor authentication by cloning their mobile phones and gaining access to generated 2FA text message passcodes. 

2FA security is only as secure as its weakest component. The National Institute of Standards and Technology (NIST) has now discouraged the use of text messages in 2FA services, recommending instead that randomly generated time-limited tokens, owing to the risk of mobile phone cloning or malware that can intercept or redirect text messages.

Many large organizations, such as Google, Facebook, Uber, etc. have fallen victim to data hacks and have found their user information for sale on the dark web. Hackers’ tools and methods of attacks are becoming more sophisticated and harder to detect – incorporating phishing, password spraying, ransomware and malware attacks. While security teams are constantly working to improve online security, they have yet to put an end to the possibility. 

According to Dark Web Price Index 2020:

“Data samples of millions of people sold on the Dark Web range from  $25USD to $6000USD for premium accounts.” 

Typically, If the user has up-to-date security protocols, hackers will usually move on to a user that is more vulnerable and has failed to properly set up their additional security. 

Tips for minimizing the risk of cyberattacks:

Always have a backup of your site: By using UpdraftPlus, you can ensure that you will have a secure and safe backup of your WordPress website. Should the worst happen and your site is the victim of a hack, you can revert to the older version of your site and make changes to your login process to make your site more secure.

Ensure your site has a robust security system: While you can’t remove all of the risk of being hacked, you can minimize it. Ensure that you have a reputable two factor authentication login system for all users with back-end website access. Do not give unnecessary privileges to users if they do not require them, as they can be used to take control of the website. 

Update your plugins/themes/WordPress version: When hacking a WordPress site, this is the most common route of attack. Outdated plugins can be particularly vulnerable to hackers in giving them a route into your site.

Make sure users are aware of the risks: It is vital that everyone with a higher level of access to your site be smart and aware of potential security issues. This means being aware of potential hacking attempts via email phishing scams, that may appear genuine, but are attempts to retrieve user names/passwords and install malware onto your computer.

Strong passwords: While this may seem like the most obvious, it is also often the most overlooked. Having a strong and unpredictable password is often the first and best level of protection against most hacks. Passwords that are changed often and have a string of letters and special characters are very difficult to hack via forced password attacks. 

Ending Notes: 

The more you know, the better your chances are of preventing any kind of cyber attack before it has even begun. A mixture of 2FA, updated software and secure passwords and help prevent the vast majority of attempted hacks. But should the worst happen, always remember that you should have a recent backup copy of your site with UpdraftPlus, which should be stored in a secure remote storage location. 

If you have any suggestions or queries, feel free to comment below. We are  interested in hearing from you.