Membership Site Security: How To Keep Your Site Safe & Secure

The security of your website is of the utmost importance for two main reasons: the investment you’ve put into your website and the privacy of the people who use your site. All sites on the internet are at risk and require specific steps to keep up with security and compliance. This is especially true for websites that house user data like membership or eCommerce sites.

If your website gets hacked, all of your users’ data would be in danger. This data is your responsibility to protect and you can carry liabilities to those users. The hacked site could be used to cause damage to visitors’ computers or used to bulk send spam messages. This would hurt your users directly and tarnish the reputation of your business. Perhaps worst of all, not being compliant (or getting hacked) can have your site de-indexed from the web search engines and blacklisted from sending email.

Yikes. Let's try and avoid that, shall we?

While it’s nearly impossible to make your site 100% secure, we will do our best to show you some of the essentials to secure your site and keep up with modern compliance requirements. Managing security and compliance is a major part of a site build. If you or your team is unable to attend to the needs of security, you should consider hiring a professional to help get you compliant and safe.

An Overview of MemberMouse’s Core Security Features

MemberMouse uses the latest standards and security protocols for passwords, licensing, and payment transactions. We also strive to integrate with any new releases of improved security features. Neither your MemberMouse website – nor our servers – will ever store your customers' payment details. Instead, that information is stored on your payment processor's servers.

Out-of-the-box, MemberMouse comes with several options to enhance the security of your website:

How MemberMouse Handles Security

Account Sharing Protection allows you to limit the number of IP addresses that can access an account over a 24-hour period.

Stripe Elements integration: The latest in 3D Secure checkout security technology from Stripe. This carries the highest level of PCI compliance and is SCA-ready. 3D Secure checkout is mandatory for customers in the European Economic Area (EEA) in order to be compliant. Credit card and billing information is sent directly to Stripe and never touches your servers.

Authorize.net CIM integration: This will enable the customer information manager that stores customer details on the Authorize.Net servers. Additionally, the Accept.js token exchange has been incorporated into our Authorize.net CIM integration, so credit card and billing information is sent directly to Authorize.net and never touches your servers.

Braintree integration: This includes 3D Secure checkout process using Hosted Fields / 3D Secure 2.0. and carries the highest of PCI compliance and is SCA-ready. 3D Secure checkout is mandatory for customers in the European Economic Area (EEA) in order to be compliant. Credit card and billing information is sent directly to Braintree and never touches your servers.

Limit Login Attempts plugin integration: By default WordPress allows unlimited login attempts. We have set up an integration with the plugin Limit Login Attempts that will allow you to configure your site to block an internet address from making further attempts after a specified limit on retries is reached, making a brute-force attack difficult or impossible.

Going One Step Deeper

When creating a user or doing a password reset, MemberMouse forces a minimum password strength requirement of 8 characters. MemberMouse also supports the addition of a custom filter that allows the password to be evaluated based on custom requirements that you can define.

Checkout can be configured to use V3 of Google ReCaptcha which is the latest version of an invisible system that minimizes bot signups and scammers.

MemberMouse.com does not store, nor have access to any of your user’s data nor credit card information.

Our platform is GDPR compliant and has features to manage GDPR requests.

MemberMouse makes use of the standard WordPress password functionality, so you know you will always have the latest and greatest features within password storage and management.

MemberMouse is regularly updated and is compatible with the latest PHP versions.

The ABC’s of Web Hosting Security

Most modern hosting has the basics required to keep your server secure with tools like Modsecurity or (WAF) web application firewalls. That being said, you should never use cheap hosting – or low-level reseller hosting – because they may not have protocols in place to keep your server secured, or the ability to attend to emergency requests you may have.

Considering that your host should already have common protocols and modules to keep your server safe, much of the security responsibilities of your server fall on you. Unfortunately, it’s common for many site owners to not consider the potential dangers involved when setting up their hosting package. To put that into perspective, poor hosting management is responsible for 41% of most hacks. To help keep your server secure, here are some common things which get overlooked that you can attend to stay safe:

How To Keep Your Site Safe

Use a strong password protocol to log into your hosting plan with a mix of letters, numbers, and characters. Never use words that can be found in the dictionary.

Remove any FTP accounts while they are not in use. Many hosts allow FTP to be closed when not in use. Again, use strong password protocols when setting this up.

All email accounts that are associated with the website, or are on the server should have strong password protocols. If these accounts get hacked, they can be used to access the site and cause damage, plus they can be used in spam email sending.

Check your file manager regularly for irregularities. Often backups or database files are located in the public_html making them publicly available. These backups can be downloaded easily and all your secure site information is within them, including database access and admin passwords. Keep your file system tidy and only store the necessary files required to make your site function.

Additional Tips

Often check to be sure file and folder permissions are properly set. Files, including your .htaccess file and wp-config file, should be 644 while your folders should be 755. Files can get adjusted to the wrong permission when certain actions take place in your WordPress admin panel, so regularly checking them is important.

Be sure your server creates regular backups which you can access. Do not rely on plugins to handle backups as they are not reliable and often do not work with MemberMouse.

Do yearly audits of your server software to be sure you are using the latest compatible versions of PHP.

Never log into your server if you think your personal computer is compromised. You should be using compatible security software on any computer which you use to access your server and website. This is a very common method your site or server could get hacked.

For further advice on choosing a hosting provider as well as minimum requirements for running MemberMouse, you can review our article on WordPress Hosting Providers.

A Few Things You Should Know About WordPress Security

The WordPress Codex has a massive article on Hardening WordPress that discusses vulnerabilities, setting secure file permissions, securing database and admin panel access, and more. This article is a must-read for any website owner who wants to learn more about the security required for your website. Most all of the recommendations are easy to accomplish and can seriously improve the health and security of your investment.

The most important steps you can take to help protect your WordPress are:

Passwords: Require all admin accounts to use a strong password protocol. Consider using 2 Step Authorization to prevent access to these accounts. A hacker who gains access to your administrator account is able to install malicious scripts that can potentially compromise your entire server, have your website banned from search engines, and destroy your website and its user’s private data.

The email account associated with the admin account should also have strong passwords and 2 Step Authorization because they can be used to easily access your WordPress installation.

Updates: 83% of websites that get hacked are not updated properly. It is the single most important step you can do to secure your website. Never let updates get behind by activating Automatic Updates which is a feature built into WordPress.

Tidiness: Remove unused plugins and themes. You want to keep one default WordPress theme aside from your primary theme, but any unused plugins should be removed unless you plan to re-enable it soon.

Side Note

Heavily evaluate if you need a plugin. Less is better when it comes to plugin count and only install plugins that are regularly updated and come from a reputable seller.

After migration plugins, database plugins, or file editing plugins are used, they should be removed promptly. Unauthorized access to these plugins can spell disaster as they provide a simple path to the needed areas a hacker requires.

Access: Always work on your site and server from a trusted network. Avoid cafe internet or public WIFI at all costs.

Use a Limit Login plugin to limit unusual login attempts. It is very common to have your website login attacked on a daily basis. Sometimes thousands of times per day, so using a login plugin will block bad attempts at logins and prevent them from continually attempting access.

Remove unused admin accounts within WordPress.

Disable Theme and Plugin Editors from WordPress Admin Panel to prevent file edits when your site is accessed without authority.

All About Acronyms: SSL, HTTPS, & PCI Compliance

All websites, whether they take payments or not, should use an SSL and be secured with HTTPS. Login data, as well as the transference of information to your users, should be secured for everyone’s protection.

The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements intended to ensure that all companies that process, store, or transmit credit card information maintain a secure environment. This not only means that it is required by law to have a properly installed SSL on your site if you have a store or a membership site, but it also means that you need to go to greater lengths to secure your website and this article covers many of those steps you can take.

If you would like to learn how to install an SSL to your site, we have a detailed article here with directions on how to install one on your site.

Just having an SSL certificate and using HTTPS doesn't necessarily mean that you will be fully PCI compliant. The requirements vary based on your business type, technical setup, and/or volume. If you have PCI compliance concerns, it is best to speak with your payment processor or a PCI-DSS expert. This article is a good primer on the subject and can help you understand what, if any, additional steps you'll need to take.

These PCI FAQ guides are also succinct and helpful:

What are the PCI compliance ‘levels’ and how are they determined?

PCI SAQ 3.1: E-Commerce Options Explained

Don’t Forget About Domain & DNS Security

Securing the account your domain is listed on (such as Godaddy, Namecheap, etc) should be protected using strong password protocols and when possible, 2 Stage Login. If unauthorized access is gained to your domain’s DNS settings, a website can be changed or hijacked, and potentially the domain can be stolen. A yearly audit on your domain’s account to be sure all contact information associated with the domain is up to date and accurate is good protection and it can help with maintaining ownership.

DNS security is less often considered, but steep consequences can occur if your DNS is hijacked. These attacks can redirect a website’s inbound traffic to a fake copy of the site, collecting sensitive user information and exposing businesses to major liability. One of the best-known ways to protect against DNS threats is to adopt the DNSSEC protocol.

Many options are available for DNS protection, but Cloudflare is a great option as it will not only protect your DNS, but it can protect your site from bots and allow all your server resources to go to real users instead of attacking bots. The huge variety of options they offer are excellent for protecting your website and have a variety of pricing plans, including free.

Wrapping Up

Passwords and updates are the foundation of security and are so often overlooked or their importance ignored. Often people think their password is strong when in actuality, it’s probably been leaked on the dark web hundreds of times and has no security at all. Try and get in the habit of regularly updating your passwords everywhere and using a reliable password manager.

Attend to website software updates as timely as possible. Not only will this help keep you secure, but it often resolves problems you may be having with your software or plugins.

If you do have an unfortunate run-in with a hack, use a reliable professional to resolve the hack, and never rely on a simple plugin to protect you or “fix” the issue. Aside from removing the malware, and preventing its return, many steps can be involved to repair these situations, including the need for documentation of the resolution to wipe out blacklisting on search engines and email providers.

You may also have a legal liability to inform your site members of the breach and having a professional to assist with the tedious project of notifying your member base, required jargon and what was breached will prove invaluable.

Simply educating yourself on the importance of security is also a great starting point. Below we include references to data points used in this article, as well as other great resources for learning about security.

Additional Resources:

How Do Websites Get Hacked?
How to Improve WordPress Security [Infographic]
Hardening WordPress
Two-Step Authentication
Configuring Automatic Background Updates
Password Best Practices
WordPress Repository – Plugins Tagged Security

---

Related content

---

• Share