How do I keep my website safe and up-to-date?

What is included by default in leflite?

Confirming new login locations

When you log in to the live website from an IP address that is not yet known, for example, from a new location or a new network, you will first receive an email with a confirmation link. Only after that can you log in. This way, someone who knows your password does not have access yet. As long as this check is active, XML-RPC is also closed, an old way of logging in that is often used for attacks. Read why you need to confirm your login via email.

General error message, protected REST API

• If you type an incorrect username or password when logging in, the website simply says: “The entered details are incorrect.” An attacker does not know whether the username exists.
• The REST API of WordPress, a technical entry point for other programs, only works for logged-in users and a few fixed connections, such as forms and payments.
• Requests with known attack patterns in the web address are denied.

Comments off

Comments under pages and posts are turned off, so no spam comes in through comment forms. If you have a webshop with product reviews, those will still work.

What do you do?

• A strong, unique password for each user. Use a password manager.
• Only users who need it, with the lowest role that suffices. Remove accounts of former employees. See how to add a user and choose the right role.
• No plugins on your own initiative. Every extra plugin is extra code to maintain. Consult first, see which plugins are included in your website by default.
• Pay attention to the notification Theme update available! and do not ignore it for months.
• Keep your website light: see why your website is slow and what you can do yourself.

What do we do?

With WordPress maintenance, we take care of the updates, backups, and security of your website, so you don’t have to worry about it. Maintenance for a website costs €400 per year, for a webshop €600 per year. What is included, you can read on the page WordPress maintenance. Why it is worth it, you can read in why a maintenance contract is necessary.

Updates: theme and plugins

WordPress, the theme, and the plugins receive regular updates: for security, new features, and bug fixes.

• Plugins are automatically updated on your live website.
• The leflite theme comes from Lef Creative’s own update server and is not automatically updated. If there is a new version, you will see the notification Theme update available! at the top of the dashboard. What to do with that, you can read in what the notification Theme update available means.

All available updates can be found under Dashboard → Updates.

Backups

Backups are not included in the theme or in a plugin of your website, but are part of the hosting. If you host your website with us, we will make the backups. Read more about hosting on web hosting. Did something go wrong? Read how to restore a backup of your website. For one page, an earlier version is often enough.

All articles about maintenance

• What does the notification ‘Theme update available!’ mean?
• How do I restore a backup of my website?
• How do I enable a ‘coming soon’ page?
• Why is my website slow and what can I do myself?
• Why a maintenance contract for WordPress websites is necessary

Frequently asked questions