Because WordPress is one of the most widely used CMS systems, it's a frequent target of attacks. In today's article we bring you 13 tips for greater security of your WordPress site.
1. Choose good hosting and trust it
Your website won't be secure if it runs on hosting that doesn't meet basic security criteria — updated system cores (Linux, Windows Server, etc.), SFTP connection to the server, a Let's Encrypt certificate, quality support from the hosting provider, and so on. Among hosting companies, excellent choices include Websupport, Webglobe – Yegon, and others.
2. Update WordPress, plugins, and themes
Keeping the system core, plugins, and your theme up to date is an absolute must for security. Before updating the system, modules, or theme — don't forget to back up. Back up your database, theme directory, and plugin directories as needed. When it comes to the core, install minor (partial) updates too, as these address security vulnerabilities. We recommend not using plugins that haven't been updated in over a year. Most quality hosting providers let you enable automatic core updates. In most cases you can turn this on — it's also a good idea to have automatic database and FTP backups enabled alongside it.
3. Login credentials and admin rights
The most basic WordPress rule is not to use "admin" as your username. Use any other name. Even with a strong password, using "admin" still leaves you vulnerable to having it cracked. The second important thing is not to give admin rights to just anyone — be very careful about this. If possible, don't give admin access to anyone else. Train your users to use complex, long passwords for their own security.
4. (Re)CAPTCHA or two-factor authentication
Closely related to login credentials is the login page itself, which you can protect with reCAPTCHA or two-factor authentication via email or a mobile app. reCAPTCHA is also worth using on contact forms and comment sections.
5. Change the login URL
Another way to prevent potential attacks is to change your login URL. A security plugin can help with this, as well as protecting against brute-force attacks — we covered these in our article: Top 3 Security Plugins for WordPress in 2018.
6. Disable the plugin and theme editor
The plugin and theme editor is a great tool for developers, as it allows certain changes to be made directly from within the WordPress admin. However, we recommend disabling these editors — if a hacker gets into your admin area, they can modify those files too. You can disable the editor via security modules or by adding a line directly to wp-config.php: define( 'DISALLOW_FILE_EDIT', true );
7. Protection via the .htaccess file
An effective way to protect against attackers is to restrict access to the WordPress admin to specific IP addresses. Add the following to the .htaccess file in the /wp-admin/ folder: order deny,allow / allow from 123.123.123.123 / deny from all — and to the .htaccess file in the main directory: <FilesMatch wp-login.php> / Order Allow,Deny / Allow from 123.123.123.123 / </FilesMatch>. In both cases, replace 123.123.123.123 with your IP address.
8. Disable error messages
If an error occurs in a plugin or template, the error message may display the full server path to that file. This information is sensitive and valuable to hackers. It's better to disable these reports by adding the following lines to wp-config.php: @ini_set('display_errors','Off'); / @ini_set('error_reporting',0);
9. Hide the WordPress version number
WordPress by default displays the version number in the meta tag: <meta name="generator" content="WordPress 4.7.2" />. For hackers, this number is important data that helps them determine your site's vulnerabilities. You can prevent version display by editing functions.php in your theme. However, we recommend handling version hiding via a security module, so the version gets hidden everywhere it needs to be.
10. Use a child theme
It's important to use a child theme so that your changes to functions.php, style.css, etc. aren't overwritten when the theme is updated. Using a child theme can also help you avoid some problems that arise during theme updates.
11. Check file and folder permission settings
Correct directory and file permissions protect WordPress against security exploits. With proper permissions set, it's much harder for a hacker to manipulate files on the server and take control of your site. The correct permissions should be:
All directories set to 755 or 750 All files set to 644 or 640 * The wp-config.php file set to 600
12. Change the database prefix
For security, it's important to change the database prefix from the default wp_ to something else. Be sure to back up your database before changing the prefix. You can change the prefix manually in the database and in wp-config, or use a security module to do it.
13. SSL certificate – https://
We try to use a secured SSL connection on every website we work on. If you're using a standard HTTP connection, your username and password are sent over the internet unencrypted. At a minimum, a Let's Encrypt certificate is sufficient — it's a free alternative to paid SSL certificates. Quality hosting providers include this certificate in their offerings. For installing SSL in WordPress, we use this simple plugin: Really Simple SSL
In closing, I'd remind you that no security measures will be 100% foolproof. There will always be some possibility of an attack. For greater security and peace of mind, we recommend using security plugins such as iThemes Security or Wordfence, which we covered in our article: Top 3 Security Plugins for WordPress in 2018. If you're unsure what to do or don't have time for these settings, don't hesitate to contact us.
