15 Handy Tricks to Secure your WordPress Website

WordPress is the most popular and widely used Content Management System in the world. An endless amount of websites have been developed and will inevitably continue to be. The popularity of WordPress doesn’t show signs of slowing down, it is projected that the number of WordPress sites will continue to increase exponentially for many years to come, indefinitely. With the amount of sites that are implementing WordPress, it’s no wonder that WordPress security is an increasingly important issue for WordPress site owners and customer WordPress site developers.

Due to the extreme popularity of WordPress, security is a major concern- its flexibility and the easy-to-tweak code will attract hackers to integrate glitches throughout its system.

We realize a hacked site is quite troublesome, therefore maintaining WordPress security is of the utmost importance for all of our developed sites. In order to secure a WordPress site, one needs to be aware of a few basic things to ensure the site will be protected from the very first day it is launched. We put together this list of easy things to implement that will help you secure your WordPress site.

Your WordPress site is as secure as your selected hosting provider; this is not a place to cut cost. Choose a reliable hosting provider for your website, a provider that has all of the appropriate security measures in place. Choosing the right WordPress development agency can help you implement this WordPress security measure.

Hackers begin cracking your account by using the simplest of usernames. It is common knowledge that WordPress suggests ‘admin’ as the username for the Administrator account, so avoid using it and choose a unique username when installing WordPress.

Create a strong WordPress password by using strong passwords by combining the following: Choose a complex and atypical combination of characters for your WordPress installation, particularly for administrator account(s). Avoid using common & predictable passwords like 123456, admin123, password etc., honestly… these aren’t the passwords but a window for hackers. Make it as hard as possible for hackers to compromise your site, and password security is an integral part of securing your WordPress site!

WP is a CMS which is upgraded often. Pay close attention when signing into the CMS, once a new version is released there will be a notification on the dashboard to upgrade your current version. As soon as a new version becomes available, your site should be updated immediately as new versions include security patches needed to keep your site secure from an attack. Upgrading your site frequently is yet another easy way to guarantee your WordPress site security.

WordPress is a Plug & Play platform. You simply have to install a plugin to create a new functionality on your site, including changing the overall look and feel. There are an abundant amount of free and paid themes available to choose from; however, remember similar to WordPress CMS, you need to consistently upgrade any and all installed plugins & themes to their latest versions to maintain the utmost WordPress site security.

WordPress Editor is indeed a fantastic tool that allows changes to be made simply and quickly to tweak the design and/or functionality; However, if left accessible a hacker can add any script into the editor, potentially overtaking your site. Therefore, it is advisable and considered best practice to disable this functionality. Blocking users from your core code ensures your site’s overall security to a much higher degree. Disabling this feature can simply be done by adding the following code in wp-config.php:

define(‘DISALLOW_FILE_EDIT’,true);

WordPress has an abundant amount of plugins and themes available for free. When selecting a desired plugin for your site it is advisable to select plugins that are recently updated, highly rated and highly recommended. Additionally, it is important to note that the desired plugin is compatible with the WordPress version your site is currently running.

Spam is an irritating issue prevalent on WordPress. Therefore, it is strongly advised to include a captcha on all registration forms, as well as the blog post comment section. Captcha will obstruct spambots and deter human spammers alike. There are many plugins available for WP that provide this service.

‘/wp-admin/’ is the gateway to any WordPress site, but if the entry is well secured it is extremely difficult for a hacker to overtake or damage your WordPress website. It is advisable and considered best practice to add a second layer of security, using server-side authentication for your WordPress admin URL. This will further protect your domain from hackers and/or bots.

wp-config.php is a file containing essential and key information for all WordPress sites. It is advisable that the configuration files and the .htaccess file be out of the reach of unknown IP addresses. This can easily be achieved by adding a code snippet to the .htaccess file. See below for snippet and placement:

order allow, deny from all

Once we start using default settings for the most susceptible elements, it becomes easier for a hacker to locate and cause harm. Choose a sensible table prefix for your WordPress installation. Have an existing installation? Don’t worry! You can still change it, see below:

In wp_config.php, just change value of $table_prefix with your favorite prefix, like:

$table_prefix = ‘wp_’; => $table_prefix = ‘wp_sys789’

Now rename all the tables of the website, like:

‘wp_users’ => ‘wp_sys789_users’ and like for other tables

Your job is not complete by simply upgrading WordPress consistently. It is advisable to hide your WP version as well. Hackers are extremely savvy and have knowledge about the glitches respective to each WordPress version. So, it’s always ADVISED to hide core information from them. If they get to know your version, they can place a hack/malicious code on your website according to the version of WordPress you are running. This is the place where they can find the version, see below:

But.. no worries… it’s very easy to hide it by just patching the following code snippet to your functions.php:

function remove_version()
{
return ”;
}

add_filter(‘the_generator’,’remove_version’);

adding the above snippet will not print the version in the head of your web page or in the RSS feed of your website.

Hackers are extremely diligent, they relentlessly attempt to crack a site. Implement code that does not allow anyone (human, robots or attackers) to attempt to log in more than 4 times. There is a multitude of plugins available that keep track of login attempts, like WP Limit Login Attempts, Login LockDown and so on.

A basic level of security is achieved by following all of the above recommendations, but to further secure your WordPress site, install a security plugin! Having a plugin on a site will heighten the security fence around the website overall and reduce the likelihood of being hacked. Below are some popular security plugins to consider:

As stated above, it is of the utmost importance to consistently backup your site. Even with the best WordPress security measures in place, something unexpected can happen, leaving your WordPress site vulnerable to an attack. In the event of an attack, your site could potentially become severely damaged! A previously backed up, unaffected version can be restored. Having backups of your WordPress site is the ultimate WordPress security and easiest way to restore a badly damaged website.

This isn’t the full list of security measures one must take to secure a WordPress site, but an introduction to securing it at its most vulnerable entry points.