How to Secure Your WordPress Site

by [email protected] on February 25, 2019 | Reader Disclosure

Do you want to keep your WordPress site safe? WordPress is a great CMS, but like any platform, it has flaws that determined hackers can exploit. But unlike other platforms or websites you create yourself, there are a variety of known security measures you can take to protect your site.

Step 1. Update Everything
Step 2. Use Actively Updated Plugins and Themes
Step 3. Choose a Good Web Host
Step 4. Install a Security Plugin
Step 5. Backup Your Website
Step 6. Protect Your Login

Step 1. Update Everything

If there’s one thing you can do to secure your website, it’s to keep everything updated. Updating patches up those security holes and glitches that allow hackers to gain access.

Sometimes you may need to downgrade WordPress for compatibility reasons, but make sure to upgrade as soon as possible.

To update WordPress or its components, head to your admin dashboard and click Updates. If there’s a new version of a plugin, theme, or installation, it will notify you here. Usually, you just click Update Now, but sometimes you’ll need to update manually.

Step 2. Use Actively Updated Plugins and Themes

It’s best to avoid older themes or plugins that are no longer compatible with newer versions of WordPress. Your old installs can be an easy gateway to infiltrating your website. Use plugins and themes that are still receiving updates, and make sure to keep them up to date.

You should avoid downloading nulled premium WordPress plugins or themes. The results are rarely worth not having to pay. Like any form of piracy, nulled content tends to come bundled with malware that can infect your computer or even your website. They also aren’t updated actively, so you’re exposing your site to security holes that the official plugin has already patched.

Step 3. Choose a Good Web Host

Web hosting can have a big impact on your security. Many web hosts will use a firewall, malware scans, and other helpful features. At the very least ensure that they keep their software up to date and their servers secure.

Shared hosting, while inexpensive, can spread malware between websites if even one server is infected. Consider using a VPS, cloud, or dedicated servers instead.

Many hosts also offer SSL certificates. If you handle sensitive data like passwords or payment info, you need an SSL certificate to encrypt this important data.

Step 4. Install a Security Plugin

Security plugins are super helpful tools that often install a firewall, enable helpful features, and make it easy to do things like changing your login page URL or blacklist IPs. They also can scan your website and detect common malware or vulnerabilities.

Some popular WordPress security plugins are All In One WP Security & Firewall, Wordfence Security, and Sucuri Security.

Step 5. Backup Your Website

If your website does get messed up by a hacker, you don’t want to spend hours trying to repair the damage. Backups allow you to simply revert to an older version of your website, and with a change of your admin password, the issue should hopefully be solved.

Your host may provide backup services, or you can use a plugin like BackUpWordPress.

Step 6. Protect Your Login

Hackers may try to brute force your login and get access to your site. However, there are a few things you can do to stop them from gaining entry.

Anyone can go to your login page and attempt to guess your password — unless you change the URL. Some security plugins come with this feature, or you can use WPS Hide Login.

WP Limit Login Attempts will add a CAPTCHA and stop people from making more than a few attempts at logging in, eliminating brute force methods of password guessing.

Two Factor Authentication, while it slows down the login process, forces people to use a code sent to another device you own to login. If someone even attempts it, you’ll know instantly.

Finally, the best thing you can do is have an unguessable username and password. Don’t leave your username as “admin”, and make sure your password contains symbols, numbers, and capital and lowercase letters.

Keep Your Website Safe

Getting hacked can mean losing your files, exposing sensitive material, or getting locked out of your site. Make sure to secure it by downloading security plugins, patching any potential exploits, and keeping WordPress up to date. That way, control of your website can be kept to you, and not handed over to criminals that want to steal your data.

If this helped you out, make sure to follow us on Facebook and Twitter for more quick WordPress tutorials.