Learn how to improve the security of your WordPress site
WordPress is the most widely used content management system on the internet, which makes WordPress a preferred target for hackers.
Owning a WordPress site means you need to take several extra steps to secure your information and that of your visitors.
In the following article we will present several very effective tools for improving the security of your site. It is important to note that the following tools do not give you a 100% guarantee against hacking attempts, for the simple reason that
that there is really no site that is 100% secure. But they will protect you against most hacking attempts.
Keep your WordPress version and plugins up to date
It is really important to keep your WordPress version and all your plugins up to date with their latest versions.
Most WordPress and plugin updates contain security patch files (Patches). Even if the vulnerabilities (that WordPress declares) are not breached so easily,
Still, it is important to update the version and fix them. To read more on the subject, visit our guide – Automatic WordPress updates.
Secure your Admin area
We recommend limiting the number of failed login attempts to your site. This way you can protect your WordPress site from brute-force attacks by robots and people trying to guess your password. For such cases you can use a nice little plugin called Limit login attempts.
Or alternatively, uPress customers can activate the dedicated tool through the management system Blocking failed login attempts to the WordPress Admin
Don't use the username "Admin"
Most attackers will assume that the username for your site is "admin". You can easily block a great many hacking attempts by giving the site administrator's username a unique name.
If you are installing a new WordPress site, you can still choose a username for the site administrator during installation.
If you already own an active WordPress site, you can simply add a user through the uPress management interface, link to the guide.
Use strong passwords
You would be surprised to learn that there are thousands of WordPress users who use phrases like "password" or "12345678" as the password for the site administrator user.
These passwords are easy to guess and are at the top of the list of every attack carried out by a robot or by a human.
Good advice is to use a whole sentence that makes sense to you and that you can remember easily; such passwords are much, much better than a single word.
Use tools for detecting security vulnerabilities
If your site has already been hacked in the past, it is likely that there is a security vulnerability on your site and it should be dealt with immediately.
To do this, you can use advanced security tools such as WordPress Clinic offered to uPress customers,
which performs a comprehensive scan of your site and alerts you to security vulnerabilities and weak points, and even helps you fix them.
or alternatively you can use services such as sucuri which perform a comprehensive scan of your site and warn you about possible security vulnerabilities.
Adding two-factor authentication (for advanced users)
Enabling two-step authentication for your WordPress site can significantly improve your security.
One of the easy ways to do this is actually with the plugin Clef for authentication using your mobile phone. Recently the authors of the Clef plugin created a free version of the plugin.
An explanation of how to set up two-factor authentication on your site will be detailed in another guide, due to the large volume it requires.
Make sure your site is hosted on a secure WordPress server
Your WordPress site is secured at the same level as your hosting server is secured; if someone can exploit a vulnerability in an old version of PHP, for example, or another service
on your hosting platform – it doesn't matter if you have the latest version of WordPress.
This is why it is important to host your site with a company that prioritizes security.
Some of the features you should look for in your hosting server are:
- Support for PHP version 5.6.15 at least
- Support for MySQL version 5.5 at least
- A separate database server
- Built-in firewall on the server
- Intrusion detection system
Make sure your computer is free of viruses and malware
If your computer is infected with a virus or malware, a potential attacker could obtain your login details, log in to your admin area and bypass all the steps you took in the previous stages.
This is why it is very important to have antivirus software to maintain the overall security of all the computers you use to access your WordPress site.
