The Ultimate Wordpress Security Guide-2019
Today, I plan to discuss quite a few simple tricks that can help you secure your WordPress website. After implementing these tactics and following up with continual WordPress security checks, you’ll be well on your way to secure your WordPress website for good.
WordPress Security in Easy Steps (No Coding)
- Install a WordPress Backup Solution
- Best WordPress Security Plugin
- Enable Web Application Firewall (WAF)
- Move WordPress Site to SSL/HTTPS
Secure your WordPress website by protecting the login page and preventing brute force attacks
Everyone knows the standard WordPress login page URL. The backend of the website is accessed from there, and that is the reason why people try to brute force their way in. Just add /wp-login.php or /wp-admin/ at the end of your domain name and there you go.
What I recommend is to customize the login page URL and even the page’s interaction. That’s the first thing I do when I start securing my website.
Here are some suggestions for securing your WordPress website login page
1. Set up a website lockdown feature and ban users
A lockdown feature for failed login attempts can solve the huge problem of continuous brute force attempts. Whenever there is a hacking attempt with repetitive wrong passwords, the site gets locked, and you get notified of this unauthorized activity.
2. Use two-factor authentication for WordPress security
Introducing a two-factor authentication (2FA) module on the login page is another good security measure. In this case, the user provides login details for two different components. The website owner decides what those two are. It can be a regular password followed by a secret question, a secret code, a set of characters, or more popular, the Google Authenticator app, which sends a secret code to your phone. This way, only the person with your phone (you) can log in to your site.
I prefer using a secret code while deploying 2FA on any of my websites.The Google Authenticator plugin helps me with that in just a few clicks.
3. Use your email to login
By default, you have to input your username to log into WordPress.Using an email ID instead of a username is a more secure approach. The reasons are quite obvious. Usernames are easy to predict, while email IDs are not.Also,any WordPress user account is created with a unique emailaddress,making it a valid identifier for logging in.
Several WordPress security plugins allow you to set up login pages so that all users must use their email addresses to log in.
4. Rename your login URL to secure your WordPress website
- Change /wp-login.php to something unique; e.g. /my_new_login
- Change /wp-admin to something unique; e.g. /my_new_admin
- Change /wp-login.php?action=register to something unique; e.g. /my_new_registeration
Secure your WordPress website through the admin dashboard
For a hacker, the most intriguing part of a website is the admin dashboard, which is indeed the most protected section of all. So, attacking the strongest part is the real challenge. If accomplished, it gives the hacker a moral victory and the access to do a lot of damage.
Here’s what you can do to secure your WordPress website admin dashboard:
5. Protect the wp-admin directory
The wp-admin directory is the heart of any WordPress website. Therefore,if this part of your site gets breached, then the entire site can get damaged.
One possible way to prevent this is to password-protect the wp-admin directory. With such a WordPress security measure, the website owner may access the dashboard by submitting two passwords. One protects the login page, and the other secures the WordPress admin area. If the website users are required to get access to some particular parts of the wp-admin, you may unblock those parts while locking the rest.
You can use the AskApache Password Protect plugin for securing the admin area. It automatically generates a .htpasswd file, encrypts the password and configures the correct security-enhanced file permissions.AskApache Password Protect
6. Use SSL to encrypt data
Implementing an SSL (Secure Socket Layer) certificate is one smart move to secure the admin panel. SSL ensures secure data transfer between user browsers and the server, making it difficult for hackers to breach the connection or spoof your info.
Getting an SSL certificate for your WordPress website is simple. You can purchase one from a third-party company or check to see if your hosting company provides one for free.
The SSL certificate also affects your website’s Google rankings. Google tends to ranks sites with SSL higher than those without it. That means more traffic. Now who doesn’t want that?
7. Change the admin username
During your WordPress installation, you should never choose “admin” as the username for your main administrator account. Such an easy-to-guess username is approachable for hackers. All they need to figure out is the password,then your entire site gets into the wrong hands.
I can’t tell you how many times I have scrolled through my website logs, and found login attempts with username “admin”.
The iThemes Security plugin can stop such attempts by immediately banning any IP address that attempts to log in with that username.
8. Monitor your files
If you want some added WordPress security, monitor the changes to your website’s files via plugins like Wordfence.
Secure your WordPress website through the database
All of your site’s data and information is stored in the database. Taking care of it is crucial. Here are a few things you can do to make it more secure:
9. Change the WordPress database table prefix
If you have ever installed WordPress then you are familiar with the wp- table prefix that is used by the WordPress database. I recommend you change it to something unique.
Using the default prefix makes your site database prone to SQL injection attacks. Such attacks can be prevented by changing wp- to some other term. For instance, you can make it mywp- or wpnew-.
If you have already installed your WordPress website with the default prefix, then you can use a few plugins to change it. Plugins like WP- DBManager or iThemes Security can help you do the job with just a click of a button. (Make sure you back up your site before doing anything to the database).
10. Make backups regularly to secure your WordPress website
No matter how secure your WordPress website is, there is always room for improvements. But at the end of the day, keeping an off-site backup somewhere is perhaps the best antidote no matter what happens.
If you have a backup, you can restore your WordPress website to a working state any time you want. There are some plugins that can help you in this respect.For instance, there are all of these.
If you are looking for a premium solution then I recommend VaultPress by Automattic, which is great. I have it set up so it creates backups every week.And should anything bad ever happen, I can easily restore the site with just one click.
I know some larger websites run backups every hour, but for most organizations that is complete overkill. Not to mention, you would need to ensure that most of those backups are being deleted after a new one is made since each backup file takes up space on your drive. That said, I’d recommend weekly or monthly backups for most organizations.
On top of the backups, VaultPress also checks my site for malware and alerts me if anything shady is going on.
11. Monitor your audit logs
When you’re running WordPress multisite, or handling a multi-author website, it’s essential to understand what type of user activity is going on. Your writers and contributors might be changing passwords, but there are other things you might not want to happen. For instance, theme and widget changes are obviously only reserved for the admins. When you check the audit log you’re able to make sure that your admins and contributors are not trying to change something on your site without approval.
The WP Security Audit Log plugin provides a full list for this activity, along with email notifications and reports. At its simplest, the audit log could help you see that a writer is having trouble logging in. But the plugin might also reveal malicious activity from one of your users.
Let the host handle your WordPress security
Almost all hosting companies claim to provide an optimized environment for WordPress, but we can still go a step further:
12. Protect the wp-config.php file
The wp-config.php file holds crucial information about your WordPress installation, and it’s the most important file in your site’s root directory.Protecting it means securing the core of your WordPress blog.
This tactic makes things difficult for hackers to breach the security of your site, since the wp-config.php file becomes inaccessible to them.
As a bonus, the protection process is really easy. Just take your wp- config.php file and move it to a higher level than your root directory.
Now, the question is, if you store it elsewhere, how does the server access it? In the current WordPress architecture, the configuration file settings are set to the highest on the priority list. So, even if it is stored one folder above the root directory, WordPress can still see it.
13. Disallow file editing
If a user has admin access to your WordPress dashboard they can edit any files that are part of your WordPress installation. This includes all plugins and themes.
If you disallow file editing, no one will be able to modify any of the files – even if a hacker obtains admin access to your WordPress dashboard.
To make this work, add the following to the wp-config.php file (at the very end):
define('DISALLOW_FILE_EDIT', true);
14. Connect the server properly
When setting up your site, only connect the server through SFTP or SSH. SFTP is always preferred over the traditional FTP because of its security features that are, of course, not attributed with FTP.
Connecting the server this way ensures secure transfers of all files.Many hosting providers offer this service as part of their package.
15. Set directory permissions carefully
Wrong directory permissions can be fatal, especially if you’re working in a shared hosting environment.
In such a case, changing files and directory permissions is a good move to secure the website at the hosting level. Setting the directory permissions to “755” and files to “644” protects the whole file system – directories, subdirectories, and individual files.
This can be done either manually via the File Manager inside your hosting control panel, or through the terminal (connected with SSH) – use the “chmod” command.
16. Disable directory listing with .htaccess
If you create a new directory as part of your website and do not put an index.html file in it, you may be surprised to find that your visitors can get a full directory listing of everything that’s in that directory.
For example, if you create a directory called “data”, you can see everything in that directory simply by typing http://www.example.com/data/ in your browser. No password or anything is needed.
You can prevent this by adding the following line of code in your .htaccess file:
Options All -Indexes
Secure your WordPress website through themes and plugins
Themes and plugins are essential ingredients for any WordPress website. Unfortunately, they can also pose serious security threats. Let’s find out how we can secure your WordPress themes and plugins the right way:
17. Update regularly for WordPress security
Every good software product is supported by its developers and gets updated now and then. These updates are meant to fix bugs and sometimes have vital security patches. WordPress, and its plugins, is no different.
Not updating your themes and plugins can mean trouble. Many hackers rely on the mere fact that people can’t be bothered to update their plugins and themes. More often than not, those hackers exploit bugs that have already been fixed.
So, if you’re using any WordPress product, update it regularly. Plugins, themes, everything. The good news is that WordPress automatically rolls out updates for its users, so you’ll receive an email notifying you of the update and information on the fixes in your dashboard.
As for the plugins, these must be updated manually by going to Plugins in your dashboard. When a plugin has a new version, it notifies you and provides a link to update now.
18. Remove your WordPress version number
Your current WordPress version number can be found very easily. It’s basically sitting right there in your site’s source view. You can also see it on the bottom of your dashboard (but this doesn’t matter when trying to secure your WordPress website).
For a more manual approach (and to also remove the version number from RSS feeds) consider adding the following function to your functions.php file:
function wpbeginner_remove_version() {
return '';
}
add_filter('the_generator', 'wpbeginner_remove_version');
