In web development, it is very common to see WordPress website owners busy with security concerns.
The most common opinion is that open-source software is vulnerable to all kinds of attacks. But this is not true; in fact, it is usually the other way around. Or rather, it is partially true, but still, WordPress is not to blame.
Why? Because it is usually the responsibility of the developer that the site has been hacked. There are some responsibilities that you must have as a website owner. So, the critical question is always: what are you doing to ensure the security of your website?
Currently, Temok ensures the security of your website hosted on our hosting servers. Here are some simple tricks that can help you protect your WordPress site:
Table of Contents
Protect the login page and avoid brute force attacks
Everyone knows the default URL of the WordPress login page. The website backend is accessed from there, and that is why people try to use brute force. By simply adding /wp-login.php or /wp-admin/ to the end of your domain name. It is a point to take into account to achieve the optimization of your WordPress.
What we recommend is customizing the URL of the login page. This is the first thing you should do to start protecting your website.
Here are some more tips to protect your login page:
1. Set up site blocking and ban users
A lockout feature that limits the number of login attempts can solve this problem, as the cybercriminal will no longer be able to use brute force to test thousands of passwords. Whenever someone tries to hack with wrong passwords repeatedly, the site will crash, and you will be notified of this unauthorized activity.
The iThemes Security plugin is one of the best plugins of its kind. Allows you to specify the number of login attempts, after which the plugin prohibits access from the attacker’s IP address. You can also use the “Wordfence Security – Firewall & Malware Scan” plugin by wordfence created to solve just this problem.
2. Use two-factor authentication
Using 2-factor authentication (2FA) on the login page is another good security measure. In this case, the user provides login details with two different components. The website owner decides what those two factors are. It can be a regular password followed by a secret question, a secret code, a character set, etc.
Some people prefer to use secret code when implementing 2FA on their websites. The Google Authenticator plugin can help with that in just a few clicks. Install Google Authenticator app on your mobile and access your website with a secure 2FA process.
3. Use email as login
By default, you must enter your username to log in. Using your email ID instead of a username is a bit more secure approach for protecting your website. The reasons are pretty obvious. Usernames are simple and easy to predict, while email IDs are complex and difficult to guess. Also, any WordPress user account is always created with a unique email address, which makes it a valid login identifier.
The WP-Email Login plugin works great for this. It starts working immediately after activation and does not require any configuration.
4. Rename your login URL
Changing the login URL is very easy to do. By default, the WordPress login page can be easily accessed by adding wp-login.php or wp-admin to the main URL of the site. When hackers know the URL of your login page, they can try to use brute force.
This little trick prevents someone from entering the login page. Only someone with the exact URL can do this. Once again, the iThemes Security plugin can help you change your login URLs.
You can change wp-login.php to something unique; for example my_new_login
And change / wp-admin / with something like for example my_new_admin
5. Set your passwords
Change site passwords regularly. Improve key strength by adding uppercase and lowercase letters, numbers, and special characters.
Protect your admin panel
For a hacker, the most desired part of a website is the Admin Panel, which is, in fact, the most protected section of all. So attacking the most vital part is the real challenge, and if accomplished, this gives the hacker a moral victory and access to do massive damage. We know this is super important; that’s why you need to be a proactive man.
Here’s what you can do to protect yourself:
6. Protect the wp-admin directory
The wp-admin directory is the heart of any WordPress site. Therefore, if this part of your site is hacked, the entire site could be damaged. One way around this is to password protect the wp-admin directory. With this security measure, the website owner can access the panel using two passwords. One protects the login page, and the other protects the WordPress admin area. If site users are forced to access specific parts of wp-admin, you can unblock those parts while blocking the rest.
You can use the AskApache Password Protect plugin to protect the admin area. This automatically generates a .htpasswd file, encrypts the password, and configures the file’s security permissions.
7. Use SSL to encrypt data
Implementing an SSL certificate is a smart move to protect your admin panel. The SSL certificate ensures the secure transfer of data between users’ browsers and the server, making it difficult for hackers to invade or falsify your information.
Obtaining an SSL certificate for your WordPress site is very simple. You can easily purchase your certificate or even use a free SSL certificate.
The SSL certificate also affects your site’s ranking on Google. Google ranks sites with SSL higher than those without. That means more traffic.
8. Add user accounts carefully
If you have a WordPress site with multiple authors, you must deal with multiple people accessing your admin panel. This can make your site more vulnerable to security threats.
You can use a plugin that forces your users to use strong passwords to ensure that the passwords they use are. This is just a precautionary measure.
9. Change the administrator username
When installing WordPress, you should never choose “admin” as the username for your main administrator account. This username is easy to guess and accessible to hackers. Half of the hackers’ work will be done; they will only need to find the password since they already know the administrator ID.
10. Monitor your files
If you want to add some extra security, you can monitor website file changes through plugins like Wordfence.
Protect the database
All data and information on your website are stored in the database. Taking care of this is crucial. Here are some things you can do to make them more secure:
11. Change the prefix of the WordPress database table.
If you’ve already installed WordPress, you probably know the wp-table prefix used by the database. It is recommended that you exchange this for something unique.
Using the standard prefix makes the website database prone to SQL injection attacks. This attack can be prevented by changing “wp-” to some other term; for example, you can use “miwp-“, “wpnew-“, and so on.
If you already installed your WordPress site with the default prefix, you can use some plugins to change it. For example, WP-DBManager or iThemes Security can help you get the job done with the click of a button. (Make sure to backup your website before doing anything to the database.)
12. Back up your website regularly
No matter how secure your site is, there is always room for improvement. And in the end, keeping a backup away from your original server is perhaps the best antidote, no matter what.
If you have a backup, you can always restore your WordPress site to a previous state whenever you want. Some plugins can help you in this regard.
If you are looking for a premium solution, Automattic’s VaultPress is a good choice. It can be configured to create backups every 30 minutes or as often as you like. And if something terrible happens, you can quickly restore the site with just one click. Furthermore, it also checks the website for malware and notifies if something strange is happening.
Another option is to use the DropMySite website. Make daily backups of your files and databases, and it is straightforward to restore if you have any problems.
13. Establish solid passwords for your database
A strong password for the primary database user is essential.
As always, try to use uppercase, lowercase, numbers, and special characters in order to create a securer and stronger password. We recommend once again using a password generator for this.
Protect Your Hosting Settings
Even though the hosting plans provide an optimized environment for WordPress, we can still go one step further:
14. WAF (web application firewall)
When it comes to hosting protection, there is nothing more efficient and complete than the new concept of Web Firewall, better known as WAF – Web Application Firewall for WordPress.
WAF for WordPress is an access filter for a hosting server, which applies a set of rules to protect your website from common attacks, such as Cross-Site Scripting (XSS), SQL Injection, and DDoS. All this, even before the attacker reaches your hosting server.
15. Protect the wp-config.php file
The wp-config.php file contains crucial information about WordPress installation and is, in fact, the most critical file in the root directory of your website. Protecting it means protecting the core of your WordPress site.
It is difficult for hackers to breach your website security if the wp-config.php file becomes inaccessible to them.
The good news is that doing this is easy. Just take your wp-config.php file and move it to a higher level than the root directory.
Now the question is, if you store it elsewhere, how will you access the server? In today’s WordPress architecture, even if the configuration file is stored one level above the root directory, WordPress will still be able to see it.
16. Forbid file editing
If a user has administrator access to your WordPress panel, they will be able to edit any file that is part of the installation. This includes all plugins and themes.
However, if you don’t allow file editing, even if a hacker gains admin access to your WordPress dashboard, they won’t be able to edit any files.
Add the following to the wp-config.php file (at the end):
define ('DISALLOW_FILE_EDIT', true);
17. Set directory permissions carefully
The incorrect directory permissions can be fatal, especially if you are working on a shared hosting environment.
In that case, changing the file and directory permissions is a good decision to protect the site at the hosting level. Setting directory permissions to “755” and files to “644” protects the entire file system, directories, subdirectories, and individual files.
This can be done manually through the File Manager within the control panel.
18. Disable directory listing with .htaccess
If you create a new directory on your site and don’t put an index.html file inside it, you will be surprised to find that your visitors can see a complete list of the directory and everything in it.
For example, if you create a directory called “data,” you can see everything in that directory simply by typing http://www.Demo.com/data/ in your browser. No password required or anything.
You can avoid this by adding the following line of code to your .htaccess file:
Options All -Indexes
Protect Your WordPress Themes and Plugins
Themes and plugins are essential parts of any WordPress website. Unfortunately, they can also pose serious security threats. Here’s how you can protect WordPress themes and plugins the right way:
19. Update periodically
Every good software product is supported by its developers and is updated frequently; WordPress is no exception and is updated very frequently. These updates are intended to fix bugs and sometimes have critical security patches.
Not updating your themes and plugins can mean serious problems. Many hackers trust people not to bother updating their plugins and themes. Most of the time, these hackers take advantage of bugs and security flaws that have been fixed in the current versions.
So if you are using WordPress products, regularly update plugins, themes, everything. To assist you at this point, you need to keep everything always up-to-date.
20. Hide the WordPress version number
The version number of WordPress you use can be found very quickly. This is essential; if hackers know which version of WordPress you are using, it is easier for them to create the perfect attack. Almost all the security plugins we mentioned above can help you by hiding the WordPress version number.
Conclusion
It is essential today that our website is protected against attack by hackers. All these tools that we indicated above will help you improve the security of your WordPress website. If you need help at this point, do not hesitate to request it. I am waiting to know your experience; write a comment in the box and let me know if you have faced any problems.
Recommended Article: Data Breach: Common Causes, Process and Prevention Methods