Powering over a million websites across the globe, WordPress is a favourite among website designers and developers. But this popularity comes at a price. It makes WordPress sites the preferred target of hackers, making WordPress security a big matter of concern for website owners. Naturally, it brings us to the next question.
Is WordPress Secure?
The short answer is yes. As a platform, WordPress is free and secure. Its developers periodically ensure its safety and release updates and patches as soon as a vulnerability is exposed to protect WordPress sites from hackers.
But the truth is that no WordPress site exists in isolation. It uses third-party plugins, and themes are developed and managed by people who may not always follow the best WordPress security practices.
One example is when website owners fail to install WordPress updates and continue to run their sites on outdated, therefore, known, vulnerable versions.
A good WordPress security plan is a strong foundation of security practices that ensure that it's harder for hackers to reach, gain access to, and damage your site.
We've put together this WordPress security guide so you know exactly how to secure a WordPress site.
15 Best Practices for WordPress Security
Let us now get down to 15 of the proven WordPress security best practices that can keep your website safe from hackers:
1. Use Secure Hosting
Your WordPress web host is responsible for the web server-level security of your site. When it comes to WordPress website security, try shifting to a secured or more managed host. One of the ways to start is by finding the right host that can offer security features like SSL certification, regular backups, and malware scanning services.
Hosting companies like Bluehost and Kinsta are the best choices for hosting WordPress sites.
Besides that, if you are running your website on a shared web host (that hosts multiple websites), it is probably a good time to switch to managed hosting with dedicated server resources. With managed hosting, you have improved website speed and better user experience, which can help supplement your SEO efforts.
2. Create Strong Passwords
The easiest WordPress security measure is to ensure that every new user account is configured with strong passwords to thwart brute-force attacks. These attacks gain unauthorized account access by guessing the right user credentials. The best way to be better prepared against them is by creating stronger, hard-to-guess passwords.
Weak passwords like “12346” or “password” make life easier for hackers. Make sure your passwords are alphanumeric, with a mix of alphabets, numbers, and special characters like @ or _. Change your passwords regularly (every 3 or 6 months), so that your site remains protected at all times.
3. Enable Two-factor Authentication (2FA)
While stronger passwords are a must-have, adding up another layer of security, like a 2FA, is a smart move to protect your website. In 2FA, a one-time password (OTP) or secret code is sent to your device after you enter your login credentials at the first step. You need to enter this code at the second step.
Simply put, 2FA adds another layer of protection to your login.
For WordPress sites, all you need to do to enable 2FA is to install a 2FA plugin like Google Authenticator.
4. Change your Default “admin” Username
Do you continue to use your default WordPress administrator with the “admin” username? That could be a security threat and can facilitate brute-force attacks on your login page.
The practical solution for securing the WordPress login page is to change the default administrator username to something more unique and tough to guess. Another option is to remove the default admin user and create a new administrator with a unique username.
5. Prevent Brute Force Attacks
Remember we discussed brute attacks in point 2? Well, strong passwords and 2FA are not sufficient to prevent brute force attacks as hackers can still devise new ways to guess user credentials. So, you need more to secure your login pages.
Here are some additional measures:
6. Keep your Site Updated at all Times
We can't stress this enough- most successful hacks happen on WordPress sites with old or outdated software versions. Hence, continuing to run your website on an older software version can be a major security risk.
Hackers often exploit security flaws in older WP versions to their advantage. One of the most effective practices to ensure security for WordPress sites is to regularly update your WordPress core as well as your installed plugins and themes to the latest WordPress version.
7. Regularly Back Up your Website
Though strictly not a security measure, WordPress security is incomplete without regular backups of your website files and database tables. Having a handy backup ensures that you minimize downtime and the risk of data loss.
While you can take backups manually, automated backup plugins like BlogVault or BackupBuddy can help you schedule backups at a frequency of your choice.
8. Add an SSL Certificate
What does an SSL certificate do? Effectively, SSL (or Secure Socket Layer) encrypts all the data transmitted between your website and the user's browser.
Move your site from HTTP to Secure HTTP (or HTTPS) to ensure the safety of your data as well as that of your website's visitors. There's another advantage of switching to HTTPS. An SSL-enabled website is also favoured and ranked higher by the Google search engine.
You can get an SSL certification from your current web hosting company – or obtain it independently using third-party SSL plugins like Let's Encrypt or DigiCert.
9. Harden your WordPress Site
If you aim at fortifying your website from a range of online attacks, then WordPress hardening measures are technical measures recommended by the WordPress security team.
Some of the hardening measures include blocking the execution of PHP files, disabling file editing, changing the security keys, etc. As you can guess, these steps are slightly more technically advanced and need a working knowledge of the WordPress backend and other tools.
If you're looking for an effortless way to harden your site, you can use the inbuilt WordPress hardening functionality that WordPress security plugins like MalCare contain. You can use MalCare's WordPress hardening workflow to implement most hardening measures in a few clicks via its dashboard.
10. Limit User Access to your Site.
Unlimited user access to critical WordPress areas like the Administrator panel can be a major security risk. The more the number of authorized users, the easier it is for hackers to compromise any of these user accounts and gain website access.
One proven way of making WordPress secure is to limit access only to trusted users or those with admin rights. Users with lesser privileges, like subscribers or contributors, must be configured with restricted access.
11. Use a WordPress Security Plugin
One of the reasons we recommend an automated security plugin is that you can't manually protect your website against various hacks 24/7 – all day, every day. Security plugins are designed to continuously scan and detect malware on your site so they can detect (and clean) even harder-to-detect malware that you may miss.
There's another reason why security plugins are probably the best way to secure a WordPress site. Security plugins like Sucuri and MalCare, in addition to malware scanning and removal, also combine most of the steps mentioned in this WordPress security guide.
For instance, the MalCare security plugin combines WordPress login measures such as user management, 2FA, etc., with more advanced features like WordPress hardening and firewall protection to take you closer to 360° website protection.
12. Disable XML-RPC in WordPress
Also referred to as XML Remote Procedure Call, the XML-RPC feature in WordPress enables remote users to upload files to your WordPress site. This is an older WordPress version feature, which is still active in the latest versions. As this can be a security threat, it is recommended to disable this feature.
All you need to do is to install and activate the “Disable XML-RPC” plugin for WordPress sites.
13. Disable Directory Browsing
For self-hosted websites, the directory browsing facility is convenient – but can be exploited by cybercriminals to search for vulnerable plugins/themes and backend website files. Hackers can use FTP tools to gain access to your WordPress installation directory and explore the backend files.
The best way is to disable directory browsing using the FileZilla FTP tool. You can do this by adding a line to your “.htaccess” file.
Options -Indexes
14. Hide WordPress Version
Recommended for all WordPress users, hiding or removing the WordPress version can be effective in stopping most cyberattacks. Once hackers come to know your WordPress version, they can exploit vulnerabilities that are specific to this version.
You can either perform this task by making manual changes to your code. To do this, you need to place a code in the function.php file as shown below:
Step 1: In your host account, navigate to the public_html folder (cPanel > File Manager > public_html).
Step 2: Within the public_html folder, access wp-content select the folder of your active theme and look for the function.php file.
Step 3: Right-click on the function.php file and select Edit. Here, place the following code.
[php]
function wpbeginner_remove_version() {
return ”;
}
add_filter(‘the_generator’, ‘wpbeginner_remove_version’);
[/php]
Save these changes to remove the WordPress version number from being displayed anywhere on your site.
15. Change your Database Prefix
Hackers can easily target your WordPress database by searching for database tables prefixed with the default “wp_” notation. You can easily change this default database prefix by modifying the following parameter in the wp-config.php file:
$table_prefix = ‘wp_';
Each of these 15 measures is designed to improve the security of your WordPress site. Next, let us look at 6 common vulnerabilities plaguing WordPress sites in 2021.
The Vulnerabilities of a WordPress Site
How do hackers take advantage of outdated versions, insecure databases, and improper user roles? Here are six types of vulnerabilities that are commonly inflicted on WordPress sites:
1. SQL Injection
This attack is aimed at WordPress users who use the MySQL database to store their records. Once hackers gain access to your WordPress database, they can easily take control of your website. With SQL injections, hackers can create suspicious user accounts assigned with admin rights to compromise your site.
2. Cross-Site Scripting (XSS)
Typically, cross-site scripting or XSS attacks are facilitated when WordPress users install a vulnerable plugin on their site. This loads a malicious JavaScript code that can steal valuable data without being detected. Online form plugins are commonly used for XSS attacks.
3. Phishing
For phishing attacks, hackers often exploit the presence of an outdated plugin/theme or weak login credentials. Once they gain access to the WordPress site, they take control and send spam emails (with spam links or attachments) to the registered user base. Through phishing, they can hoax genuine users to share their credit card details or buy fake products.
4. Privilege Escalation
What happens when hackers take control of a user account with lower privileges like that of a subscriber or contributor? They cannot inflict much damage, which is why they use privilege escalation to override the existing user privileges. This type of attack is also caused by plugin vulnerabilities that allow them to override the default permissions assigned to them.
5. Pharma Hack
Also known as SEO spam, pharma hacks are made possible by vulnerable plugins/themes or weak credentials. Once they gain website access, hackers install the favicon.ico malware to target high-ranking web pages and infect them with spam keywords. The aim is to list the target website for keywords selling fake or banned pharmaceutical products.
6. Japanese Keyword Hack
Much like pharma hacks, the Japanese keyword hack injects spam Japanese keywords into your web pages.
When your web pages are indexed by search engines, they end up getting listed on search results for these unrelated and spammy keywords. Unsuspecting users then click the links and are redirected to unsolicited sites run by hackers.
Why is WordPress Security Important?
The six common vulnerabilities discussed in the previous section are just some of the better-known ways hackers target WordPress sites. A hack damages more than just a website; it can impact every aspect of your business. Here are just some of the ways a hack does that.
Though no security measures can promise you 100% protection from hackers, following these 15 practices is the best you can do to make the lives of hackers harder.
In matters of WordPress security, “prevention is better than cure” is more than just another cliché. These measures are as big a part of your website maintenance plan as creating content or focusing on SEO.
Hope you find these 15 measures easy to implement for your WordPress site. Still need any help? feel free to connect.
