Why is Website Security Important?
If your WordPress site got hacked, it can be proven very harmful to your business revenue and reputation. Hackers can steal user information, passwords, install malicious software, and can even distribute malware to your users. Moreover, you may find yourself paying compensation to the hackers to regain your website.
For your information, Google blacklists around 20,000 websites for malware and around 50,000 for phishing each week. So, if your business on your website, you should pay an extra attention to your WordPress security.
Now if you want to secure your website, there are 15 ways given below by which you can assure Bulletproof Security for your WordPress Website.
1. Keep Your Computer, WordPress Core, Themes and Plugins up to date:
The most common reason for getting a website hacked is being an outdated component. Outdated plugins, themes, and core open the portal for a potentially hacked site. When left un-updated, these outdated files gets easy to track and make your site a target by outside illegal intruders. In one study 54 percent of reported that WP security vulnerabilities belonged to outdated WordPress plugins.
So Bulletproof Security for your WordPress Website, whenever you see an orange notification in your website dashboard next to plugins, themes or a notification to upgrade WordPress, update as soon as possible
2. Regular Backup your WP site:
Backing up your site is very easy to do. For backup, you can use many kinds of plugins like BackupBuddy. Even if you take security precautions, you should backup your site regularly. This may save your WP site and property.
You can try many plugins to backup your WordPress site like:
3. Strong Passwords and Usernames:
You have to strain a strong password and username. A password that contains your very personal information like birth date, year etc. makes it easier for hackers to crack the code using brute force automated scripts, which continuously try to guess your password and username over and over. For ensuring that your passwords are strong you can try some tools like Strong Password Generator or Strong Random Password Generator.
However, in the latest version of WordPress, when you try to create an account, WordPress automatically generates strong passwords.
4. Two Factor Authentication(2FA):
Two-factor authentication can add an extra layer to your WordPress site security. Two-factor authentication works by requiring a second factor of information that only you can give, like a code sent to your mobile phone to verify your activity on a specific computer. If you follow this step it’s harder to steal your information if they try to log in to a different device.
We are giving some WP plugins you can use for 2FA:
We think if you follow this step, you can save your WP site from hackers.
5. Change the ADMIN Username:
At the time of installation, you should never use “ADMIN” as your username for your main administrator account. This is very common and easy to guess to the hackers. If they know your username, all they need to know the password and your site will be theirs.
Removing or changing the “ADMIN” username is the next step to improving your site security. To do this just simply go to the “USERS” section of the WordPress admin panel and rename or delete the “ADMIN” account or username.
The iThemes Security plugin can stop such attempts cleverly by immediately banning any IP address that attempts to log in with that username.
6. Change the WP Database Table Prefix:
If you want to add some extra security for Bulletproof Security for your WordPress Website, you can change the WordPress database table prefix. At the time of installation of WordPress, you can see the “wp” table prefix that is used by the WordPress database. It will be better for you if you change it. If you use the default prefix, your site database prone to SQL injection attacks. These attacks can prevent by changing “wp” to “mywp” , “newwp’, “wpnew” etc.
If you have already installed your WordPress website with default, nothing to worry.
There is some plugin you can use to change it like WP-DBManager, iThemes Security and so on.
7. SSL for Data Security:
SSL stands for Secure Socket Layer. I want to get a more secure site, enable SSL. SSL encrypts all information sent to and from your website. This is the way the private data visitors share with your site stays private.
If you use SSL, hackers can’t see or intercept the data your users share on your site. The secure tunnel SSL creates is important with sensitive information, like credit card numbers, usernames, and passwords. If you want to identify whether it is an SSL site or not is so easy. SSL certified sites will start with an HTTPS in the URL address and a site which is not SSL certified will begin with HTTP. You can get a free SSL certificate with Let’s Encrypt.
8. Hide Your WordPress Version:
If you postpone WordPress updates, you should hide your WordPress version. It leaves footprints and gives useful and necessary information to the hacker. There is some way how can you hide your WordPress version number:
(PSD to WordPress Conversion, PSD to HTML, PSD to DRUPAL )
The generator meta tag in the header:
<meta name="generator" content="WordPress 4.0" />
Query strings on scripts and styles:
subscriptions.css?ver=4.0
Generator tag in RSS feeds:
http://wordpress.org/?v=4.0
To hide your WP version in all three areas add this code to your function.php file:
/* Hide WP version strings from scripts and styles
* @return {string} $src
* @filter script_loader_src
* @filter style_loader_src
*/
function fjarrett_remove_wp_version_strings( $src ) {
global $wp_version;
parse_str(parse_url($src, PHP_URL_QUERY), $query);
if ( !empty($query['ver']) && $query['ver'] === $wp_version ) {
$src = remove_query_arg('ver', $src);
}
return $src;
}
add_filter( 'script_loader_src', 'fjarrett_remove_wp_version_strings' );
add_filter( 'style_loader_src', 'fjarrett_remove_wp_version_strings' );
/* Hide WP version strings from generator meta tag */
function wpmudev_remove_version() {
return '';
}
add_filter('the_generator', 'wpmudev_remove_version');
You should also make sure that your readme.html file is removed for Bulletproof Security for your WordPress Website. Because this exposes the version number.
9. Rename or Relocate Your Login Page
To make Bulletproof Security for your WordPress Website, you can relocate your login page. It not only hides the fact you are on WordPress but also limits brute-force attack on your login page.
If someone tries to hack your WordPress website and came across a 404 error upon entering your login page, say www.site.com/wp-login.php, they’d likely be deterred from breaking in.
There are many kinds of plugins you can use to rename your login page like iThemes Security, Rename wp-login.PHP, Move Login etc. Before taking any action firstly consult with your web dost or developer to ensure that you are taking the right path.
10. Protect the wp-config.php File:
The wp-config.php file contains confidential information about your WordPress installation. Protecting it means protecting the core of your WordPress blog. It is very difficult for a hacker to break the security of your site wp-config.php. Because the file becomes inaccessible to them.
This step is very easy, just take your wp-config.php file and move it to a higher level than your root directory. Moreover even it is stored one fold above the root directory, WordPress can still see it. SO don’t worry following this step, your site will be protected.
11. Disallow File Editing:
If a user has admin access to your WordPress dashboard then they can edit any files that are part of your WordPress installation. All plugins and themes have this feature.
If you disallow file editing, even if the hacker gets admin access to your WordPress dashboard, he still can’t modify any of your files or can’t steal any of your data.
You can do this step like this. Add this to your config.php file:
define('DISALLOW_FILE_EDIT', true);
12. Directory Permissions:
Wrong directory permissions can be proven very dangerous while you are working in a shared hosting environment.
Although changing files and directory permissions is good to secure your WordPress website at the hosting level. You can set the Permissions to “755” to “644” to protect your whole filesystem like individual files, directories, subdirectories etc. You can do this following 2 steps. You can do this manually from the File Manager inside your hosting control panel or through the terminal using the “CHMOD” command. You can also use the iThemes security plugin to check the current permission settings of yours.
13. Securing WP-CONFIG File:
Your website’s root information like database connection information is protected to WP-CONFIG file. If you want to secure your WordPress website you have to secure your WP-CONFIG file. To secure your WP-CONFIG.PHP file from instruction, you have to add the code we have given below to your .htaccess file to prevent unwanted surfing:
<files wp-config.php> order allow,deny deny from all </files>
14. Picking the Best Hosting:
If you want to make Bulletproof Security for your WordPress Website, all you want is all the latest security hacks. For that most importantly you need a good hosting provider. Otherwise, you won’t be able to secure your WordPress website fully. In a report, WP White Security said that 41% of WordPress site got hacked for security vulnerabilities on the host. As this report, you must have to do something about your hosting. So pick a good hosting provider who is a specialist in WordPress to include a WP firewall, up-to-date PHP, and MySQL, regular malware scanning, a good customer service team who knows WordPress very well. So pick the best hosting and hosting provider you can afford. Here few hosting we highly recommend:
15. A Secure Hosting Environment:
If you follow all the security tricks but don’t do anything in a secure hosting environment, all your hopes will be nipped in a bud and your beloved WordPress website will be an unsecured one. If you follow the tricks in I have given above and also make secure your hosting with its proprietary security technology, you can ensure Bulletproof Security for your WordPress Website.
That’s all for now! We hope this article helped you to know something about WordPress security. If you liked this article, and have any questions on your mind regarding this article please let us know in the comment section. We will try our best to help you.
Help us grow by sharing this Post!