WordPress is the most popular blogging and CMS system on the Internet which makes it a favorite target for hackers. Having a WordPress site means you have to make some extra efforts in order to protect your and your visitor’s data. Here is a summary of the best practices for WordPress security, that will help you do that. It is important to mention that these measures don’t guarantee 100% protection against hacking attempts, mostly because a 100% secure website doesn’t exist, but they will protect you against the majority of attacks.
Read here the ultimate WordPress security guide [Proven] – Step by Step (2023)
- Tips for your WordPress security:
- Keep your WordPress site and plugins up-to-date and protect your WordPress Admin Area
- Don’t use the “admin” usernames strong passwords consider two-factor authentication make sure your site is on a secured WordPress hosting ensure your computer is free of viruses and malware.
- Get a Secure WordPress Hosting by SiteGround!
- Our team of security specialists works around the clock in order to provide you with a safe WordPress environment that you can use to create your sites without worrying about whether your hosting account is secured or not.
- Automatic WordPress Updates
- Expert Security Team
- State-of-the-art Account Isolation System
- WordPress-specific Firewall
- Latest PHP & MySQL Versions
- Keep your WordPress site and plugins up to date.
It is really important to keep your core WordPress files and all of your plugins updated to their latest versions. Most of the new WordPress and plugin versions contain security patches. Even if those vulnerabilities cannot be easily exploited most of the time, it is important to have them fixed.
Protect your WordPress Admin Area
It is important to restrict the access to your WordPress admin area only to people that actually need access to it. If your site does not support registration or front-end content creation, your visitors should not be able to access your /wp-admin/ folder or the wp-login.php file. The best you can do is to get our home IP address and add these lines to the .htaccess file in your WordPress admin folder replacing xx.xxx.xxx.xxx with your IP address.
<Files wp-login.php>
order deny, allow
Deny from all
Allow from xx.xxx.xxx.xxx
</Files>
In case you want to allow access to multiple computers (like your office, home PC, laptop, etc.), simply add another Allow from xx.xxx.xxx.xxx statement on a new line.
If you want to be able to access your admin area from any IP address (for example, if you often rely on free Wi-Fi networks) restricting your admin area to a single IP address or to a few IPs can be inconvenient. In such cases, we recommend that you limit the number of incorrect login attempts to your site. This way you will protect your WordPress site from brute-force attacks and people trying to guess your password. For such purposes, you can use a nice little plugin called Limit login attempts.
Don’t use the “admin” username.
Most of the attackers will assume that your admin username is “admin”. You can easily block a lot of brute-force and other attacks simply by naming your admin username differently. If you’re installing a new WordPress site, you will be asked for a username during the WordPress installation process. If you already have a WordPress site, you can follow the instructions in our tutorial on how to change your WordPress username.
Use strong passwords.
You will be surprised to know that there are thousands of people that use phrases like “password” or “123456” for their admin login details. Needless to say, such passwords can be easily guessed, and they are on the top of the list of any dictionary attack. A good tip is to use an entire sentence that makes sense to you and you can remember easily. Such passwords are much, much better than single phrase ones.
Consider two-factor authentication.
Enabling two-factor authentication for your WordPress website will significantly improve the security of your website. One of the easiest ways to do this is to use Clef to authenticate using your mobile phone. For all SiteGround users, Clef authors have created an ad-free version of their plugin. Check out our Clef tutorial for more information on that matter.
Make sure you’re site is on a secured WordPress hosting.
Your WordPress site is as secure as your hosting account. If someone can exploit a vulnerability in an old PHP version for example or other services on your hosting platform it won’t matter that you have the latest WordPress version. This is why it is important to be hosted with a company that has security as a priority.
Some of the features that you should look for are:
- Support for the latest PHP and MySQL versions
- Account isolation
- Web Application Firewall
- Intrusion detecting system.
- Ensure your computer is free of viruses and malware.
If your computer is infected with a virus or malware software, a potential attacker can gain access to your login details and make a valid login to your site bypassing all the measures you’ve taken before. This is why it is very important to have an up-to-date antivirus program and keep the overall security of all computers you use to access your WordPress site on a high level.