How To Secure WordPress – Complete Guide
In the news you will hear a lot about hacking, hackers, and information that has been stolen. You will find yourself getting a bit worried about your information, especially if you have a website. WordPress users need to be vigilant about protecting themselves, especially if the install is tied to an ecommerce solution. If you have used WordPress for some time right now, you are going to need to take on a few tips that will help you ensure that your traffic doesn’t get hijacked. You also don’t want to have your backend stolen and then rerouted. There’s so many issues that could cause your WordPress to go down, that you should adhere to the following 5 tips that will help you out against hackers.
Use A WordPress Brute-Force Plugin
The first thing that you need to do is look into WordPress brute-force plugin options. These block scripting from hitting your password page and literally hijacking the entry point. When your site’s admin area is attacked by this forceful entry point it breaks the password system and grants people access to your admin. You do not want to let anyone into your WordPress, especially for those that have multiple authors, comments, emails, and more. Lock things down by finding a plugin that will block this sort of nefarious attack. You will be surprised how just a little protection can help your WordPress.
If you’re looking to secure WordPress check out our most recommended security plugin:
WordFence
WordFence is widely used by WordPress users as it scans your files, plugins and themes in real-time for malware. WordFence is fully open-source and claims to make your site faster by using the Falcom caching engine. The plugin is free however some advanced features do have a price but using the free version will be more than enough for most users. WordFence also support WordPress MU (multi-user) which is definitely a plus.
Disable Pingback in WordPress (stop xmlrpc.php attacks)
Another thing that you have to consider is the pingbacks that you receive. You will want to disable them so that you do not get attacked because of it. There are some nefarious individuals that will take this simple ping solution and turn it against you. When you are attacked in this manner, you may not realize it until it’s too late. You will want to add simple scripting when you work with your WordPress option. Consider updating your php a bit with a script that will deny access.
In order to work with this, you will need to look into adding the following scripting:
“<Files “xmlrpc.php”>
Order Allow,Deny
deny from all
</Files>”
Edit your .htaccess file with that scripting and you should have some help with thwarting the ping issue of WordPress.
Keep Themes and Plugins Up To Date
Here is the number one thing that you can do when you install WordPress. You absolutely need to make sure that you protect your WordPress installation from hackers by plugging up holes that you could inflict yourself. Keep your themes up to date. This is a simple one press thing to get done. Don’t let your template, theme, or code go stale, update it often. With that in mind, make sure that you focus on the plugins and update them properly. Make absolutely sure that you are updating the plugins from time to time or you will end up with diminished and inaccurate code. When the code is old, you can leave your WordPress open to hackers and they can just modify a few lines of code before jumping into your site.
Use Stronger Passwords
This has been repeated often, but it begs repeating yet again. You absolutely want to use the strongest passwords that you can think of. A great password uses different capitalization, different numbers, and lots more. You have to think about the password that you have now and then turn it on its head with randomizing. In regards to WordPress, it’s best not to just have something simple. Focus on complexity, and if you can’t think of anything, look online for a tool that randomizes password for you. You’ll be surprised by how complex some password can become, and how many help you build on the right elements moving forward. Stronger passwords will help your WordPress stay locked down.
If you’re having trouble thinking of a password use this Free Password Generator Tool.
Back Up Your Site Often
If you do nothing else, you might as well pay attention to this tip as it could very well save you many times over, back up your WordPress. Not just the actually files, but the database as well. Make sure that you back up often, and if you don’t know how, look to see if your hosting company has a tool to use. There’s a lot of different ways that you can work with this. Do not just set up a site and use WordPress then forget about it. You need to back things up often, just in case you are hacked and you have to revert to an older saved state. This will save you if you forget about the rest, and will definitely help you keep things tightened up moving forward.
