Do you think hackers just attack big websites such as Microsoft and Time Magazine and don’t bother with small and medium-sized websites? In reality, hackers favour launching attacks on small and medium websites because they know that these websites do not have the infrastructure or skillsets to improve their platform. Let me break the news to you. And they are easy to breach, thus. Here, we’ll show you how to secure a website for WordPress.
Your website is under an equivalent and more substantial possibility that hackers will target you. And the worst part is that you stand to risk everything when hackers break into your network, unlike the major websites that have the money to patch a hacked site. But don’t worry, we’ll cover all the necessary and easy-to-implement measures in this article that will shield your WordPress website from hackers and bots.
TL;DR:
With the assistance of a security plugin like MalCare, many of the security steps mentioned in this article can be enforced very quickly. It conducts the 3 most critical tasks that will ensure that your site stays protected and screening, washing, and security are those.
Early in 2019, more than 10 WordPress plugins were abused by a group of hackers to build rogue user accounts and plant malicious code on compromised pages. Another party of hackers hit gold about a year before it occurred, when they defaced over 1.5 million websites. There is nothing new about security attacks, but hacking attempts on this scale raise the question of how secure a WordPress website is these days? And most specifically, why is there little that WordPress does to protect its users?
Is WordPress Failing to Protect Its Users?
As the highest-profile CMS in the world, WordPress makes sure it’s doing whatever it can to create a stable website construction network, but it can only do so much, sadly. Although there is an army of individuals working to keep WordPress secure, the site does not operate in isolation. It is also the fault of various plugins and themes built on your web to make your site insecure. In fact, most hackers may be connected to a compromised plugin from the hundreds of thousands of hacked WordPress pages that we have investigated. It’s very sad that all these concerns are triggered by the environment built for your website to succeed in.
What’s worse is that a really common target is WordPress websites. There are 75 million WordPress websites on the internet at the time of writing this, and hundreds of new ones are being created each day. At a price, that sort of success arrives. This is setting a target on your back. In those cases, you have to take action to ensure that your site is safe until you wish to switch away from WordPress (which, by the way, doesn’t mean that your site won’t be hacked).
How to Secure a WordPress Website?
For a WordPress website, there are 3 types of security – standard, moderate, and advanced. Basic steps are necessary and simple to carry out. Whereas the advanced and moderate steps provide an added layer of protection and are slightly dangerous. Before practising any of the steps mentioned below, we will advocate taking a full website backup. A quick reboot of your website will get your back up and running if everything doesn’t go according to schedule.
Eager for hackers, bots, and the rest to protect your WordPress website? We recommend that you perform a website security audit and take the following steps:
1. Regularly Update Your Plugins, Themes & Core:
People also fall into the habit of notifications being missed. Either the changes are too regular or when you introduce them or both, they ruin your website. Skipping updates, however, will mean tragedy because WordPress updates do not only bring new functionality and enhancements, they also come with security vulnerability fixes and patches. These flaws welcome intruders to your website, whether in the extensions, themes, or the heart. If you wish to keep hackers at bay, keeping them updated to the new edition is also imperative.
Since updates are regularly published, it’s wise to set aside some time to introduce them every week. Owing to usability concerns, patches are known to interrupt websites. But the good news is, prior to making them on your real site, you can test updates on a staging site (a clone of your website). You can learn how to organise a platform if you like.
2. Always Remove Any Inactive Themes & Plugins
Even in an inactive state, vulnerable themes and plugins are menacing. It’s best to uninstall them if you are not using them. But in the future, if you are going to use the plugin or style, make sure you keep them updated.
3. Remove Abandoned Themes & Plugins
WordPress is the leading CMS in the world and it has an ever-growing plugin and theme repository. Developers build them for different purposes, but it is a different ball game to retain a theme or a plugin. Often, because of factors such as lack of paying users, when developers are unable to concentrate on developing the product, they abandon the software. And the worst thing is that bugs leak through the theme and plugin, without frequent changes. To obtain access to your website, bugs, as we know, can be abused. Removing abandoned themes and plugins and keeping an eye out for abandoned applications is also important.
4. Never Use Pirated Themes & Plugins
It’s enticing to use pirated plugins and themes, but you didn’t realise the booby traps are pirated apps. As soon as you trigger the plugin or theme on your website, they have malicious codes (called backdoors on your WordPress site) pre-installed. It unlocks the door to your web for hackers to reach. You need to immediately uninstall all the pirated applications to stop using it in the future.
5. Choose a Good Hosting Plan
There are 3 key hosts for WordPress: shared, managed and VPS hosting. The cheapest in the bunch is joint hosting and it attracts the most publicity. Without thoroughly understanding about its disadvantages, people prefer to use it to create websites.
In most cases, inexpensive hosting, which evidently functions well, also lacks tools to cope with security threats. It is now a cause of significant cybersecurity problems. In the other hand, hosting services are built to keep the website safe and up and running at all times, such as managed hosting and VPS hosting. (Recommended reading: Comparison to the best hosting providers.)
6. Use Unique Usernames
The WordPress login tab, where hackers and bots try to guess the username and password, launches most hack attempts. If it is easy to guess your code, so the hacker just needs to find out the password. Select a special username that would be impossible to infer.
7. Enforce Strong Passwords
The login page for WordPress is a favourite of hackers. You’ve got to defend it from regular hack attempts, including attacks by brute force. A brute force attack entails automated bots carrying out multiple username and password combinations before they find the correct ones. It is possible to break an easy-to-guess secret within a few minutes. But it can protect against modern password cracking strategies if you have a good password. Here are tips for setting good passwords that will be useful.
8. Limit the Rate of Failed Login Attempts
In brute force attacks, passwords are guessed, as we described earlier, by bots programmed to hack your website. A bot could perfectly avoid guessing the correct passwords by limiting the number of unsuccessful login attempts. Protection dependent on CAPTCHA could easily thwart brute force attacks (like the one offered by MalCare). In this In-Depth Guide to WordPress Login Security, read more about CAPTCHA-based protection.
9. Hide WordPress Login Page
Both WordPress websites have a default ‘yoursite.com/wp-admin’ login page that looks like this.
Hackers create sophisticated bots programmed to perform brute-force attacks on hundreds of thousands of WordPress websites thanks to this information.
One way to stop these threats is to change your login page from ‘yoursite.com/wp-admin’ to something like ‘yoursite.com/newloginpage.’ In the WordPress repository, there are also a few plugins that you can use to change your default login page URL.
10. Remove WordPress Version Number
Although it is a vital step to keep your website up-to-date in order to protect your WordPress website, there are occasions when you may choose to postpone updates.
The new WordPress editor, Gutenberg, for example, is very distinct from the old classic. With WordPress 5.0 and several site owners, Gutenberg was released, becoming hesitant to move to the new editor, delaying the core upgrade. For intruders, an obsolete heart may be a symbol of welcome. You wouldn’t have to think about running an obsolete centre if you wanted to cover the WordPress update.
We recommend reading this post, How to Delete WordPress Version Number, if you want to keep outsiders from figuring out the WordPress version your website is running.
11. Set Up a WordPress Firewall
Before they enter your web login tab, wouldn’t it be awesome if you could block the hacker or the bad bot? That is precisely what the firewall is doing! This filters the incoming traffic that your WordPress account needs to visit. A WordPress firewall can stop bad traffic (i.e. hackers and bots) to ensure sure the website stays secure.
12. Use HTTP Authentication
Since the login page is under threat more often than any other page on a WordPress website, adding a layer of security over the domain makes sense. That is what will help you achieve HTTP authentication.
HTTP authentication provides you with a way to prevent unauthorised login page visits. It’s difficult to reach the login page without a specific collection of HTTP credentials if you have enabled HTTP authentication on your website.
There are a handful of plugins on your site that will help you allow HTTP authentication. In the WordPress repository, you should look for them.
13. Implement Two-Factor Authentication
For a very long time, passwords have become a key form of security in the WordPress community. Nevertheless, there are also modern password-cracking methods these days. Therefore, using a second element of authentication after the username and password stage is a good way to improve the login page. That’s what two-factor authentication can help you do. Learn how two-factor authentication can be applied.
14. Auto-Logout When No Activity
The odds of a security breach are very high for websites with many users. Extreme security risks are raised by a user leaving the dashboard open on the screen when attending other urgent business.
Without the user’s awareness, a passerby can steal data, change the web or can even end up destroying the site. You have the ability to set up your platform in a way that it automatically logs out inactive visitors to minimise any threats of this nature. In the WordPress repository, there are plugins for logging users out while they are idle for a certain amount of time.
15. Set Passwords to Expire
Regular e-banking platform customers will be aware of credentials that expire every couple of months. The aim is to guarantee that the hacker has only a short window to exploit your account if your account is compromised. It would help reduce the harm of a hack attack if you implement the same practise to your WordPress website.
Enforce a policy that will update the password every few months for all the users. It’s a good idea and a great example of how an on-going operation is protection.
16. Perform Daily Malware Scan
Hacking is a continually evolving process. We see hackers creating advanced instruments every year and discovering better ways to break websites. Using a security scanner will make a major difference to your security posture under certain circumstances.
You will detect ransomware before it does any harm to your site with the help of a WordPress security scanner. Here’s a roundup of the top 5 ransomware scanners for WordPress to pick from.
17. Schedule Daily Backups
Anyone who’s been running WordPress websites for a long time knows the unexpected disasters will arise. While you will not guess what shape it will take, before tragedy happens, you can formulate a recovery strategy. The easiest way to protect your website with WordPress is when you have nothing to lose. This is where it comes with copies.
They’re your net of protection. If things go wrong, for example, your website breaks due to an upgrade, with the help of a backup, you can return the site back to normal. Therefore, on a daily basis, make full backups of the website. (Recommended Read-5 Best Plugins for WordPress Backup.)
18. Employ Least Privileged Principles
There’s a user function for any registered WordPress user. He or she may be an Editor, Author, Reader, Subscriber, or SuperAdministrator. Before allocating user positions, you should consider twice. A collection of powers and obligations comes with each role. It may lead to power misuse and major security issues to hand over broad responsibilities such as that of an Administrator to someone you don’t fully trust.
19. Block Suspicious IP Addresses
One of the best ways to shield your WordPress account is to restrict traffic to the WordPress page. We talked about how the WordPress firewall blocks bad traffic from visiting the website in the previous segment.
But you have the option of blocking them in case a few hackers and poor bots sneak by. You can see users continuously failing to log in to your site if you have a WordPress protection plugin like MalCare built on your website. You will block the IP addresses of the hacker and protect your WordPress website until you are confident that it’s not one of your registered users.
20. Use an SSL Certificate
You’ll be able to migrate from HTTP to HTTPS using an SSL certificate. Hang on, what are HTTP and HTTPS?
You must have found an url for the website starting with http or https? HTTP may be considered an enabler for connectivity. Your browser connects with the registry of the website you choose to use as you access a webpage. It tells the server exactly which page you’re searching for. The window shows you the website after the server answers. This contact is possible because of HTTP between the browser and the server. So it’s insecure with HTTP. It is possible to hijack the contact line and hack it. HTTPS is a variant of HTTP that is more stable. This contact line is protected by it.
There will be 3 key advantages of converting your website to HTTPS: One, it will encrypt all information passed between the user and your website, thereby keeping essential information secure. As a result, it creates confidence among the site’s users. That’s the number two value. And advantage number three is that because Google considers an SSL certificate a significant ranking element, the certificate boosts the Google ranking.
21. Ensure permissions for files are right
A website for WordPress consists of archives and databases. Each file has a permission set that specifies whether or not the file can be changed.
In protecting your domain, WordPress file permissions play a critical role. Different mistakes or even a security violation can result from having the wrong collection of permissions. The wp-config file, for example, is a very critical WordPress file and should not be fucked up. Set to ‘read-only’ should be set. If this is modified to ‘read and write,’ without your knowledge, someone can edit the file and enforce updates on your website. Therefore, all essential files such as the .htaccess file and the wp-config file should be set to read-only.
22. Monitor Real-time Activities Every day
You can detect unusual activity at an early stage by keeping a watchful eye on all that is going on your WordPress website. This will help foil any potential interference until your website gets hurt. In the repository, there are many plugins that can help you track events in real-time. We checked one here: WP Protection Audit Log.
23. Disable File Editing
WordPress lets users edit and apply code samples from the dashboard to the installed plugins and themes. This raises significant security issues because he will edit the themes and plugins if a hacker gains admin access.
It’s a safe spot to instal malware codes and go unnoticed, as most WordPress users don’t edit themes and plugins. In the future, the code would allow the intruder to enter the website. But you wouldn’t have to think about malware codes contained in your themes and plugins if you were to disable file editing.
It’s dangerous to delete file editing manually, so if you’re a MalCare client, you can press a button to disable file editing.
24. Change Database Prefix
The WordPress archive is a hosting system where the website’s content and settings are stored. It’s a very significant aspect of the site that sets a target on the back of it. To enter and exploit the database, hackers take our Spam Connection Injection or SQL injection.
Popular awareness is the layout of the data base. It comes with 11 regular tables, and there is a ‘wp” prefix for each table. You can throw the hackers off-guard if you change the prefix, and make it impossible to exploit the database. It’s good WordPress security procedure to change this prefix to something else.
25. Disable PHP File Execution
Many files and directories make up a WordPress website. The Upload folder is where the website’s photos are kept. In the Upload folder, you’ll never find a PHP file. The PHP files contain a series of commands which are used for method execution. Since they have a .php filename, PHP files are easy to find.
If you see a file like that in the Upload folder, it’s presumably put by an attacker. To perform malicious operations such as sending spam emails, he or she can use the PHP file. In securing your website, disabling PHP execution in the Upload folder can go a long way. Here’s how to disable execution with PHP.
26. Disable Directory Browsing
Often, instead of a typical homepage, a website can display a list of files and folders. This normally happens when there is no index file (index.html, index.php, etc). The data is revealed in situations like this and can be quickly manipulated.
If your website displays important details to the public, you’d like to search. If so, you need to make sure that the WordPress website’s directory searching is disabled. This post will help you do exactly that: How to disable the searching of directories?
27. Disable XML-RPC in WordPress
XML-RPC is a WordPress feature that helps users to remotely carry out a number of operations on their pages. It helps you to use the smartphone WordPress programme to reach the site. XML-RPC is allowed on the WordPress website by default, which raises some security risks.
We know that XML-RPC enables users to access their websites remotely, but before WordPress allows you to access the site, you’ll need to authenticate your identity. Hackers exploit this mechanism of authentication and attempt to enter your site. So, if you don’t use WordPress remotely, try shutting off the XML-RPC.
28. Hide wp-config.php & .htaccess
Two of the most relevant files on the WordPress website are wp-config.php and .htaccess. They encourage you to make changes to the web. For eg, in the .htaccess file, you can add snippets of codes and tell WordPress to password-protect those sites. Likewise, to allow or disable automatic WordPress notifications, you can use the wp-config file. It will mean tragedy for your website if these files go into the wrong hands.
The hardest thing is that it is common knowledge that the location of all files makes it easy to reach them. Hiding the files, tucking them away in a separate folder where hackers are unable to discover it is good practise. Learn how to hide a file from wp-config and a file from .htaccess.
29. Change WordPress Security Keys & Salts
Did you ever note how any time you try to enter your website dashboard, you don’t log in?
WordPress stores your username information in your browser cookie after logging into your account, in an encrypted fashion. To encrypt the passwords, WordPress uses encryption keys and salts such that they will not decipher the password even though hackers manage to snatch your cookie.
Consider a case where, without your knowledge, a hacker steals your security keys and manages to decrypt and enter your site. If you change the authentication keys and salts, it will automatically invalidate the browser cookies. He’s going to be kicked out of the website.
He’s going to have to steal the latest encryption keys and salts, try decoding them and then re-access the site. It’s a tough operation, one that he/she does not want to stick with again.
30. Google Scan Console Track for Security Threats
On a daily basis, Google crawls websites to check if there is any new material useful enough for its users. It even tracks fraudulent activity on your web by doing so. Google blacklists those domains to protect its own customers and alerts the author of the domain. If you are using the Google Search Console, when malicious behaviours are found on your website, Google will even give you a note in the Console. Make sure you periodically update the Google Search Console to keep updated about your site’s fitness.
Ultimate Thoughts
There is a lot to take in, for a beginner in particular, someone who has little understanding about how WordPress works. Yet it’s a step in the right direction to take these steps.
That being said, with a single security plugin, all of the security steps can be executed. What you need to do is just press a mouse. A protection plugin such as MalCare, for example, scans ransomware, defends your login screen, runs a firewall to block unwanted traffic, modifies security keys and salts, and a variety of other things. The best thing is that all of these steps are automated and allow you to spend more time working on your company rather than thinking about security. We hope this article lets you figure out how to secure a website for WordPress.