WordPress is widely used by individuals and businesses as a content management system (CMS) to design their website or blog. According to an estimate, more than 37% of websites on the web are powered by WordPress. However, this also makes it a prime target for online attacks. According to WP WhiteSecurity, more than 70% of WordPress installations are vulnerable to hacker attacks.
Since WordPress regularly publishes software updates and security patches, it’s up to you to keep your website secure. In this post, we’ll go over some of the commonly used security practices that can help you secure your WordPress website. Let’s see how to keep your WordPress website secure:
Table of Contents
#1: Customize the Login Page URL
Malicious users can easily access the default WordPress login page by adding wp-admin or wp-login.php to the website’s main URL. However, you can prevent attackers from targeting your WordPress site by changing the login page URL.
Hackers use brute-force attacks (or trial-and-error guessing) to access the direct URL of a site’s login page. They do this by submitting many passwords using their GWDb (Guess Work Database) a database containing millions of usernames and password combinations, for example, username: adm!n and password: p@ssword.
The most obvious way to protect your WordPress website from brute force password hacking is by swapping usernames for email addresses and changing the login URL. The simplest way to customize your login URL is by using WPS Hide Login. With this plugin, you’ll only have to enter your new login page URL and save changes.
You can rest assured that only authorized personnel with the exact URL will be able to access the login page.
#2: Change the Admin Username
WordPress is well-known for its ease of installation. A simple way to secure your site from would-be hackers is by setting a custom name as the username for your main administrator account.
Hackers will find it difficult to inject their way into your site if they don’t know your username. However, if the username is set to the default “admin” during WordPress installation, it will be easy for hackers to guess. This means they only need to figure out the password to access your website and steal your data.
We recommend using the iThemes Security plugin to ban login attempts from IP addresses that use a specific username such as “admin”.
#3: Use 2FA
After you’ve updated and changed your WordPress admin username, the next best way to prevent unauthorized access to your WordPress site is by enabling two-factor authentication (2FA).
With this security measure, you can implement an additional step to your basic login process which involves requiring users to answer a secret question, enter a secret code or a set of characters, or enter a unique code from an authentication app sent to the user’s phone. This means only the authorized users with the correct username, password, and the code will be granted access to your site.
Some of the popular tools that offer two-factor authentication include Google Authenticator, Two-Factor, and Two Factor Authentication.
#4: Use Password Managers
It’s a good idea to use a powerful password manager to boost your cybersecurity. Password managers can help you generate strong and unique passwords and store your login credentials inside a safe vault. As a result, you’ll be able to automatically access your websites without the need to remember all of your passwords.
1Password and LastPass are two of the most popular password managers on the internet.
#5: Enable SSL
Another way you can secure your WordPress admin panel is by getting an SSL certificate for your website. SSL is a security protocol designed for web browsers and servers to protect communications over a computer network. It involves encryption, decryption, and authentication of data transfers over the internet.
In addition to this, an SSL certificate helps you increase user trust as it informs them that their data will be secure on your website. This is essential for all kinds of online stores.
The easiest way to obtain an SSL certificate for your WordPress site is by purchasing it from an independent third-party company or asking your hosting provider to deliver one without charges.
You can enable SSL on your site by simply installing an SSL plugin like the Really Simple SSL plugin and activating it. The plugin will handle the rest.
#6: Make Regular Backups
It’s a good idea to always be prepared for unfortunate events such as successful hacking attempts. Maintaining a complete backup of your website can help you avoid any major data loss.
Backing up your WordPress website involves creating a copy of your data and storing it at a secure location. It’s the simplest way to restore it to a working state whenever you need and avoid having to rebuild your website from the ground up. For most businesses, running backups every week or month is plenty.
You can choose from various WordPress backup restore plugins available in the market including VaultPress, BlogVault, and BackupBuddy. We recommended using a plugin that offers an automatic backup option. This way, you can save time and prevent outdated backups from eating up your hard drive space.
#7: Change the WordPress Database Prefix
Your WordPress database contains all the information stored on your WordPress website making it a prime target for hackers and spammers. They use SQL injection attacks which involve inserting malicious code into an entry field for execution, allowing attackers to easily delete, modify, or steal data from the database.
SQL injection attacks are most commonly used by hackers to obtain sensitive data such as credit card information and passwords from individuals and organizations. This is why you should immediately take steps to remove this security weakness from your website.
A common vulnerability responsible for SQL injection attacks on WordPress databases is the use of the default wp- database prefix. When you install WordPress, all the database table names are prefixed with wp-. Using an easy-to-guess data prefix allows the hackers to figure out the table names and exploit your database. This is why we recommend changing and updating them as soon as possible.
You can use WordPress plugins like iThemes Security or WP-DBManager to easily replace your database prefix to another keyword in a single click. Remember to backup your website before making any changes to your database!
#8: Hide the WordPress Version Number
An out of the box installation of WordPress publicly displays your WordPress version number in your website’s source view. It’s also shown on the bottom of your WordPress admin panel as well as on your website’s CSS, RSS, and scripts.
This is a potential security risk as it allows hackers to create and execute a tailor-made attack on your WordPress website. They do this by exploiting the known vulnerabilities of a specific version.
You can avoid revealing this sensitive information using a WordPress plugin like WP Hide & Security Enhancer. Alternatively, you can do this manually (which will also hide the version number from RSS feeds) by inserting the following code in your functions.php file:
function wp_remove_version() {
return '';
}
add_filter('the_generator', 'wp_remove_version');#9: Use CAPTCHA and reCAPTCHA to Prevent Spam
Both CAPTCHA and reCAPTCHA are security measures that help you protect your site from bots and spam.
CAPTCHA is a type of security check that determines whether the user is a human or a robot. reCAPTCHA is also an authentication test that prevents spam and other online attacks from accessing your website.
Check out our tutorial on how to secure downloads with CAPTCHA and reCAPTCHA in WordPress.
CAPTCHA and reCAPTCHA offer an easy way to keep your WordPress site spam free which helps improve the user experience of your website. Using a security check form is one of the most effective ways to secure your site data and stop cybercriminals from influencing site activities such as online polls, posting dodgy comments and links, and placing spam online shopping orders.
This is particularly important because hackers use automated bots to place random orders on WooCommerce sites. They use different IP addresses and email IDs to do this, making it impossible for traditional methods to prevent such users from accessing your online store. However, you can block spam orders on your WooCommerce store simply by implementing a CAPTCHA check on the new account page.
The simplest way to implement CAPTCHA and reCAPTCHA protection on your website is by using the Passster plugin for WordPress.
Passster
Protect your entire website, entire pages, or just parts of your content with one or more passwords.
#10: Disable File Editing
You can use WordPress’ built-in file editor to easily make changes to plugins and theme scripts. However, this feature is available to anyone who has administrative access to your WordPress admin portal, creating a possible security vulnerability.
Disabling file editing will prevent other users as well as potential hackers from modifying these files, even if they get admin access to your dashboard. This can be done by adding the following code in the wp-config.php file:
define('DISALLOW_FILE_EDIT', true);Keep Your WordPress Website Secure
Securing your WordPress website from hackers and spammers doesn’t have to be difficult. You just need to follow some best security practices and you’ll be well on your way to successfully preventing malicious users from damaging your website.
Also, be sure to check out our Complete Guide to WooCommerce Anti Spam for information on how to keep your online store secure.
Do you have any WordPress security tips of your own that you’d like to share? Let us know by commenting below!