Corporate Branding, Digital Marketing and Business Development Blog

On the average, WordPress powers about 40% of all websites and this makes it the most popular content management system (CMS) in the world.

Although, the above statistics makes it easy to assume that the dominance of WordPress in the web development space should make their system immune to all threats. It is not always the case.

Unfortunately, records of unauthorized access to different WordPress powered websites have been registered overtime.

Security plug-in Security documented that 90% of its clean up request comes from WordPress.

Are you also surprised?

This high rate obviously opens you to the reality that your website is not exempted from attacks and if you are worried about how to solidify your website’s defense walls, this post reveals to you the proven ways to boost your website’s security.

WHAT IS AT STAKE?

Generally it’s not safe to leave the security of your website toWordPress alone.

Your brand has too much to risk, not to mention what you can lose:

• Sensitive information
• Your privacy
• Control of your site
• Money

All the work put behind making your brand could come crashing down from the simple neglect of a few key plugins.

The type of attacks you need to avoid include:

• Phishing
• Brute force
• Backdoor
• Malware and so on

The good news is that most security plugins available give you a standard protection against these threats and here are five ways to improve the security of your website.

15 Ways To Secure Your WordPress Website

1. INSTALL THE NECESSARY PLUGINS

The plugin we recommend is iThemes Security.

IThemes security offers protection against all the attacks mentioned and more.

Also, iThemes is trusted by the community, boasting over 1 million installs.

It has gained the WordPress community’s trust by providing guaranteed protection and being relatively easy to use.

In order to have iThemes, download the iThemes security plugin > then go to the sidebar to where it says ‘security’ > hover over ‘security’ and click the ‘security check’.

Here is where you get to see the many threats that iThemes is protecting your WordPress site from.

Your security checklist will be long and that is to show that iThemes Security is legit.

 

2. LIMIT ADMIN LOGIN ATTEMPTS

iThemes Security is great but it comes with one flaw; it does not protect against ‘brute force attacks’ when installed.

Brute force attacks involves an intruder inputting thousands of passwords an hour in order to access your account.

It’s a large scale trial and error method that is proven effective.

In fact, that is why most sites encourage, force, you to generate a long password with a special character and numbers.

It is giving the system time to detect a brute force attack and prevent it

Conventionally, there are plugins that can limit the WordPress admin login attempts to 3 to ward off that threat.

With iThemes Security, they will ask for your email so as to notify you if any one of their users has been breached.

Then the ‘on button to protect against the threat’ will glow blue and you can click that to enjoy full protection.

3. KEEP YOUR SITE UP TO DATE

Updates can be a chore sometimes.

However, they are useful because they contain the latest systems in place to combat security threats.

An out of date plugin can leave you vulnerable and exposed to malware.

When 52% of WordPress vulnerabilities are related to WordPress plugins, it is risky to neglect them.

Security software Sucuri identified that over 56% of all CMS applications were out of date when hacks happened.

Manually updating each plugin individually would be excess.

Therefore, automatically update the plugins and themes to their latest versions.

This will involve enabling automatic WordPress updates.

You can do this by going over to ‘updates’ on the side-view panel. Click on it, then navigate the next page till you see a link for enabling automatic updates.

This same feature can be found in the themes page also.

4. CHANGE YOUR LOGIN URL

WordPress sites are easily noticeable to hackers because of the unique URL they carry.

The URL to login to the backend usually ends with /wp-admin/.

With this extension to your URL, the backend is left exposed because hackers now know that it is the backend of a WordPress site.

Installing a plugin can prevent this from happening.

So head over to ‘add new plugins’ and search for WPS hide login.

Activate it after installing then go to plugin settings.

You will now be able to change your login URL to a URL of your choice and be able to redirect traffic of the old URL to a 404 page not found.

With this your backend has additional protection.

5. HAVE BACKUPS READY

There’s no easy way to say this but…

Your site is not 100% secure.

A malicious attempt to any of your social media accounts, web hosts, or network provider could leave your site on the receiving end of an attack.

That is why you need a fail-safe in place in the form of a backup.

Like a saved game, this backup will allow you to restore back to its earlier version at the point of backing up.

By installing iThemes Security plug in, your WordPress site will be automatically backed up frequently.

Additionally, you can change the frequency of the backup, delete or restore old backups.

We recommend doing weekly backups or as often as you can to always be prepared for an attack.

6. USE STRONG PASSWORDS

The most malicious of attacks can be avoided by using a strong password.

Commonly, internet users use weak passwords and tend to regret it when they are hacked.

The standard practice for generating a strong password is:

• Have at least 8 characters long
• Have at least one numerical character
• Have at least one special character
• Have at least one uppercase and lowercase letter

You can make this compulsory on signup for users of your WordPress site which will ensure every user has a secured password.

7. ENABLE AUTO-LOGOUT

This is a very basic procedure which protects against strangers accessing your site through your phone or laptop.

Normally, it is a standard practice to log out of the account when not in use but you can enable auto-logout to make it much easier.

Simply install the inactive logout plugin and go to settings to set the time of inactivity that will logout the user.

You can even add a 10 second timer to remind the user they are about to be logged out.

8. USE SECURE HOSTING

The majority of security comes from having good hosting.

Normally there are plenty of options for hosting but you need to use the most secured hosting to protect your WordPress site.

Here is a list of WordPress hosts, courtesy of codeinwp.com:

1. SiteGround
2. Bluehost
3. Kinsta
4. Hostinger
5. Flywheel

9. ENABLE SSL/HTTPS

You can tell whether your site is SSL enabled by looking at your URL.

It needs to have https:// instead of http://.

But why is it important?

SSL stands for Secure Sockets Layer and it ensures that the traffic between your site and visitors is secure from third-party intrusions.

It is an important security feature of your site because it shows Google and your visitor that your site is secure.

If you don’t have it then it will warn visitors that you don’t have it and they will rather not access your website.

So get your SSL certificate for your website if you currently don’t have one.

10. FIREWALL

Just how the firewall on your computer prevents certain sites from being accessed and from accessing you, it works the same for websites.

The firewall will prevent malicious IPs from accessing your site.

It will also screen incoming IPs to make sure they are safe.

You can download the Web Application Firewall (WAF) plugin and configure the firewall settings for your WordPress site.

11. WORDPRESS MONITORING

It’s crucial to be on top of your website activity.

WordPress themselves have alluded that security isn’t risk elimination but risk reduction.

That means you need to act fast if your site is eventually hacked and the only way to do that is to be alerted when suspicious activity occurs on your site.

12. WORDPRESS SCANNING

Another important way of preventing attacks on your site would be routine scans.

Normally, your security plugin should be able to run the scans for you.

If they don’t, we recommend:

• Checking if scanning is enabled in the plugin
• Installing a scan plugin

Effectively, you want to be scanning once a month to ensure no files or user data has entered that could compromise your WordPress site’s integrity.

13. DISABLE FILE EDITING

File editing is a function that admins can use to change the codes of their files directly.

WordPress is open source and gives administrators the freedom to edit their files and work as they deem fit.

However, this leaves gaps in your security system because hackers would have the same access that you do.

If you realize that you have no use for this function then make sure it is disabled.

Standard security plugins disable it for you but you can get someone that is tech savvy to apply their expertise.

It should look like this on the file wp-config.php:

14. CHANGE YOUR DATABASE FILE PREFIX

Your database contains all the stored data for your site and is a prime target for hackers.

The WordPress database starts with “wp_” and this makes it easy to locate because WordPress databases are highly targeted.

You need to disguise your database by changing the file prefix.

Look into your security plugin and make sure that it automatically does that for you.

15. CONSIDER CREATING A DOPPLEGANGER ADMIN ACCOUNT

The default WordPress admin account is easy to distinguish among user accounts for WordPress sites.

When hackers are searching for the account with necessary access codes, the default admin account is the prime target of the user accounts on the WordPress site.

Therefore, you should consider deleting the default admin account and giving the same administrator permissions to another account.

It’s not a priority if you have a good security plugin, but it will give the hacker a harder time when attacking your site.

Conclusion

There is no surprise that the most popular CMS would also be the most sought after target for malicious attacks.

However, there are common security mistakes that can be avoided by generating longer passwords, backing up the site, and installing necessary plugins.

As a matter of fact, you only need one or two plugins to get high level protection for your WordPress site.

Sarge Clan holds website security to high regard and makes sure security is kept in the forefront of decision making during the web design process.

Adopting a platform outside of WordPress would afford you that flexibility and anonymity for keeping your site safe.

We design bespoke websites that are tailored to our client’s business needs. To get started, fill this form for a free consultation.

Thanks for reading!