WordPress site security should come before every other optimization because a single weak plugin, outdated theme, or bad login setting can expose the whole site. The safest first step is always to back up the site before making any security changes, so you can recover quickly if something breaks.
WordPress Site Security Measures
If your site is already hacked, follow this.WordPress Malware Removal guide Some of these methods can be easy or too difficult to implement, depending on your comfort and expertise. If you’re doubtful about the process for any step, make sure to ask an expert for help before moving forward.
1. Maintain strong login credentials
This is one of the most common instructions and yet, the one that’s most neglected. The more enthusiastic you’re about setting a suitably difficult username and password combination, the more likely you’ll forget it.
However, it’s very important that you follow the basic rules behind setting strong passwords and unique usernames. If you’ve to, you can always use a secure password manager to store all of this information.
This is especially important if you’ve multiple users handling your site. You don’t have to exert manual effort either; just use the automated software that WordPress provides for ensuring strong passwords. You can also check out plugins that set an expiry for your passwords, forcing the user to change them after a specific period.
2. Blocking PHP execution in certain vulnerable folders
Some files and/or folders on your WordPress site use the PHP coding script, like ‘wp-config.php’. Hackers often try to gain access through these files, then create new ones of their own or insert malicious PHP functions into the existing ones. To prevent this, you can remove the option of executing PHP functions from unknown folders.
However, this step requires a certain level of expertise with backend files and database tables, so ensure this before proceeding with the steps below:
- Check cPanel > File Manager – or use an FTP client if this isn’t possible.
- Click on ‘public_html’ which has three folders – ‘wp-admin’, ‘wp-includes’, and ‘wp-content’.
- Look out for the ‘.htaccess’ file (if there isn’t one, you can open a file in Notepad and save it as ‘.htaccess’). Use the code:
<Files *.php> deny from all </Files>
If you’re creating a new file, you’ll need to upload it to the ‘wp-includes’ and ‘wp-content/uploads’ folders.
3. Monitoring login attempts
Maintaining a log of login attempts and other activities, such as file modifications or additions, is a smart move. This will allow you to keep an eye on all major activities on the site and identify which user is responsible. For example, if the login attempts suddenly increase beyond your usual expected traffic, you can suspect a potential brute force or DDoS attack.
There are also features to limit login attempts to prevent events like brute-force attacks. By default, WordPress allows unlimited login attempts, so you’ll have to either install a plugin that limits them or install a WordPress Site security plugin that comes with this feature. Otherwise, you can insert specific code in the ‘functions.php’ file by adding the action and hook feature, with a callback response.
You can also design your site to log out inactive users, which protects it from unauthorized access – this is offered by some plugins. Set up alerts for any suspicious login activity, which can be tagged in the audit log or provided by your security plugin.
4. Disabling the file editor
Most WordPress hacks occur by editing core files, where hackers insert malicious scripts. It ranges from defacement and pop-up ads to questionable external links and displaying unknown content on your site. For disabling the editor:
- You can access the File Manager > ‘wp-config’ file > ‘Edit’
- Then, you should press on the ‘Disable Encoding Check’ > ‘Edit’.
- You’ll find a line that says ‘That’s all, stop editing. Happy publishing.’ Above this, put in this code:
define( ‘DISALLOW_FILE_EDIT’, true );
- Save all the changes and close the editor. If you follow the steps given above again, you’ll find that the ‘Editor’ option no longer shows.
5. Secure the ‘wp-config.php’ file
This is one of the more important WordPress files and also contains the database access credentials, making it a favourite target of hackers. To improve security, you can change your security keys, disable the file-editing option, and remove the option to install plugins.
You can also hide or simply deny access to the ‘wp-config’ file. For the latter, you can type in this code at the beginning of the ‘.htaccess’ file:
<files wp-config.php> order allow,deny deny from all </files>
There are many more steps one can follow to increase WordPress Site Security. Sometimes, some security measures may not apply to you, or you find out that you’ve been hacked despite all of the precautions.
Check out: Top 9 WordPress Tips That Are Worth Knowing