How to Secure WordPress
By Jithin on July 8th, 2016
In this documentation, we can learn how to secure WordPress.
Keeping WordPress secure is necessary in order to keep websites from being compromised. The are that attackers will attempt to access is the wp-admin page. If a malicious user can login as admin, they can cause issues for the site owner. Hackers will also try to log in using “Brute force attack”, by creating up automatic logins using multiple computers. A series of multiple computers used to conduct malicious activities are known as botnets. They use different combinations of username and password. In order to prevent hackers from compromising the wp-admin interface, the following steps need to be made.
1) Using Unique, Secure Username and Password
Always avoid using the default ‘admin’ username. Also try to avoid common names like your website’s name, your name, etc. In addition, use complex passwords with combinations of alphabets, numbers, special characters, yet still easy to remember. Phonetic password generators are always a great idea.
2) Two-factor Authentication
Two-factor Authentication also called ‘2FA’ or 2-step verification requires the user to not only enter the username and password but also a unique code sent to linked device, usually a mobile phone. This feature increases the security of our website.
3) Verify the user is ‘Human’
reCAPTCHA modes can be used to check whether a user is human or not. This means that botnets cannot automate the reCAPTCHA and the hence the attacker cannot login to our account.
4) Keep WordPress updated.
To automatically install WordPress releases, add the following to the website’s wp-config.php file:
define( ‘WP_AUTO_UPDATE_CORE’, true);. However, this can bring incompatibility between newly installed WordPress version and existing themes/plugins. To resolve this issue, iThemes Sync and ManageWP third party tools help you with all the installations and updates for WordPress on your websites.
5) Using Security plugins
Some of the most popular security plugins are:
Acunetix WP Security
6) Protection from brute force attacks
A website can be attacked in two ways namely,
Surgical attack – Here the attacker looks for vulnerability and then exploit it with shear precision.
Brute force attack – As mentioned above, is a trail and error way using programs to crack passwords.
The best method of protection of wp sites from brute force attacks is a plugin called BruteProtect and you can also enable any CDN services.
7) WordPress Plugin and Themes
Security holes in themes and plugins represent more than half of all successful WordPress hacks. Careful attention to the plugins you activate on your website is warranted. It is important that your WordPress theme is up to date and well-coded. You can check the quality of the code in your theme by using a plugin.
8) Using Correct File Permissions
It is important to configure file permission correctly in WordPress.
All directories should be 755 or 750
All files should be 644 or 640
wp-config.php should be 600
9) Protecting WordPress using .htaccess
The .htaccess file is a powerful configuration file that changes the way your server operates. It is used to redirect URLs and configure permalinks. The file can also be used to harden WordPress security.
10) Limit Login Attempts
Hackers use brute force attacks to try and gain access to your WordPress admin area; continually trying new random usernames and passwords. One of the best ways to protect your website against this kind of attack is to install Login LockDown or Login Security Solution. The plugins limits the number of login attempts from a given IP range.
If you need any further help please contact our support department.