How to keep my WordPress website secure

With the beginning of the worldwide pandemic Covid-19, the activity of cybercrime has increased. Hackers or cybercriminals are emerging with new ways to attack people or organizations. More and more companies are becoming victims of cyberattacks. That is why the following speech was given by the chairman of IBM –

“Cybercrime is the greatest threat to every company in the world.”

-IBM’s chairman, president, and CEO

Along with various types of security vulnerabilities, hackers are coming up with phishing email schemes and inventing malicious applications. To secure a WordPress website from hackers, a lot of ways can be applied to lock down your website. Among all the ways, we will discuss the most effective ones that are easy to apply.

Protect Your WordPress Site from Being Hacked with 10 Result-Oriented Methods:

Table of Content-

You will be surprised to know that – we have found the following numbers of websites that are being hacked today (the day we have written this article). The status is found from a reliable online status.

Hacked Status

That right! We will be showing 10 strategies that have been proven to be result-oriented. Unline some critical ones, these methods are also easy to apply. So people from all technical levels can use these strategies.

1) A Secure WordPress Hosting is the Very First Step:

A recent big tragedy of cyberattack is the $50 million data breach of Saudi Aramco company. The company had no idea about the data breach until 1 terabyte of their confidential data was leaked online. According to a media conversation, one personnel of the company reported –

“We confirm that the release of data was not due to a breach of our systems, has no impact on our operations, and the company continues to maintain a robust cybersecurity posture.”

The whole point of this story is they should have a stronger security infrastructure. And secure WordPress hosting is the key to this. The first point of getting reliable hosting is trust, you don’t want to get hosting service from a company whom you don’t trust.

On top of that, check whether the hosting provider can offer an adequate level of security measurements with multiple layers of hardware and software. The hosting provider should have a security infrastructure to protect your WordPress site from potential physical and virtual threads.

2) Use HTTPS Encryption (SSL Certificate):

Often overlooked, installing an SSL certificate has become a popular way of making websites secure. There are many hosting providers that offer free SSL certificates when you purchase any of their hosting plans. Many users like the idea as they don’t have to go through the hassle of getting an SSL certificate separately.

Among many necessities, these are some of the vital ones for HTTPS encryption –

  • HTTPS is vital for a secure connection between browsers and websites
  • Google gives priority to HTTPS encryption. So, it has a ranking factor on search engine optimization
  • Helps to get you referral data where normal HTTP gets blocked by Analytics
  • The green address bar is a mark of trust that is searched by 28.9% of visitors when they are browsing
  • From the 24th of July 2018, Chrome won’t mark HTTP sites as ‘Secure’. The versions are Chrome 68 and higher
  • While logging in, you can ensure a secure and encrypted connection by adding the following line to the wp-config.php file –
define(‘FORCE_SSL_ADMIN’, true)

3) Always Work With the Latest PHP:

Being the backbone of WordPress, it is very important that the PHP version is always up-to-date. Your server and WordPress site may not work properly if the version of PHP is too old. Although support is offered for 2 years after a major version of PHP is released, users of PHP 7.1 or lower won’t get any support for security.

Sadly,

“77.5% of users are still using PHP version 5.6 and lower that are no longer supported”

Websites running on PHP 7.1 and below are exposed to security vulnerabilities that are unpatched. Here is a chart of PHP versions and their release dates –

PHP versions release dates

Image Source – dx3webs.com

4) Use Unique Username and Password:

Never use the default username and password. Your website will be hacked in no time. To set a strong username and password for WordPress login security, use something creative and distinct. Something that is hard to guess at the same time, only you can remember it.

According to SplashData’s annual list, these are the common passwords that got stolen throughout 2019 –

  • 111111
  • 12345
  • 123456
  • 1234567
  • 12345678
  • 123456789
  • password
  • iloveyou
  • sunshine
  • qwerty

‘123456’ is the most common one of all these. It is easy to find a password generated by the hashing framework (phpass). So, it is better to change it in the core WordPress wp_hash_password function.

With that being said, never set ‘admin’ as the username of your WordPress site login. You can create a different username for the administrator account. Inside your WordPress dashboard, go to ‘Users’ to add a new user and assign the profile as ‘Administrator’.

Administrator Area

If the username ‘admin’ exists on your website, it’s time to delete it. Before you delete the account, select the “Attribute all content to” option for the new account and press the “Confirm Deletion” button.

Delete User

Also, the current admin name can be manually changed through phpMyAdmin. Use the following command to change the name of the admin. Before changing the name, make sure you have taken an adequate backup of your database.

UPDATE wp_users SET user_login = ‘newcomplexadminuser’ WHERE user_login = ‘admin’;

5) Always Use the Latest WordPress Plugins and Themes:

The most recent versions of themes and plugins are better than the previous ones in terms of security. It is wise to keep your site updated with the latest WordPress core updates, plugins, and themes. A report suggested –

55.9% of known entry points will be exposed due to plugin vulnerabilities

Don’t use plugins from unknown sources. In the WordPress library, look for plugins from the ‘popular’ and ‘featured’ categories. And it is always better not to use null WordPress themes or plugins.

You can use online tools like the VirusTotal to check if a theme or plugin contains any type of malware.

Virustotal

You can update your WordPress themes and plugins using bulk actions. Inside your WordPress dashboard, you can select the themes and plugins that you want to update and select ‘Update’ from the drop-down bar. Hit the ‘Apply’ button to complete the task.

Apply Button

In this 2 minutes video, you will find out how to turn on automatic plugin update for your WordPress site –

6) A WordPress Security Plugin is a Must:

Of course, a security plugin deserves a spot when it comes to WordPress site security. There are many plugins that can enhance the overall security infrastructure of your website. After doing some hard research and getting user opinions, we have found these security plugins very handy –

The security provided by your hosting company is never too enough. When your website starts to grow, you will need unique and advanced security features that can be achieved through installing security plugins.

You will need a security plugin for the following reasons –

  • Resetting passwords on a timely schedule
  • Enabling two-factor authentication for your WordPress site
  • Accessing better user login with adequate actions
  • Generating creative and strong passwords for profiles
  • Applying captchas for authentic access
  • For whitelisting or blacklisting IP addresses

7) Lock the Login URL:

You lock down the path of the URL so that only your IP address will be accepted for WordPress admin login. If you are using plugins like Sucuri or Cloudflare, which contains a web application firewall (WAF); then you can set a rule for accessing WP login only through your IP address.

A lockdown URL feature is available in the pro and higher accounts of Cloudflare. You can set your own rule for a particular URL. On the other hand, a feature for blacklisting URLs is available in Sucuri where you can whitelist your own IP address. No matter what you do, don’t apply such settings to an eCommerce website.

8) A 2-Factor Authentication is Useful:

Two-factor authentication is an innovative way to secure your WordPress website. You may have set up a really strong password for your admin panel. But there are always chances of discovering it by someone.

Many plugins are available for enabling two-factor authentication for your website. Two-factor authentication consists of two different parts. The first one is your account and dashboard. One can change the DNS records, change your password, or even shut down the entire website if someone accesses your account.

The second one is – the WordPress installation where you would need some plugins like below –

9) Get DDoS Protection to Secure Your WordPress Site:

If you are not aware, DDoS (Distributed Denial of Service) is a type of cyberattack used to target a particular system by using multiple systems. The initiator tries to temporarily make the resources of a network or machine unavailable for the authorized users by causing indefinite disrupting services of the host.

A DDoS attack was first encountered in early 2000. The purpose of this type of cyberattack is not to harm your website or application. Rather, your website will remain down for a few hours. The best way to avoid these problems is to use a plugin like Cloudflare or Sucuri. Also, it is better to go for premium plans when your business is serious.

10) Regular WordPress Backups are Emergency:

This final strategy on our list is very important. Suppose your website got hacked despite having adequate security features. You have lost all your files and resources as you can’t access your website anymore. What will you do in that case?

If you had taken proper back of your website, you would have to worry less. The popular hosting providers offer built-in backup features. Depending on the type of hosting it gets better or worse. For instance, managed hosting plans are good for WordPress site backup. Many hosting providers include automated backup plans with managed hosting.

And talking about automated backups, you can use plugins or talk to your hosting agency for getting one. Some mentionable plugins for automated backups are –

Installing any of these plugins will be a wise decision. Manual backups are good, but they are not better as automated backups. It’s as like as they say – you can’t be 100% safe no matter how secure your site is.

Overview:

Apply the strategies that we have discussed in this article and never say – “My WordPress site is hacked”. There are numerous ways to make WordPress secure. They can have a greater impact on solving different security issues but they may have a critical installation process or let’s say, they are hard to operate and need certain technical knowledge.

All these strategies that we have discussed here are very simple to use and they are very effective. Thanks for reading this article. Leave a comment below if you have any confusion about any of these strategies.