WordPress is a powerful and flexible content management system (CMS), but it’s also a popular target for hackers. There are millions of websites running WordPress and most people like to manage their website themselves. So, they need to know how to protect their WordPress website. It is important to implement robust security measures to keep your WordPress website safe from hackers. Here’s a comprehensive guide to help you secure your WordPress site:

1. Keep Everything Updated

Keeping WordPress and plugins updated is important for maintaining the security of your website. WordPress is an open-source software. Many of its themes and plugins are also open-source. So, vulnerabilities can easily be discovered by anyone. When developers find vulnerabilities, they fix Them and push updates. If you don’t update themes, plugins, or WordPress, your website remains vulnerable to known exploits. Any person with malicious intent can easily target your website.

In most cases, outdated WordPress or plugins are the reason to infect a website. Updating your WordPress and plugins ensures that you have patched all known vulnerabilities of your website. So, regularly update your WordPress installation to the latest version, as updates often include security patches. You should also ensure that all themes and plugins you are using are up-to-date. Outdated versions can have vulnerabilities that hackers can exploit.

2. Strong Passwords and User Management

WordPress attackers often use Bruteforce or a dictionary attack to crack the admin password of websites. So, you should always use a strong and unique password for your WordPress admin account or any other user account. Avoid using easily guessable information. WordPress already has a built-in password generator to recommend a hard-to-guess, complex, and long password.

Check: Random Password Generator

WordPress also lets the admin create more user accounts for different roles. However, it is important to create only the necessary user accounts and assign appropriate permissions to each. If you are creating a user account only for writing articles, give it a contributor or editor role.

Encourage users to change their passwords periodically. It is a good practice to keep your accounts safe.

3. Two-Factor Authentication (2FA)

Two-factor authentication (2FA) adds an extra layer of security to your WordPress site. After your enter a correct password, it will ask for a second form of verification before providing access. There are several plugins to enable 2FA on your WordPress site, but I recommend Wordfence. It is an essential security plugin that I recommend to all WordPress users. So, use the 2FA feature of the plugin to add two-factor authentication on your website.

4. Security Plugins

Security plugins provide an essential layer of protection against various online threats. These plugins safeguard your site by implementing a range of protective measures. If you are using a good security plugin, it adds a firewall that filters incoming traffic and blocks suspicious requests. The firewall also protects against common attacks like SQL injections, cross-site scripting (XSS), and brute-force attempts. Security plugins also provide options to limit the number of login attempts to prevent brute-force attacks. Some of the security plugins offer 2FA. You will also get a malware scanner to detect malicious code injection and removal.

Some of the plugins also offer real-time monitoring of your site’s activities. These plugins also alert you when your website has vulnerabilities in themes, plugins, and WordPress core files.

There are several highly regarded security plugins available for WordPress. Here’s a list.

• Wordfence Security
• Sucuri Security
• iThemes Security
• All In One WP Security & Firewall

Carefully configure the plugin’s settings to suit your specific needs.

5. File Permissions

File permissions are a critical aspect of WordPress security. It determines who can read, write, and execute files on your server. If there’s incorrect file permission on your server, it can leave your website vulnerable to attacks. File permissions are expressed in three categories: Owner, Group, and Public. Each of these categories can have three permissions: Read, Write, and Execute

To secure your WordPress installation, it’s important to set the correct file permissions for various files and directories.

Recommended File Permissions for WordPress

1. Files: 644
   • This means that files can be read and written by the owner, but only read by the group and the public. It prevents unauthorized users from modifying your files while still allowing them to be accessed when necessary.
2. Directories: 755
   • Directories should typically have 755 permissions, allowing the owner to read, write, and execute, while the group and public can only read and execute. This setup allows the necessary access to directories while preventing unauthorized modifications.
3. wp-config.php: 440 or 400
   • The wp-config.php file contains sensitive information, such as your database credentials. It’s recommended to set this file’s permissions to 440 or 400, ensuring that only the owner can read it, and it cannot be modified or executed by others.

6. Limit Login Attempts

Configure your WordPress to limit the number of failed login attempts. This helps deter brute force attacks, where hackers try to guess passwords repeatedly. I have already explained how WordPress security plugins can provide the option to limit login attempts on WordPress.

7. Web Application Firewall (WAF)

Consider using a WAF to filter incoming traffic and block malicious requests before they reach your WordPress site. There are two main types of WAFs for WordPress:

Cloud-Based WAF:

Cloud-Based WAF operates at the DNS level and filters web traffic before it even reaches your server. it also offers protection against Distributed Denial of Service (DDoS) attacks, spam, and other network-level threats. Cloudflare, Sucuri, and Akamai are some of the known cloud-based web application firewalls you can add to your WordPress website.

Host-Based WAF:

Host-Based WAF are installed directly on your WordPress server, and are integrated with your WordPress installation. this kind of firewall provides more detailed logging and protection tailored to the specific needs of your site. Wordfence and NinjaFirewall are two known web application firewall plugins for WordPress

8. Disable XML-RPC

XML-RPC is an API that allows remote access to WordPress. However, it’s a common target for brute force attacks. So, you can consider disabling XML-RPC on your WordPress.

Add the following code to your .htaccess file:

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
    order deny,allow
    deny from all
</Files>

If you are afraid of modifying code, you can use the Disable XML-RPC plugin to easily disable it.

9. Security Headers

Configure your web server to send security headers, such as HTTP Strict Transport Security (HSTS) and Content Security Policy (CSP), to help prevent common web attacks.

HTTP Strict Transport Security (HSTS) is a security header that forces browsers to communicate with your site over HTTPS only. This helps prevent man-in-the-middle attacks and ensures that sensitive data is always encrypted.

How to Configure HSTS:

Edit .htaccess file located in the root directory of your WordPress installation. Add the following lines:

# Enable HSTS
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>

If your website uses nginx, locate your Nginx configuration file (usually found in /etc/nginx/sites-available/ or /etc/nginx/nginx.conf). Add the following line inside the server block:

# Enable HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Content Security Policy (CSP) is a security header that helps prevent a variety of attacks, including XSS.

Edit .htaccess File (Apache Servers) and add the following lines to your .htaccess file:

# Enable CSP
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-ancestors 'none';"
</IfModule>

Edit nginx Configuration (Nginx Servers) and add following line inside the server block in your Nginx configuration file:

# Enable CSP
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-ancestors 'none';";

10. Regular Backups

Regularly back up your entire WordPress installation, including files and database. This allows you to restore your site in case of a security breach or other issues.

Read: How to Backup Your WordPress Blog

11. Stay Informed

Keep up-to-date with the latest WordPress security news and best practices. Subscribe to security blogs and forums to stay informed. It will keep you updated with the latest WordPress attacks and vulnerabilities.

Wrap Up

By following these guidelines, you can improve the security of your WordPress website and protect it from potential threats. However, it is important to understand that security is an ongoing process. You should regularly review your plugins, themes, and firewall settings. If you get to know about a vulnerable plugin installed on your website, update it without any delay. If there’s no update, consider removing it.