How to Protect Your WordPress Website

WordPress is the most popular content management system used by all personal blog websites & e-commerce sites. However, it is also quite popular with cyber thieves to exploit the weaknesses of the platform.

We should be considering the correct way to protect a WordPress website. We’re going to discuss 10 best practices for the security of your WordPress website.

1. Select a good hosting provider

    Why do we select a good hosting provider? Because we need a good security environment for our WordPress website. We recommend WordPress hosting for WordPress websites. Because it is optimized for the WordPress website itself.

It is vital that the many types of hosting services offered be considered when picking a provider. Here are a few factors to take into account when deciding where you are required to host your site.

• How do you construct a website? Blog, Business Website, portfolio, E-commerce etc.
• What bandwidth is needed to run your site based on the website type?

Also we can implement firewall, auto backup malware scans and technical support.

2. Update WordPress version

 With each update, several improvements are made, also, often includes bugs fixing, security feature updates. Being with the latest version like this will help you to protect yourself from being targeted by vulnerabilities that can be used by hackers to gain access to your site.

3. Enter a Strong Username and Password

 For privileged users like administrators, strong passwords are important. Because the Hackers go through a lot of passwords and try to guess the password. If you are using safe passwords, there is a most minimal risk of successful assaults.

Here are some recommendations on the security of passwords:

• use at least 12 numbers
• use upper and lower case characters
• use special characters such as ! @ # etc…

https://www.lastpass.com/features/password-generator

4.  Install an SSL Certificate to the website

 Now, SSL certification is the most important component of a website. For websites that were required to be secure for some transactions, for example, payments were formerly necessary for SSL. However, whether your website handles payments does not matter these days. SSL is compulsory for all sites, including passwords, names, and addresses, which process sensitive information. Today, however, Google understands the significance of SSL certification and ranks websites with higher in its search results.

5. Change the URL of your Login Page

The default login address for WordPress is “example.com/wp-admin” or “www.example.com/wp-login.php“. However, putting it this way makes it easier for hackers to figure out how to get into your backend and launch an attack by a brutal force.

You can change the URL (slug) to your login page using a plugin.  Also,

by installing a 2-factor authentication plugin on your WordPress site, you may better secure your login page and You may also see which IP addresses had the most unsuccessful login attempts and then ban them.

6. Using .htaccess for Security

 The .htaccess file ensures that WordPress links function correctly. If you don’t have this file, which contains the necessary rules, you’ll receive 404 errors that you won’t be able to solve. Furthermore, the file might assist you in better protecting your WordPress site.

• Restricting Access to the WordPress Administrator Area

For example, you may use .htaccess to limit access from specific IP addresses or stop PHP execution on specified directories. The examples below demonstrate how to strengthen your WordPress security with .htaccess.

 

• Disabling PHP Execution in Specific Folders

Backdoor scripts are frequently uploaded to the Uploads folder by hackers. This folder should not include any PHP files by default because it solely hosts submitted media files.

Create a new.htaccess file in /wp-content/uploads/ with the following rules to keep your WordPress site secure from PHP execution:

7. Keep Directory permission carefully

 This means preventing hackers from adding unwanted code and scripts by determining which users can read, write, or activate files or folders on your site.

This may be done manually using the File Manager inside your hosting control panel, or using the “chmod” command from the terminal (connected through SSH).

8. Changing the Default WordPress Database Prefix

 All of the information needed for your site to work is stored in the database. For this reason, hackers often target databases with SQL injection attacks.

If you have WordPress installed, the default prefix you will see is wp-. So, I suggest you change it to something different.

When you use the default prefix, your site’s database is vulnerable to SQL injection attacks. By replacing wp- to another word, such assaults may be avoided. You might call it ef-.

For example,

9. Limit Login Enable

 By default, WordPress allows users to attempt multiple access times. But we can limit it.  so will block users from attempting more often. So the hackers lock up before they can finish their attack.

10. Install a Security Plugin

 Now let’s talk about the benefits of using a security plugin. Most of the above are covered by good security plugins, which can do a lot of things with a small number of plugins. Here are some examples:

• Another popular solution with a lot of capabilities is Wordfence security. The plugin analyses WordPress for numerous security threats such as dangerous code, spam injections, and even bad URLs, making it ideal for users with several websites.
• WP Cerber Security is a fantastic plugin with a powerful set of features, many of which are mentioned in this article. However, this is likely one of the security plugins with the most extensive set of functions.
• iThemes provides excellent security features. It’s a more straightforward and user-friendly plugin. For those new to website security or just new users in general, iThemes Security can be a helpful resource as it works well for personal blogs and small to medium-sized websites.

 

Written by: Chamod Tharuka Hewawasam,

Junior Lead – Web Development, Enfection

 

Reference Links :

https://www.codeinwp.com/blog/secure-your-wordpress-website/

https://medium.com/@AmDee_Elyssa/10-wordpress-tips-to-make-your-website-secure-133ffc35f27a