WordPress Security: 10+ Great Tips To Protect Your Site

You always want to make sure you have applied all updates to WordPress as they come available. By not keeping your website updated you are putting your website at risk since many updates are done just to keep your website secure.

Before you do an update, make sure you run a full backup of your website.

If you see this message when you login to your WordPress – take a few minutes to make sure you have a recent backup and then you can update your WordPress to the latest version.

Also, consider following the WordPress blog which will show you the latest updates and releases: WordPress News

Schedule WordPress Backups

Make sure you always have a backup of your website! If your WordPress security is at risk or if you have in fact been hacked this will allow you to easily restore your website to a previous version – then you can take some of the steps in this post to have it not happen again!

Here are a few WordPress backup plugins that we personally like.

Update Your Plugins

WordPress plugins also need to be updated – an outdated plugin can leave a lot of ways for hackers to get in!

Also use caution when downloading plugins, since plugins are open-source and can be created by anyone for use – you have to use caution and be sure you are downloading ones that are free from malicious code. Make sure you are doing your research on plugins before installing any on your website!

Look at the reviews, learn about the author and be sure to see how often they are updating it. Some extensions have not been updated in a long time – that is a signal that issues could arise. By reading the reviews and looking at the support questions you can see the issues that the plugin may have – and make better choices in the plugins that you choose to use.

Before downloading any plugin, we do recommend doing a quick check to make sure there are no vulnerabilities! 

If you are still logging in to your WordPress admin with the username of “admin” – you are putting yourself at risk. This is the FIRST thing you should change when you launch your WordPress website – or your developer should have changed it for you before handing your site over to you.

If you need to change your username – here are the simple steps:

a) Create a NEW user and make sure they are set to have administrative access.
b) Make sure your new username is unique and your password includes a variety of numbers and letters in both capital and lowercase.
c) Logout from the old admin user once the new user is created
d) Login with the new user login you just created
e) Go to users and DELETE the old admin user name – it will ask you where you want to transfer all posts, make sure you choose the NEW username you just created

By removing the “admin” username you now have a much more secure website. If you need help choosing a really secure password, here is a great tool that can help: Password Generator

Choose Secure Hosting

Hosting is one of the top reasons for hacking issues – as noted above reports show that 41% of hacking attempts were caused at the host level. If you are on a cheap host or one that is not doing everything it can to prevent hack attempts then you are opening yourself up to allow the hackers in. If you are hacked at the host level, there is nothing you can do to prevent it and you are at the mercy of the host to fix it!

It is important to invest in a host that will be a step ahead of the hackers, and while no host is immune to hackers completely – some do a lot more than others to keep them at bay.

Here are some things to consider when signing on for hosting.

a) Choose a host that provides free backup recovery – although you should have your own as well, it is a great addition so that you never loose your data
b) Ask if the host offers security monitoring services that monitor for malware – do a search for “hosts offering free daily malware scanning”
c) If you are considering a host do your research! Do searches for things like “my site was hacked on whatever host you are considering“
d) Review the recommended WordPress hosting list at WordPress Hosting Recommendations

Be sure to do your research! If you are doing research about hosts, be sure to find websites that give actual insight via comments and dialogue – there are many web pages that are “website hosting review” sites, but those are just affiliate websites trying to make money – do not use those to make such an important decision!

WP-Config.php File

If hackers can get access to your wp-config.php file – they can wreak havoc!

This is a file in your root directory that contains all the data and details about the configuration of your blog, by securing your website to make sure no one has access to this file it is a major way to prevent a hack.

By adding the following code to your .htaccess file – you can prevent anyone from accessing the wp-config.php file. This will also block the website owner from accessing the file as well – so if for some reason you need to edit this file in the future, you will need to remove this code from the .htaccess.

# Deny access to wp-config.php file
<files wp-config.php>
order allow,deny
deny from all
</files>

Personal Computer

Yes, what is going on on your own personal computer can impact what happens on your website. Imagine you have malware on your computer that is tracking your every move (called a keystroke logger). Then the hackers can see every keystroke and gain access to your WordPress files just from this malware.

No matter how secure you may make your WordPress website, if you have malware on your computer it is all in vain. Make sure your computer browsers are up to date, you run frequent malware scans and keep your operating system updated to avoid computer malware issues that can cause issues with your website.

Use A WordPress Security Plugin

There are a few great plugins that you should definitely install that will do a great job of monitoring your website for a variety issues from malware to file integrity to activity auditing.

Here are a few to consider, each have their own advantages and some offer a free and premium version.

Sucuri Security
Wordfence
All In One WP Security & Firewall

We use Wordfence on our website and here is a screen capture of a recent scan that we have done on 2 Dogs Design:

You can see that is found an issue in the old themes, plugins and core files section. When we scroll down we can see exactly what plugin has the issue and take action to fix it. In this case it was our Shareaholic plugin – which needed to be updated. But this is a great way to see at a glance where you may have vulnerabilities.

Protect Your Admin Area From Unwanted Access

There are a couple of ways you can keep your admin area safe from unwanted access.

If you are a small website that only has a few people who need access to the admin and you have no need for visitors to access it, you can restrict access by applying the following code to your .htaccess file:

# Block access to wp-admin.
order deny,allow
allow from x.x.x.x

The allow from should be your IP address. If you are not sure what that is you can visit whatismyip.com where you can get your IP address.

You will need to add that line that starts with Allow for EACH person that needs access to your admin with their specific IP address.

As an alternative – if you have several people who require access or if you often rely on Wi-Fi networks that can change IP addresses often, you can use a plugin that will allow you to set limits on your login settings.

A couple of good ones that have several login related features to protect you are:

We use Wordfence on our website and for a short while had it set to email us when there were attempts at logins to our admin. We stopped that email notification quickly as it became overwhelming! Yes, there are really that many attempts every day to access your WordPress login. This is a simple step that can have great rewards.

Here is a sample of an email received that showed an attempt that someone was trying to make to access our admin login.

You can see in the email that they used an invalid username “admin” – which is why it is critical that you change that!

This email was sent from your website “” by the Wordfence plugin at Wednesday 17th of December 2014 at 11:45:14 AM

The Wordfence administrative URL for this site is: https://www.2dogsdesign.com/wp-admin/admin.php?page=Wordfence

A user with IP address 93.61.66.215 has been locked out from the signing in or using the password recovery form for the following reason: Used an invalid username ‘admin’ to try to sign in.

User IP: 93.61.66.215
User hostname: 93-61-66-215.ip145.fastwebnet.it