How to Protect Your WordPress Website from Hacking

Because of WordPress’s popularity, the platform and the websites built on it have become a target for hackers and bots. Over the years, as WordPress has grown more popular, an opinion has formed that the platform is unreliable and easy to hack. This opinion is mistaken, because almost all hacks are caused by mistakes and inexperience of the developers who build and configure the website.

I will tell you about the techniques and plugins I use when developing websites and which will help protect your website from any hacking attempts.

Login page

Block repeated, unsuccessful attempts to log in to the admin area (Login Lockdown or iThemes Security)
Enable two-factor authentication (Google Authenticator for WordPress)
Use an email address instead of a username to log in (WP Email Login)
Change the URL of the admin login page (iThemes Security or in the .htaccess file)
Remove links to the admin login from the front end of the site. Often this link is in the Meta widget
Use a strong password made of upper and lower case letters, digits and at least one special character (password generator or secure password generator)
Change your password from time to time
Do not show on the login page what exactly the user entered incorrectly (guide)

Admin panel

Password-protect the wp-admin folder using .htaccess (leave only the necessary files open)
Update WordPress regularly
Do not use the word admin when creating an account. If you already have such an account, create a new account with admin rights and delete the old one
Create an account with the Editor role and use it to publish content
Install an SSL certificate
Install a plugin that monitors file changes (WP Security Scan, Wordfence or iThemes Security)
Scan the site for viruses and security holes

Themes

Update your theme regularly
Delete themes you do not use
Download themes only from reliable sources (ThemeForest, ElegantThemes)
Remove the WordPress version from the code (guide)

Plugins

Update all plugins
Delete plugins you do not use
Download plugins from reliable sources
Replace plugins that have not been updated for too long with more recent alternatives
Do not install too many plugins

Database

Change the default database prefix (guide)
Set up a schedule of regular backups (Updraft Plus, WP DB Backup)
Use a very strong password for the database when you create it (password generator)

Hosting provider

Use a reliable company
Connect to the server via SFTP or SSH to upload files
Set folder permissions to 755 and file permissions to 644 (Codex recommendations)
Make sure nobody has access to wp-config.php
Delete license.txt, wp-config-sample.php and readme.html
Disable file editing via wp-config.php by adding this line: define('DISALLOW_FILE_EDIT',true);
Disable directory browsing with this code in .htaccess: Options All -Indexes

Our specialization is WordPress website development and maintenance. Contact us for a free consultation — [email protected], +371 29394520