In the first half of 2021, there were more than 86 billion password attack attempts blocked, and it is estimated that there are an average of 30,000 new websites hacked every day. Hackers and various types of malware are relentless in their attempts to gain access to websites and their sensitive data.
Secure Sockets Layer (SSL) certificates are an industry standard used by millions of websites to protect their online transactions with their customers. Obtaining one should be one of the first steps you take to secure your website. You can buy an SSL certificate, but most hosting providers offer them for free. Next, use a plugin to force HTTPS redirection, which activates the encrypted connection.
Along with obtaining an SSL certificate, one of the very first things you can do to protect your site is to use and require strong passwords for all your logins. It might be tempting to use or reuse a familiar or easy-to-remember password, but doing so puts you, your users, and your website at risk. Improving your password strength and security decreases your chances of being hacked.
Installing a security plugin can add some extra layers of protection to your website without requiring much effort. To get you started, check out this list of recommended WordPress security plugins. Wordfence Security – Firewall & Malware Scan All In One WP Security & Firewall iThemes Security Jetpack – WP Security, Backup, Speed, & Growth
Keeping your WordPress up to date at all times is critical to maintaining the security and stability of your site. Every time a WordPress security vulnerability is reported, the core team starts working to release an update that fixes the issue. If you aren’t updating your WordPress website, then you are likely using a version of WordPress that has known vulnerabilities.
Keeping WordPress updated ensures your core files are in check, but there are other areas where WordPress is vulnerable that core updates might not protect – such as your themes and plugins. For starters, only install plugins and themes from trusted developers. If a plugin or theme wasn’t developed by a credible source, you are probably safer not using it. On top of that, make sure you update your WordPress plugins and themes.
One way to protect your WordPress website is to always have a current backup of your site and important files. The last thing you want is for something to happen to your site and you do not have a backup. Backup your site, and do so often.
Because “admin” is such a common username, it is easily guessed and makes it much easier for scammers to trick people into giving away their login credentials. Never use the “admin” username. Doing so makes you susceptible to brute force attacks and social engineering scams. Much like having a strong password, using a unique username for your logins is a good idea because it makes it much harder for hackers to crack your login info
By default, a majority of WordPress login pages can be accessed by adding “/wp-admin” or “/wp-login.php” to the end of a URL. This makes it easy for hackers to start trying to break into your website. Hiding your WordPress login page is a good way to make you a less easy target. Protect your login credentials by hiding the WordPress admin login page with a plugin like WPS Hide Login.
WordPress uses an implementation of the XML-RPC protocol to extend functionality to software clients. This Remote Procedure Calling protocol allows commands to be run, with data returned formatted in XML. Most users don’t need WordPress XML-RPC functionality, and it’s one of the most common vulnerabilities that opens users up for exploits. That’s why it’s a good idea to disable it. Thanks to the Wordfence Security plugin, it is really easy to do just that.
Your WordPress wp-config.php file contains very sensitive information about your WordPress installation, including your WordPress security keys and the WordPress database connection details, which is exactly why you don’t want it to be easy to access. This basically means you are giving your site some extra armor against hackers.
Like old versions of WordPress, outdated versions of PHP are no longer safe to use. If you aren’t on the latest version of PHP, upgrade your PHP version to protect yourself from attack.