Wordpress Security Tips

We host a ton of Wordpress based blogs and websites on our servers. Due to the fact that wordpress is extremely popular and widely used, it is also one of the most exploited web based softwares. So, I decided to put down a few lines of tips and tricks on how to secure that beloved wordpress site of yours.

• Keep wordpress & plugins updated at all times
  

Wordpress is updated  as soon as a security issue is identified. Updating wordpress is very easy, just login to your admin dashboard and the home page should give you an option of updating your installation. The same applies for all plugins and themes that you use. The inbuilt wordpress update utility makes the entire process of updating your wordpress installation extremely easy.

Do not forget to backup your database and files before updating. Nothing is worse than a broken WP site.

• Only use essential plugins

This perhaps is one of the most common reason why wordpress sites get hacked frequently. The wordpress plugin directory is undoubtedly a great resource but it should be noted that most of these plugins are not coded by professional developers and carry numerous loopholes and vulnerabilities in them. It is very important that you use only the plugins that you need. Check the reviews and ratings of plugins before installing them.

• Change your username and password
  

The default wordpress admin username is admin, you should change this to something else. Create a new user from your dashboard and assign that user admin privileges and remove the default admin user from your wordpress installation.

There’s nothing worse than having “myname123′ as your password. Use something like StrongPasswordGenerator and create a strong password for your users.

• Secure WP-Config
  

Your wp-config file should only be readable by the server and should be CHMOD’d to 400 or 440. You should also move the wp-config file to a different location. Move the file up one directory from your WordPress root. WordPress will automatically look for your config file there if it can’t find it in your root directory.

• Restrict admin login
  

If you use a dedicated ip address at your home/workplace or access the web through a VPN, you can lock down access to the wp-admin folder to your IPs only.  To restrict logins based on IPs, do the following:

Add a .htaccess file to the root folder of your wordpress installation.

Open the files and place the following code inside it:

<Files wp-login.php>
        order deny,allow
        Deny from all

# whitelist First IP Address
allow from xx.xxx.xx.xx

#whitelist Second IP Address
allow from xx.xxx.xx.xx

</Files>

 

• Use Login LockDown

Login LockDown acts as a firewall and if it detects too many failed logins to your wp-admin dashboard from a single IP, it will block that IP from accessing the login page. You can also modify the duration of the block.

• Change your secret keys

Open your wp-config.php file to find the following 4 lines of code:

define('AUTH_KEY', ''); 
define('SECURE_AUTH_KEY', ''); 
define('LOGGED_IN_KEY', ''); 
define('NONCE_KEY', '');