How To Protect WordPress From hacking: Tips And Best Practices

How To Protect WordPress From hacking: Tips And Best Practices

Similar to Microsoft Windows in the software industry, WordPress, the most popular self-hosted content management system (CMS) online, takes the brunt of assaults. This open-source infrastructure, which is hosted on GitHub, turns into an ideal target for hackers looking to compromise WordPress websites.

Maintaining current software versions is a crucial first step in fortifying your WordPress installation. Enhancing security requires updating your software, as well as your themes and plugins. Here are some tips on how to make your WordPress blogs more secure:

Login with your WordPress account:

The initial user that installs a WordPress blog is automatically given the username “admin.” It’s essential to create a different user to manage your WordPress blog for increased security. Take the following actions to protect your website:

Create a Distinct User: By creating a brand-new user profile with an unusual username that is hard to guess. As a result, there is less chance of illegal access to your blog.

Remove the “Admin” User: To increase security even more, either remove the “admin” user by default or change its role from “administrator” to “subscriber.”

Single Sign-On with Jetpack: Implementing single sign-on with Jetpack is an even better strategy. You may use this feature to log into your self-hosted WordPress blog using the credentials from your account.

By putting these precautions in place, you strengthen the security of your WordPress blog and lower the risk of security breaches.

Do not advertise your WordPress version to the world:

Regularly displaying their version numbers, WordPress websites run the risk of disclosing vulnerable, unpatched software. Increasing security

Information about the version may be hidden with ease by making a small change.

Remove the readme.html page from your WordPress installation directory as well. The public may unintentionally learn your WordPress version via this file.

You strengthen the security of your website and thwart any threats by acting quickly.

Don’t let others “Write” to your WordPress directory:

Follow these instructions to handle directory permissions efficiently to strengthen WordPress security:

Examination of Directory Permissions To find “open” folders, where any user can write files, log in to your WordPress Linux shell and run the following command:

find . -type d -perm -o=w

The following instructions will help you to properly set the permissions for your WordPress files and directories:

find /your/wordpress/folder/ -type d -exec chmod 755 {} \;
find /your/wordpress/folder/ -type f -exec chmod 644 {} \;

The command “chmod 755” for directories gives the owner write access while allowing others to read and execute. Files are set to “chmod 644,” allowing owners read and write access but limiting everyone else to read-only.

You can protect your WordPress site from unwanted changes and improve overall security by carefully controlling permissions.

Rename your WordPress tables prefix:

Tables have predictable names like “wp_posts” or “wp_users” when WordPress is first configured using default settings. Consider changing these table prefixes to something more random to increase security. This procedure is made simpler with the “Change DB Prefix” plugin, which enables you to quickly edit your table prefix with a single click.

Prevent users from browsing your WordPress directories:

To strengthen WordPress security, take the following critical actions:

Take down Directory Listing: Find the.htaccess file in the root directory of your WordPress installation. Add the next sentence at the top:

Options -Indexes

If the default index.html or index.php files are missing, you can prohibit outsiders from viewing a directory listing by doing this.

Update WordPress Security Keys: Visit the link provided to generate six new security keys for your WordPress blog. Update WordPress Security Keys. Replace the existing keys in the wp-config.php file in your WordPress directory with the new ones by navigating there.

Your saved WordPress passwords are substantially more secure thanks to these randomly generated salts. An additional benefit is that unauthorized users will be automatically unlogged out once their cookies expire if they connect into your WordPress account without your knowledge.

By putting these procedures into practice, you may increase the general security of your WordPress site and protect it from potential flaws and illegal access.

Keep a log of WordPress PHP and Database errors:

A wealth of information about the erroneous file requests and database queries that are hurting your WordPress site may be found in error logs. The Error Log Monitor program is my personal choice for error log monitoring. Error logs are simply delivered to your mailbox, and they are also displayed as a widget on your WordPress dashboard.

Simply add the following code to your wp-config.php file to activate error logging on your WordPress platform. Make careful to substitute the exact location to your log file for “/path/to/error.log”. Remember that your error.log file should be kept in a location that is unavailable to web browsers for security reasons (you may use this as a reference).

You’ll be more prepared to diagnose and improve the speed of your WordPress site if you use this simplified method and the power of error logs. It’s a proactive move in the direction of upholding a sound and error-free internet presence.

define('WP_DEBUG', true);
if (WP_DEBUG) {
define('WP_DEBUG_DISPLAY', false);
@ini_set('log_errors', 'On');
@ini_set('display_errors', 'Off');
@ini_set('error_log', '/path/to/error.log');
Password Protect the Admin Dashboard:

It is crucial to secure your WordPress website. Since the content of the wp-admin directory isn’t intended for public viewing, think about password securing it. By adding an additional layer of security, the total level of protection is increased because even authorized users must input two passwords to access their WordPress Admin panel.

Track login activity on your WordPress server:

The “last -i” command is essential for Linux server security for your WordPress website. It provides you with a thorough list of all the users who have accessed your server, along with their matching IP addresses. This useful information enables you to quickly see any strange IP addresses, alerting you to a potential security breach and requiring you to change your password right away.

Use the following command to do a more thorough study of user login activities over a longer time frame. Do not forget to substitute your real shell username for “USERNAME”:

last -if /var/log/wtmp.1 | grep USERNAME | awk '{print $3}' | sort | uniq -c

In addition to displaying login information, this command groups it according to IP addresses to give a clearer view of activity trends. By exercising caution and using these Linux commands, you may strengthen the security of your WordPress server.

Monitor your WordPress with Plugins:

A wealth of security plugins are available in the repository to protect your website from hacks and other shady activity. My top options are as follows:

  • Exploit Scanner: Rapidly scanning files and blog posts for possibly dangerous code, the exploit scanner. It goes above and above, finding hidden spam links within your postings, even when they are covered up with CSS or IFRAMES.
  • WordFence Security: This plugin, a strong guardian for your website, continually compares your WordPress core files to their equivalents in the repository and highlights any changes. By locking out users after a certain number of unsuccessful login attempts, it also improves security.
  • WP Notifier: For people who don’t frequently visit the WordPress Admin panel, WP Notifier is ideal. This plugin makes staying up to date simple by sending email alerts when updates are available for installed themes, plugins, and the core of WordPress.
  • VIP Scanner: VIP Scanner is the “official” security plugin for WordPress that examines your themes for flaws and finds any inserted ad code in your templates.
  • Sucuri Security:  Sucuri acts as a watchful sentinel, keeping track of essential file changes and sending email notifications anytime a file or post is modified. It also keeps track of user login activities, informing you of successful and unsuccessful login attempts.

Bonus Tip: Use the following Linux command, replacing’mtime’ with’mmin’ to select minutes, to track files updated in the prior three days:

find . -type f -mtime -3 | grep -v "/Maildir/" | grep -v "/logs/"

With these dependable plugins and the command tip, the security of your WordPress site is well-established and protected from future dangers.

Secure your WordPress Login Page:

By default, your WordPress login page is visible to everyone. But if you’re worried about illegal access, you have three practical choices:

Password Protection with .htaccess: Add an extra layer of security to the wp-admin folder. Users must use a username and password in addition to their standard WordPress login information to utilize this technique.

Google Authenticator: Use the Google Authenticator plugin to increase security on your WordPress site by introducing two-step verification, similar to what is used for Google Accounts. For login, users must enter their password and a time-sensitive code produced on their mobile device.

Password-less Login: By enabling users to scan a QR code to enter their WordPress website, the Clef plugin revolutionizes login. Additionally, utilizing your mobile device, you may remotely end the connection, which adds ease and security.

You may select the solution that best satisfies your security requirements for your WordPress site from these selections because they all provide differing levels of protection.

Leave a Comment