Most website owners assume that the odds of their site being hacked is very low. The reality is that it occurs more often than you would suppose and sadly most website owners are usually not conscious of the risk.
Have you ever seen noticed a warning on Google that says “This site may harm your computer?” These are web sites which were hacked and subsequently blacklisted by Google. Most visitors would never visit your web site if they see this warning and even worse – Google will eventually blacklist these websites from it’s search results pages.
The following is a brief list of suggestions that may drastically enhance the safety of your WordPress web site.
1. Use Robust & Difficult to Guess Passwords
It might seem simple however you’d be amazed by the amount of website owners ignore this. Irrespective of how secure your website is, a weak password can undo all that work within seconds. Your entire website’s security relies on the strength of that password.
Listed below are three suggestions for deciding on your password:
- Use a password manager such as LastPass to generate and save secure passwords.
- Never use any personal information or use the site’s name in the password
- If you’d prefer something easier to remember, try a lyric from your favourite song but mix it up with some capital letters, numbers and symbols.
2. Keep WordPress And Your Theme & Plugins Updated At All Times
One of the greatest strengths of WordPress is the community of developers and security experts working on it 24 hours day. That means that if a security vulnerability is found, the developers release updates to patch these vulnerabilities. On the flip side – when these vulnerabilities are discovered, they then become widely known which makes older versions of WordPress and it’s themes and plugins extra susceptible to attack
3. Watch out for Malicious Themes or Plugins
Some WordPress premium themes and plugins can cost a lot of money and where there’s people selling premium digital goods there will be people pirating premium digital goods. A lot of these pirated themes and plugins look and work exactly like the legitimate plugins but have been known to contain hidden code which when installed can give a hacker full control of your website. Never install a plugin or theme unless it is from a reputable source.
4. Disable File Modifying
WordPress offers site owners the ability to edit theme and plugin files directly from the WordPress admin area. This function may be very helpful for fast edits however it may also be helpful to a hacker who manages to access the administration dashboard. The attacker can use this function to edit PHP files and execute malicious code. To disable this function add the next line to your wp-config.php file.
outline('DISALLOW_FILE_EDIT', true);
5. Lock down your wp-config.php
Thge wp-config.php file of your WordPress incorporates some essential configuration settings and your database information. That is why it’s essential for the safety of your WordPress site that no one could have access to that file.
Usually the wp-config.php is usually not accessible to the general public. However it’s a good suggestion to add an additional layer of protection by utilizing .htaccess guidelines to deny requests to it.
Simply add this to the.htaccess file in your web site root:
<recordsdata wp-config.php> order permit,deny deny from all </recordsdata>
6. Block Access to your WordPress Directories
Prevent people from browsing your server files by adding the following line to your website’s .htaccess file.
Choices -Indexes
This will disable the ability for anyone to view the files on your server in their browser.
7. Change username
Hackers are well aware that the most typical user name WordPress site owners use is admin so leaving your username as admin is doing half the hackers job for them
Most people set their username when installing WordPress for the first time. However if you have already installed WordPress it is still possible to update to a more secure username in your hosting account’s PHP MyAdmin interface.
Simply go to phpmyadmin – choose your database name – click the SQL tab and then paste the following (changing NewUsername to your desired username)
UPDATE wp_users SET user_login = 'NewUsername' WHERE user_login = 'admin';
It is very important to remember that even when you implement all my recommendations you may by no means be 100% shielded from hackers. However the above suggestions are a good start on your road to a more secure website.
