Updated: 09/01/2018
Ever worried about your website’s security? Sure you have. Although WordPress is one of the most secure CMS on the web, there have been cases where non-secured or neglected installations have fallen victims to malicious hackers and spammers.
Although, the most important security measure is to always keep your site backed up and updated, here are some extra steps in order to secure your WordPress website:
While the process is famous for its short duration (5min), we recommend spending a few more minutes to make it more secure.
As a good precautionary measure (although there’s a bit of controversy on the matter) we suggest you change the default database prefix from wp_ to something else (like a random string, e.g. l3xfr_) when installing WordPress. The particular prefix is declared in wp-config.php file. If you need to change the table prefix after installation (a quite risky process), you can check out these two guides: How to Change the WordPress Database Prefix to Improve Security and Change Your Database Prefix to Improve Security.
After completing the installation, you can keep wp-config.php file one level up on the server’s default public access directory (like public_html). Using your FTP account, you can move that file away from the rest files of the installation to make sure nobody will be able to access and change it, resulting in ruining your website.
Now, let’s see the very basics.
No joke, you need to do regular Back ups. Thankfully, there are some great Plugins for doing that: BackWpUp, UpdraftPlus WordPress Backup Plugin, etc. We recommend automated regular backups, especially to some external FTP or Cloud Storage solution (Dropbox, Google Drive) for security purposes. Alternatively, you can download the latest backups to your hard drive.
Yes but, here are some more things to check out. This is your installation and you care about it, so would you let a poorly authored plugin to ruin it? No, so:
Bonus: how to use .htaccess for keeping your site secured. The particular file existing on apache server, a very popular web-server, can be used for allowing or prohibiting access to back-end files of your installation and, is a very good way to keep your website secured.
Here is an example .htaccess file for disabling PHP execution on all files on a folder:
RemoveHandler .php .phtml .php3 RemoveType .php .phtml .php3 <IfModule mod_php5.c> php_flag engine off </IfModule> <Files *.php> deny from all </Files>
Now we are (almost) sure our website is safe. How about some extras?
Does your website requires feedback from the readers. If not, consider disabling comments and trackbacks as there are common gateways for intruders to “come in” and have, well, fun.
Connect to Jetpack. This amazing plugin is like a Swiss knife, offering among other features, extra security to your website. You only need one wordpress.com account and, you are ready to use it.
Install a third party antispam plugin. There are numerous available, but you can always use the Automattic promoted Kismet plugin, bundled with WordPress with just a small fee.
First of all don’t panic. You have been keeping backups (don’t you?) and, you can restore your website anytime. A good idea is to keep even older backups of your website because you don’t know (and probably won’t ever) now when exactly this thing happened. The site may have “broken” now but, malicious code may have been injected days or months ago. Keeping older backups may be helpful if you find out (or suspect) that the latest backups may have included the scum. Now, let’s do some treatment:
Add Comment