WordPress, as the most popular content management platform today, is a favorite target for various cyber attacks. Therefore, ensuring adequate security of your WordPress site is necessary in order to prevent hacks and possible damages.
In this article, we will review the most important steps to take in order to secure your WordPress website yourself, focusing on simple and easy-to-implement actions that do not require special technical expertise.
The approach to securing WordPress sites or rather to updating WordPress sites is to start with what is most likely to cause errors and from there slowly to things that probably won’t cause errors and the reason is that if during the update process I get an error I would like to know at the beginning of the process and not at the end.
The website security process in this article talks about a situation where the website has not been hacked, and if everything goes without errors, if you make an error in part of the security process, you must restore a backup, and repeat the operation again, skipping the step that caused the error.
Website security is fine, but first a backup
On a website, as a general rule of thumb, it is always but always to back up before any action.
So before we start let’s back up the site first, I like to use the WP ALL IN ONE WP MIGRATION plugin, but any other plugin works.
Some storage servers also have the option to back up the website from the interface, this is of course better.
Updating the WordPress version and plugins
One of the main reasons for hacking WordPress websites is the use of old versions of the platform or plugins, which contain known security holes. Therefore, it is very important to make sure that the WordPress version and plugins on your site are always updated to the latest version.
WordPress version update
The first thing we want to back up is our WordPress version, the WordPress version can be seen in this link:
https://eyal.cc/wp-admin/about.php
And here you can see the latest version.
https://wordpress.org/news/category/releases/
If your version is not updated, there should be a simple button to click and it will update the WordPress version, a 2 minute process and you are done.
Update plugins and templates
Add-ons can be seen on your add-ons page:
Updating free plugins is very simple, you just have to click on the link to update each plugin (remember, it’s important to have a backup first) do it one by one, until you’ve finished them all!
Regarding updating paid plugins, you usually have to download the plugin from the company’s website and then upload the plugin manually to the website, there is no need to delete the old plugin, the new one will simply overwrite the old plugin and replace it.
Important – after updating plugins it is very important to do a comprehensive check of the entire site including:
- View all the pages of the site
- Filling out details in all contact forms
- Adding a variety of products to the basket (regular products, variations, and other types if available)
- Complete checkout process
- Access to the admin and opening all the pages in the admin
- If there is additional functionality then also execute
PHP version update
The PHP version is very related to the security of the site but is not carried out inside the WordPress site, these are in storage.
You must go to the storage service you store in and check how to update the WordPress version, if you can’t find it, feel free to contact and ask the storage company to perform the update, it should be included in the service they offer.
More updates
Password management
Care must be taken to choose strong and complex passwords both for the management interface and for all system users. Weak and simple passwords are an easy target for hacking. You should use a password manager for this.
Restricting access to website users
Access to various folders and files on the server should be limited as much as possible, and full access should only be allowed to those who absolutely need it. Also, you should limit the number of failed login attempts to the management interface in order to prevent brute force attacks.
Go to the users page and filter only admins:
Quick link: https://eyal.cc/wp-admin/users.php?role=administrator
Here you have a list of all the users who have administrative access to the website, so first of all the website should have one admin, and every other employee in the company should have the appropriate permission, there is a wide variety of permissions but I will mention 3 main ones here:
- Admin – The admin has access to everything, there should only be 1 such for each, and he should be responsible for a number with passwords, and accesses.
- Content editor – a content editor can write articles, and other content on pages and a blog, very common for blogs, and content sites
- Store manager – if you have e-commerce, every employee who works with you in the store will receive a maximum of this access to the website and no more.
Hiding sensitive information
Avoid revealing sensitive information such as the WordPress version, usernames and server details. This information may help potential attackers to locate weak points in the system.
Monitoring and backup
It is recommended to install a high-quality security plugin that will monitor threats in real time, warn of suspicious activity and even block it. Also, take care of a daily backup of the website so that it can be restored quickly if necessary.
A common plugin that I recommend is Wordfence , a paid plugin but does the job.
If you want free plugins you can also find them online, but I cannot recommend such a plugin.
Enable HTTPS
Enabling secure communication using HTTPS is essential in order to encrypt the traffic between the browser and the server and prevent the theft of sensitive information such as usernames and passwords.
Change the management interface address
It is recommended to change the address leading to the WordPress administration interface from the default address, in order to make targeted attacks against this interface more difficult.
Server security updates
Make sure with the storage provider that the server itself is updated in terms of information security and includes protection mechanisms such as a firewall. A defective server in this respect may damage the security of the WordPress site.
Summary
Implementing the steps detailed above will allow you to significantly strengthen the protection of your WordPress site against various threats, while maintaining simplicity and ease of application. It is recommended to carry out a periodic security check in order to make sure that the required standards are indeed met, and to continue to improve the security system according to the changing developments and threats.
Share with us in the comments any additional recommendations you have for independent security of WordPress sites!
