WordPress is the most popular content management system (CMS) on the internet for websites. Because it is the most popular, WordPress site may become an easy target for hackers if you aren’t being careful and proactive. We understand the importance of website security and invest in premium security tools. It is a top priority to keep client sites secured and monitored daily, yours should be too. If you aren’t frequently monitoring your website, you may become vulnerable. You may be wondering, is WordPress secure? It depends. It is very secure as long as WordPress security best practices are followed. If you neglect ongoing maintenance and monitoring then it probably isn’t secure.
In this post, we will list our top 10 tips to secure your website to significantly reduce your vulnerability from attacks.
Keep WordPress Core, Themes and Plugins Up-To-Date
It might not seem important, but if your website is running outdated versions of themes, plugins or WordPress you are opening yourself up to hackers. Updating notifications may be annoying but they should not be neglected. Often the updates that appear on your dashboard are important patches that fix security issues, bugs, and other reported vulnerabilities. Although, before running updates it is important to back up your website off-site using a tool like BackupBuddy. All of our Plus Subscriptions enjoy the peace of mind of the off-site backups in addition to daily server-level backups. When running updates, be sure to update plugins first, then your theme, then WordPress. An easy way to remember the order is to update in alphabetical order. Once the updates are complete, review your website to ensure there are no issues. If you haven’t updated your site in a while, you are more likely to notice issues.
Be Cautious Before Installing Plugins
Only install themes and plugins from trusted sources. To be safe, stick to the WordPress.org plugin directory for free and premium plugins. Installing insecure, out-dated or poorly written plugins is a popular way attackers can exploit your website. Your site is only as secure as you make it, so be diligent and do not give untrusted sources access to your website by unknowingly installing a malicious plugin. Avoid bootlegged versions of premium plugins, this is another common to find malware in the code.
Keep the Bots Away by Using Secure Passwords.
The most commonly attacked WordPress vulnerability is admin logins. This provides the easiest access to hackers using brute force attacks. Brute force attacks are a trial and error method used to try and discover username and password combinations to essentially hack into the backend of your website. According to iThemes, an attacker can go through thousands of different password combinations in a minute. All Barketing maintained WordPress websites are secured from these type of attacks. When our security tool recognizes a brute force attack, it will immediately blacklist that IP address so it can no longer access your website. Don’t worry, we’ve got your back! Avoid using weak passwords by including multiple characters, symbols, and numbers. Additionally, use a strong and unique password that is not used for anything else and store it in a secure place offline. For additional login security, limit login attempts, add a captcha, use two-factor authentication, and make a habit of changing your passwords often.
Avoid Cheap, Poor-Quality, and Shared Hosting
Your server is another target for hackers, so it is important to invest in a high-performance server and not settle for a budget host. All hosts do take precautions but not all servers are as vigilant as others. Shared hosting on budget hosts can be a concern because if one website on the shared server is hacked, then they may also gain access to other sites. All Barketing websites are hosted on our fully-managed dedicated server with BigScoots, therefore all sites on our server are our managed clients to ensure ongoing performance and proactive security monitoring is used.
Back it up!
Regularly backing up your website is another way to ensure your site is secure. If your website is ever compromised, you will be able to easily restore a clean version of your website. Your server should conduct daily backups but it is even better to configure scheduled off-site backups to a secured location for added security. It is important to ensure that your backups can be restored. A tool like BackupBuddy is a great investment if you aren’t on our Plus subscription.
Install a WordPress Security Plugin
Installing a premium security plugin is like having your own security assistant to help catch and fix common vulnerabilities, block hackers, and strengthen the overall security of your site. iThemes Security Pro and BackupBuddy make a great team. We take security seriously so we invest in the best tools, you should too!
Add an SSL Security Certificate
Not having an SSL certificate installed on your website is a major security threat. However, it also negatively effects your SEO because Google views your site as “not secure”. If someone visits your site and enters their contact information, fills out a form or enters their credit card information if your site isn’t secure that communication can be intercepted by a hacker. The SSL certificate will protect your content from being stolen by adding a level of encryption to the communication. There are free options available so you have no excuse not to have an SSL installed.
Keeping Unused or Out-Dated Plugins
If you have plugins or themes that are marked as “inactive” or not being used, delete them. Maybe you added a plugin to try it out, but you never ended up using it. It is a good idea to uninstall and fully delete these plugins as they can post a security risk. Furthermore, if you are using an outdated plugin that hasn’t released updated recently, these also post a security threat and should be deleted and replaced.
You may be concerned about potential security issues. It is important that you or your webmaster routinely monitor and protect your site against security vulnerabilities and malware. With a tool like iThemes Pro Security, you can set up notifications to be alerted of potential threats. WordPress is the most popular website platform therefore, it is important to secure and protect your site. Is your site secure?
Erika Godwin is the President of Barketing Solutions and the Co-Founder and CMO of ProPet Software, an industry-leading kennel management software. Erika has over 8 years of experience with WordPress and graduated from Elmira College in 2009 with a BS, Business Administration- Marketing and Management. View Erika’s Full Bio.
