04/18/2016 Joe Jensen

Securing Your WordPress Website

WordPress is one of the most popular frameworks for building websites. It is easy to manage, it’s intuitive, and beginner friendly. Unfortunately – because of its popularity – it is also vulnerable to attacks (aka “hacking”).

Here are a few standard tips and recommendations to keep your WordPress website design safe and secure.

  1. Invest in Secure Hosting.

    Find a managed WordPress hosting service that isolates server accounts from each other and provides firewalls. While managed hosting costs more than shared hosting, benefits include enhanced security, faster speeds, automatic updates, and comprehensive support.  In other words…stay away from GoDaddy!

  1. Disable User Registration or Use Captcha to Deter Spambots.

    Enabling user registration makes your site a target for spambots and hackers. Disabling this feature adds another layer of security to your WordPress website.  It’s also recommended to disable comments on your website.  Don’t know how?  Use a plugin, such as Disable Comments.  If your website requires user registration or if you have any sign-up forms on your website, make sure to protect them with Captcha or verification codes to prevent spambot attacks. An example of a plugin for this is Captcha by BestWebSoft.

  1. Create a Unique Admin Username.

    Get creative. Avoid obvious usernames like “admin” at all costs – unless you like the idea of having your site hijacked by hackers.

  1. Don’t Use “Password” as Your Password.

    For the same reasons you don’t use “admin” as your username. A strong password should include numbers, letters, and symbols. Can’t think of a secure password?  You can always install a secure password generator plugin, such as WP Password Generator.

  1. Install a WordPress Security Plugin.

    Installing a high-quality, free security plugin like All-in-One Security & Firewall can literally save you thousands of dollars. Because repairing a hacked website is not cheap. Prevention is key!

  1. Third-Party Plugins. Choose wisely & always update.

    Third-Party plugins for WordPress are a great way to save upfront custom development cost. In short, it’s code that a third-party developer has made to work on the WordPress CMS with a click of a button.  What you have to be careful of, is the security risk.  Before installing a plugin on a website, you should always do your research.  For starters, make sure that it is compatible with the latest WordPress version and that the “Last Updated” info is recent (within 3 months is OK). A plugin that does not get updated is vulnerable to an attack. Also, read some reviews about the plugin and the developers themselves.  After selecting the right plugin…you must remember to update it as often s they release the updates for it.  Speaking of updates…

  1. Update Your WordPress Software.

    WordPress is always updating their CMS software to provide an enhanced usability experience, but more importantly, for security reasons.  Keeping up to date with the latest version of WordPress is always recommended.  If you have ever logged into your WordPress admin area, you will notice an “Update Now” button.  As tempting as it is to simply click this to update your WordPress CMS on your own, please consider the proper steps that WordPress recommends when updating.WordPress Update Process
    This doesn’t look as easy as you thought it was going to be, does it?  Don’t worry…that’s where we come in.  Our experienced developers and webmasters do this sort of thing everyday.  And remember…don’t just click that shiny “Update Now” button.

  1. Enhanced Security.

    While we know the preventative steps it takes to secure the fort…sometimes it takes a little extra.  If your security precautions were penetrated and you need malware removed from your website, we highly recommend companies like Sucuri & SiteLock.  The benefits of these two options vary, depending on the kind of hosting server that you are on.  Contact us to find out which works best for you.



, ,