Introduction
WordPress is a content management system(CMS) that can be used to your website or blog.
Its widely used to create websites and blogs and it can be modified to fit your needs to create a business website, portfolio website, shopping website, blog, etc.
It is very easy to create a website in WordPress and over 35% of websites on the internet are built on WordPress.
Once you have made a website on WordPress, it is very important to secure your website from hackers.
Points to remember before starting using WordPress
Before we start to securing a WordPress website, we first need to fulfill the pre-requirement for keeping our base for the website secure.
Choosing a Secure hosting
Web hosting plays an important role in keeping your website secure. It is important to choose a hosting provider who provides a secure hosting environment for your website.
Use the latest PHP version
Using an outdated PHP version is a risk factor for Webserver(hosting). Having outdated software at the server level can also be a reason for your website getting hacked.
At the time of writing this tutorial, PHP 7.4 is the latest PHP version.
PHP version 7.3 or 7.4 should be used to run your website. We recommend that you at least using PHP 7.3 to run your website which is also secure to use.
Points to remember when installing WordPress
Before you start installing WordPress, below the important points to be followed.
Change Table Prefix
Using default wp_ table prefix is considered as a security risk. Always change the default table prefix to random for example, website_ when installing WordPress.
Use Unique username and strong password
We recommend not to use that you do not use the common usernames ‘Administrator’ user such as admin, administrator, adm, admin1, hostname, manager, qwerty, root, support, sysadmin, test, user, etc.
Also, always use a strong password which is not easy to guess. Avoid using easy passwords such as admin, 123456, 666666,111111, 12345678, qwerty, etc.
Other common passwords include using phone number, Date of Birth, etc.
Securing WordPress site from hackers
It might seem hard to secure WordPress website from hackers but it’s easy as 1,2,3.. if you follow the guide properly.
WordPress websites will be secure if these points are kept in mind.
Keep WordPress CMS updated
Keeping the WordPress version updated is the ‘core’ to keep your website secure. The updated version may have vulnerability fixes and other security bug fixes to keep your website up and running.
Older version of WordPress may have 0-day or anything vulnerability that might have got fixed in the latest version, hence keeping WordPress CMS updated is the ‘core’ to secure full website.
Keep Plugins and theme updated
Once you are using updated WordPress CMS, it is now important to keep the extra things on your websites such as theme and plugins.
Always keep your theme and plugins updated on your WordPress website.
Do not use nulled/cracked version of theme/plugin
Always use theme/plugin downloaded from ‘their’ official website. Using theme/plugin downloaded from websites providing paid theme/plugin for free may harm your website.
Avoid using anything which is named as ‘nulled’.
A possibility is, it may contain a virus, malware, trojan, backdoor, etc which can be used by the hacker to damage/hack your website.
Nulled/cracked things are free but they may harm your website later(99% chances).
Below is an example of websites providing ‘nulled themes/plugins’
Change default wp-login page
Using the default WordPress login link is like you are providing theft the door to your home(website).
Hacker is just one step away from gaining access to your website if you have used a weak username and password.
You can do it by simply installing WPS Hide Login plugin.
Note: If you have an e-commerce or a website where your customer login into your website, you should skip this step
Add limit on login attempts
A hacker when trying brute-force attack to hack into your website, he attempts a lot of passwords and username combination to find the correct one.
This results in getting hacked when you have used an easy username and password.
Also when brute-force attack is carried on login page, a lot of hosting resources are used resulting in slow website or full website down.
Adding a limit to the login page removes the chances of a brute-force attack.
It can be simply done by installing Limit Login Attempts Reloaded plugin.
Disable xmlrpc
WordPress xmlrpc.php can also be used to carry out brute-force attacks resulting in the same issues such as the WordPress login page mentioned above.
We recommend disabling it if you want to keep your WordPress website secure from a brute-force attack.
Warning: This should not create any issues if you are running a simple WordPress website without any ‘automation’.
If you use remote software to post on your WordPress website, it will stop it.
To disable XML-RPC, add the below code in your .htaccess file located normally under public_html
<Files xmlrpc.php> order deny,allow deny from all </Files>
Enable Two-Factor Authentication
Last but not least, enable Two Factor Authentication in your website.
Enabling this will add one more security layer to your website.
We highly recommend enabling Two-factor authentication
You can install Google Authenticator plugin
Conclusion
Once you have followed all the above mention points carefully, your ‘core’ website is secure from hacking.
It simply means that chances of getting your website hacked due to ‘vulnerabilities’ are fixed.
Also, strongly recommend updating the theme/plugin on a daily basis but do not forget to take a backup first.
