{"id":262,"date":"2021-03-24T21:58:50","date_gmt":"2021-03-24T21:58:50","guid":{"rendered":"https:\/\/hoganhost.com.ng\/blog\/?p=262"},"modified":"2024-08-12T13:34:58","modified_gmt":"2024-08-12T12:34:58","slug":"how-to-secure-wordpress-website-easy-guide","status":"publish","type":"post","link":"https:\/\/hoganhost.com.ng\/blog\/wordpress\/how-to-secure-wordpress-website-easy-guide\/","title":{"rendered":"How to secure WordPress website [Easy guide]"},"content":{"rendered":"

Introduction<\/span><\/h2>\n

WordPress is a content management system(CMS) that can be used to your website or blog.
\nIts widely used to create websites and blogs and it can be modified to fit your needs to create a business website, portfolio website, shopping website, blog, etc.<\/p>\n

It is very easy to create a website in WordPress and\u00a0over 35% of websites<\/strong>\u00a0on the internet are built on WordPress.<\/p>\n

Once you have made a website on WordPress, it is very important to secure your website from hackers.<\/em><\/p>\n

Points\u00a0 to remember before starting using WordPress<\/strong><\/span><\/h2>\n

Before we start to securing a WordPress website, we first need to fulfill the\u00a0pre-requirement<\/em>\u00a0for keeping our base for the website secure.<\/p>\n

Choosing a Secure hosting<\/strong><\/em><\/span><\/h3>\n

Web hosting plays an important role in keeping your website secure. It is important to choose a hosting provider who provides a secure hosting environment for your website.<\/p>\n

Use the latest PHP version<\/strong><\/em><\/span><\/h3>\n

Using an outdated PHP version is a risk factor for Webserver(hosting). Having outdated software at the server level can also be a reason for your website getting hacked.
\nAt the time of writing this tutorial, PHP 7.4 is the latest PHP version.
\nPHP version 7.3 or 7.4 should be used to run your website. We recommend that you at least using PHP 7.3 to run your website which is also secure to use.<\/p>\n

Points\u00a0 to remember when installing WordPress<\/strong><\/span><\/h2>\n

Before you start installing WordPress, below the important points to be followed.<\/p>\n

Change Table Prefix<\/strong><\/em><\/span><\/h3>\n

Using default\u00a0wp_<\/strong>\u00a0table prefix is considered as a security risk. Always change the default table prefix to random for example,\u00a0website_\u00a0<\/strong>when installing WordPress.\"\"<\/p>\n

Use Unique username and strong password<\/strong><\/em><\/span><\/h3>\n

We recommend not to use that you do not use the common usernames \u2018Administrator\u2019 user such as\u00a0admin, administrator, adm, admin1, hostname, manager, qwerty, root, support, sysadmin, test, user<\/em>, etc.
\nAlso, always use a\u00a0strong password<\/strong>\u00a0which is not easy to guess. Avoid using easy passwords such as\u00a0admin, 123456, 666666,111111, 12345678, qwerty,\u00a0<\/em>etc.
\nOther common passwords include using phone number, Date of Birth, etc.<\/p>\n

Securing WordPress site from hackers<\/strong><\/span><\/h2>\n

It might seem hard to secure WordPress website from hackers but it\u2019s easy as 1,2,3.. if you follow the guide properly.
\nWordPress websites will be secure if these points are kept in mind.<\/p>\n

Keep WordPress CMS updated<\/strong><\/em><\/span><\/h3>\n

Keeping the WordPress version updated is the \u2018core\u2019 to keep your website secure. The updated version may have vulnerability fixes and other security bug fixes to keep your website up and running.
\nOlder version of WordPress may have 0-day or anything vulnerability that might have got fixed in the latest version, hence keeping WordPress CMS updated is the \u2018core\u2019 to secure full website.\"\"<\/p>\n

Keep Plugins and theme updated<\/strong><\/em><\/span><\/h3>\n

Once you are using updated WordPress CMS, it is now important to keep the extra things on your websites such as theme and plugins.
\nAlways keep your theme and plugins updated on your WordPress website.\"\"<\/p>\n

Do not use nulled\/cracked version of theme\/plugin<\/strong><\/em><\/span><\/h3>\n

Always use theme\/plugin downloaded from \u2018their\u2019 official website. Using theme\/plugin downloaded from websites providing paid theme\/plugin for free may harm your website.
\nAvoid using anything which is named as \u2018nulled\u2019.<\/p>\n

A possibility is, it may contain a virus, malware, trojan, backdoor, etc which can be used by the hacker to damage\/hack your website.
\nNulled\/cracked things are free but they may harm your website later(99% chances).
\nBelow is an example of websites providing \u2018nulled themes\/plugins\u2019<\/em>\"\"<\/p>\n

Change default wp-login page<\/strong><\/em><\/span><\/h3>\n

Using the default WordPress login link is like you are providing theft the door to your home(website).
\nHacker is just one step away from gaining access to your website if you have used a\u00a0weak username and password.
\n<\/strong>You can do it by simply installing\u00a0WPS Hide Login<\/a>\u00a0plugin.
\nNote:<\/strong>\u00a0If you have an e-commerce or a website where your customer login into your website, you should skip this step<\/p>\n

\"\"<\/p>\n

Add limit on login attempts<\/strong><\/em><\/span><\/h3>\n

A hacker when trying brute-force attack to hack into your website, he attempts a lot of passwords and username combination to find the correct one.
\nThis results in getting hacked when you have used an easy username and password.
\nAlso when brute-force attack is carried on login page, a lot of hosting resources are used resulting in slow website or full website down.<\/p>\n

Adding a limit to the login page removes the chances of a brute-force attack.
\nIt can be simply done by installing\u00a0Limit Login Attempts Reloaded<\/a>\u00a0plugin.<\/p>\n

\"\"<\/p>\n

Disable xmlrpc<\/em><\/strong><\/span><\/h3>\n

WordPress\u00a0xmlrpc.php<\/strong>\u00a0can also be used to carry out\u00a0brute-force attacks<\/em>\u00a0resulting in the same issues such as the WordPress login page mentioned above.
\nWe recommend disabling it if you want to keep your WordPress website secure from a brute-force attack.
\nWarning:<\/strong>\u00a0This should not create any issues if you are running a simple WordPress website without any \u2018automation\u2019.
\nIf you use remote software to post on your WordPress website, it will stop it.<\/p>\n

To disable XML-RPC, add the below code in your\u00a0.htaccess<\/em><\/strong>\u00a0file located normally under\u00a0public_html<\/strong><\/p>\n

<Files xmlrpc.php>\r\norder deny,allow\r\ndeny from all\r\n<\/Files><\/pre>\n
<\/h3>\n
Enable Two-Factor Authentication<\/strong><\/em><\/span><\/h3>\n
Last but not least, enable Two Factor Authentication in your website.
\nEnabling this will add one more security layer to your website.
\nWe highly recommend enabling Two-factor authentication
\nYou can install\u00a0Google Authenticator<\/a>\u00a0plugin<\/p>\n
 <\/p>\n
Conclusion<\/strong><\/span><\/h2>\n
Once you have followed all the above mention points carefully, your \u2018core\u2019 website is secure from hacking.
\nIt simply means that chances of getting your website hacked due to \u2018vulnerabilities\u2019 are fixed.
\nAlso, strongly recommend updating the theme\/plugin on a daily basis but do not forget to take a backup first.
\n