Security Hardening Practices For WordPress

Install a WordPress firewall and security plugin

A WordPress security & firewall plugin is like your site's bouncer, keeping an eye out for dodgy characters and hacking attempts. By filtering out malicious traffic and stopping brute force attacks, SQL injections & scanning for malware a WordPress firewall helps your online business stays safe and sound. So, it's a no-brainer, really – you should have a solid firewall like Wordfence or Sucuri protecting you while you focus on growing your business and livin' the dream!

Apply WordPress hardening techniques

Out of the box, WordPress comes with some features and settings that allow for customisation but can be adjusted to harden the security of your website. Things such as disabling XML-RPC, protecting the wp-config & wp-includes files, setting file permission and disabling plugin edits will cover some of the holes in your website's armour.

Implement anti-spam measures

No-one likes spam! And while mostly harmless, just bloody annoying, they’ll clog your database and muddy up your marketing analytics if you don’t block the spam-bots. You should disable blog commenting (who comments on business blogs these days?). For your user sign-ups & forms there are 3 options to try out and find which works best for you: ReCaptcha is strong but slows your site, Honeypot is invisible but not as strong, Cleantalk has no impact on users but can be too strong, sometimes blocking legitimate users.

Use supported and secure WordPress plugins and themes

As time goes by, some WordPress plugins and themes can become unsupported when their developers hit the road for new adventures, leaving 'em exposed to security risks and compatibility hiccups. To keep your site secure, choose plugins from the WordPress repo, and always double-check if your themes and plugins are getting regular updates and support.

Use strong, unique passwords

Using strong passwords is important to keep your site secure and prevent unauthorised access. A strong password should be long, unique, and contain a mix of characters. Avoid using common words or phrases, personal information, or easily guessable patterns.

It’s best to use a different password for each user and force them to regularly change their passwords. Use a password manager to store passwords so you don’t have to remember them and if you need to share them, use a one-time link service such as https://securedlink.co/

Manage Admin roles and Users

Over time you are probably going to add users to your website, especially if you are working with different contractors, agencies or staff to grow your business. You probably have a couple on your site now that don’t need to be there. Only give ‘author’ access to people adjusting content, they don’t need ‘admin’ access. And remove admin users when they no longer need access. Don’t share your main logins, it’s best to create a user for each person or team using your site. But every now and again, check and remove the unnecessary admin users.

Block brute-force attacks

Brute force attacks are when hackers use automated tools to bombard your site with heaps of username and password guesses. The easiest way to block these attacks is to limit login attempts (assuming you are already using secure passwords). This can usually be activated in your security plugin.

Change the default login address

By default, WordPress uses a predictable URL (like /wp-admin or /wp-login.php), making it easy for hackers to find and target your login page. By changing the address to something unique, you throw them off the trail, making it harder for them to locate and launch brute-force attacks. This simple tweak can boost your site's security and dodge the bulk of the bots.

Enable two-factor authentication (2FA)

You're probably familiar with 2FA, a code sent to your phone or from an authenticator app. It can be a pain in the arse, but it's a solid security measure! If you're not logging into your site too often, give it a go. But if your customers or members login to your site, the bad user experience may put them off. And if you or your team need to get in regularly, having all the other security measures sorted should be enough without the added hassle of 2FA.

Choose a secure hosting provider

It's true, you get what you pay for! Cheap hosting options can be stingy on security. Give cPanel shared hosting a miss, and go for modern cloud hosting providers that offer updated PHP, regular backups, and top-notch support. Keep your hosting account logins safe with long passwords, and be careful who you share 'em with.

Install SSL certificates

SSL certificates encrypt the data transferred between your site and web browsers. An SSL certificate allows you to use HTTPS for the addresses of your pages and for all the elements loading on the page. If you don’t do this, most browsers will mark your page as insecure. This is not a great look and it can hurt your Google rankings.

Implement security headers

Security headers inform browsers about the content of your webpage protecting against nasty attacks like cross-site scripting & clickjacking. This is more about protecting users from anything that might spread from your website. This mostly protects your reputation and Google prefers sending people to sites with these measures in place.

Use Cloudflare DNS to block bots and DDoS attacks

Cloudflare can block bots and DDoS attacks before they even get to your website or server. It’s much better to have this external layer of protection. Cloudflare handles about 20% of the traffic on the internet so they are great at spotting threats. And it makes managing DNS easier and improves your website speed!

Update WordPress themes and plugins

Like your computer and your phone, updating your WordPress themes and plugins is absolutely essential for security. Hackers constantly find ways to get through existing security and exploit vulnerabilities, so the software needs to be regularly updated to block these attacks.

Updates also improve site speed, fix bugs, and ensure compatibility with the latest WordPress updates and other plugins.

Ensure PHP version is up to date

PHP is the engine that powers your WordPress site, running everything from its core to themes and plugins. Keeping PHP up to date is crucial for your site's security and performance. It can improve site speed and fix bugs, but most importantly, it can protect your site against known security vulnerabilities and keep nasty hackers at bay. So, update your PHP regularly to keep your online business safe and thriving!

Regularly scan for malware

Regular malware scans are like routine check-ups for your website, catching potential problems before they blow up. Malware can sneak in through various ways – dodgy plugins, iffy themes, or even a hacker's crafty work. No security measures are 100% effective. By scanning regularly, you can detect and remove malware before it wreaks havoc on your online business, steals sensitive data, or harms your users.

Maintain layers of regular backups

Backups are crucial for when things go pear-shaped, like malware infections, dodgy plugin updates, or good old human error. We use 'incremental backups,' which only save changes as they happen, using fewer resources and offering more rollback options. But, since it's better to be safe than sorry, we add a second layer of backups, just in case the first one fails. And we even use a third layer, with each backup type stored in separate locations.

Keep Change History Logs

Change History logs track all changes made by users, plugins, and themes, helping you pinpoint when and where issues crop up. With this info, you can quickly identify any dodgy activity, resolve conflicts, and even roll back to a previous state if needed. So, change history logs not only keep your site safe but also save you heaps of time troubleshooting, helpful if you have multiple people working on a site.. Some security plugins include it, or the free Simple History plugin is a great solution.

Have access to an infection cleanup team

When malware strikes, who ya gonna call? No security system is ever 100% effective. Be wary of anyone who says they are. So as well as implementing everything you can to avoid infection. Make sure you have access to a cleanup team like TunedWP who can swoop in and fix your site quickly if things go wrong.

Regularly monitor and audit your website

Website security is no a one-time activity, it is an ongoing process. Your website should be monitored on a regular basis to catch unusual activity as early as possible. And probably once a year at least you should review your security settings, reset passwords and make sure everything is up to date with best practice. If you haven’t for a while, now might be a good time to do a security review.

Maintain control of your domain name & DNS

Your domain name and DNS controls your website and emails. You should never give up full control over your domain name to a third party. Keep it in your own account at a domain registrar. It is common for DNS records (which tell the internet where your emails and website are hosted) to be set to the domain registrar. But this poses a security risk if you need to give DNS access to a service provider. I recommend moving your DNS hosting to a Cloudflare account that you own and simply providing access to that. It is much less risky to give access just to your DNS because you still ultimately control the domain and can easily setup new DNS hosting elsewhere if that account is compromised.

Maintain access to your online assets

While I don’t believe that as a business owner, your should be logging into your website to fiddle round with it, I firmly believe that you should be able to if you need to. And you should be able to easily hand over access to your website to a different service provider for them to take over. Avoid unique, custom themes or proprietary CMSs controlled by a provider that other developers won’t be able to easily take over. Use a child theme of a solid and reputable theme framework, so the parent framework can be updated to stay secure without altering the customisations in the child theme. Go for popular page builders and editors rather than ‘hard-coded’ changes.

Build Online Assets

While social media is a fantastic way to engage with your audience. You do not own or hold ultimate control over anything you do on these platforms. These platforms can change, disappear or ban you on very short notice. As per James Schamko’s ‘Own The Race Course’ method, you should have content assets and a business website that you have full ownership and control over. Then use social channels to bring people to your platform. This gives you a valuable and saleable business asset when you exit the business.

Leverage a support team to super-charge your asset building

The biggest thing that can hold back a lot of entrepreneurs is being ‘on the tools’; getting caught up in the ‘technician’ work. You need to free yourself up from those activities so that you can focus on the higher-value activities where you add the most value to your business. So make the most of service providers like a website support team who can take care of the implementation of your ideas and publish your content for you.