{"id":13591,"date":"2014-12-16T22:37:15","date_gmt":"2014-12-16T15:37:15","guid":{"rendered":"http:\/\/tom.ji42.com\/?p=13591"},"modified":"2020-11-05T13:46:02","modified_gmt":"2020-11-05T06:46:02","slug":"protect-and-secure-wordpress-site-from-hackers-2","status":"publish","type":"post","link":"https:\/\/tom.tomwork.net\/?p=13591","title":{"rendered":"Protect and secure WordPress site from Hackers"},"content":{"rendered":"

WordPress is among the most popular blogging platforms being used. And because it is so popular it becomes a common target for hackers. Fortunately, it supports a wide ecosystem of free plugins and services that can help you enhance the security of your WordPress blog. We have already seen how to keep websites secure<\/a> and deal with threats and vulnerabilities in general. In this post we will see how to harden security so as to protect and secure your self-hosted WordPress site.<\/p>\n

Secure WordPress site<\/h2>\n

<\/p>\n

1]\u00a0 Make sure your Windows computer<\/strong> is free of malware. No amount of security in WordPress or on your web server will make any difference if there is an illegal keylogger installed on your computer.<\/p>\n

2] Always make sure that you have the latest version<\/strong> of WordPress and your Plugins installed. Your web server can have vulnerabilities too. Therefore, make sure that your Web Host<\/strong> is running latest, secure, stable versions of server software on it. Better still, make sure you are using a trusted host that takes care of these things for you.<\/p>\n

3] Use a strong username<\/strong> and a strong passwords<\/strong>. Best to go for mixed complex passwords using upper, lower case alphabets, numerals and special characters of length exceeding 15 characters. Enforce usage of strong passwords for all your Authors too.<\/p>\n

4] Change the Administrator username<\/strong> of your WordPress installation from the default admin<\/em> to something strong and unrelated to your own or sites name. You can create another administrator account, login as new administrator user and delete the old default admin username account. Or you could use Admin username changer<\/strong> or Admin renamer<\/span>extended<\/span><\/strong> plugin or one of the security plugins mentioned below to rename the default admin username.<\/span><\/p>\n

5] Use a Captcha for login purposes.<\/p>\n

The Captcha plugin from BWS<\/strong> is a good one you may want to have a look at. It lets you choose the operations and the complexity levels.<\/p>\n

6] The Limit Login Attempts<\/strong> plugin will limit the rate of login attempts, by way of cookies, for each IP. It will allow only the configured number of attempts after which the user will get locked out. You can configure all its settings like number of attempts allowed, lock out period, allowed re-tries and so on. This plugin is useful in preventing brute force attacks.<\/p>\n

If a user uses and incorrect username or password, he or she will see this message.<\/p>\n

7] Change the WordPress Panel login URL<\/strong> from default \/wp-admin\/<\/em> to something else using Rename wp-login<\/strong>plugin.\u00a0 This plugin is useful in preventing brute force attacks too.<\/p>\n

 <\/p>\n

8] Use a Security Scanner plugin<\/strong> to scan your WordPress installation files periodically. The Sucuri Security \u2013 SiteCheck Malware Scanner<\/strong> plugin enables you to scan your WordPress site using Sucuri<\/span> SiteCheck right in your WordPress dashboard. It checks for malware, spam, blacklisting, .htaccess redirects, hidden <\/span>eval<\/span> code, and other security issues.<\/span><\/p>\n

Furthermore, it verifies if WordPress and PHP is up-to-date and hides the WordPress version from public etc, if your site is protected by a Web Firewall. It also protects your Uploads Directory, restricts wp-content and wp-includes access by hardening file permissions and checks for the integrity of your core WordPress files. It monitors a large number of actions, including, Login attempts, Failed Logins, File Changes and so on.<\/p>\n

<\/div>\n

Sucuri also checks if your site has been black-listed anywhere like Google Safe Browsing, Norton Safe Web, Phish Tank, SiteAdvisor, Eset, Yandex, etc and informs you about it.<\/p>\n

Remember to back up your database or full site before making any notable changes to your WordPress installation as some of these 1-click fixes could potentially break some functionality of your site. So please be careful here.<\/em><\/p>\n

8] Use <\/span>Cloudlare<\/span><\/span><\/strong> free content delivery network to filter all your traffic and minimizes the risk of your WordPress website from becoming a target, as it acts as a proxy between your visitors and the server your website is hosted on.<\/span> Cloudflare basic is free, but if you pay a nominal amount, you can also avail of its <\/span>Web Application Firewall<\/strong> service. It\u00a0stops real-time attacks like SQL injection, cross-site scripting, comment spam and other abuse at the network edge. Sucuri<\/strong> offers a great firewall, but it is not free.<\/p>\n

9] Minimize the number of plugins<\/strong> you use. Deactivate or even better, delete the ones you don\u2019t use.<\/p>\n

10] Keep creating backups<\/strong> of your site at regular intervals, and upload them to some Cloud service and\/or to your desktop. BackWPUp<\/strong>, VaultPress<\/strong>, BackupBuddy<\/strong>, DropBox for WordPress,<\/strong> BackUpWordPress<\/strong> are among the good Backup plugins you may want to check out.<\/p>\n

While this may be enough for most WordPress sites, if you need to go further, you could read this post on WordPress<\/a>. You might want to also read about Badware and Badware websites<\/a>.<\/p>\n

Some of you might want to check out my post on Useful tips for new bloggers<\/a><\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"

WordPress is among the most popular blogging platforms being used. And because it is so popular it becomes a common target for hackers. Fortunately, it supports a wide ecosystem of free plugins and services that can help you enhance the security of your WordPress blog. We have already seen how to keep websites secure and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[13],"tags":[],"class_list":["post-13591","post","type-post","status-publish","format-standard","hentry","category-13"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p6cOVM-3xd","_links":{"self":[{"href":"https:\/\/tom.tomwork.net\/index.php?rest_route=\/wp\/v2\/posts\/13591","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tom.tomwork.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tom.tomwork.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tom.tomwork.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tom.tomwork.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13591"}],"version-history":[{"count":11,"href":"https:\/\/tom.tomwork.net\/index.php?rest_route=\/wp\/v2\/posts\/13591\/revisions"}],"predecessor-version":[{"id":24781,"href":"https:\/\/tom.tomwork.net\/index.php?rest_route=\/wp\/v2\/posts\/13591\/revisions\/24781"}],"wp:attachment":[{"href":"https:\/\/tom.tomwork.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13591"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tom.tomwork.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13591"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tom.tomwork.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13591"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Apart from <\/span>Sucuri<\/span><\/span>, <\/span>Secure WordPress<\/span><\/strong> plugin, <\/span>Exploit Scanner<\/span><\/strong>, <\/span>WordFence Security<\/span><\/strong>, <\/span>WordPress Sentinel<\/span><\/strong>, <\/span>Quttera<\/span><\/span><\/strong><\/a>, <\/span>VIP Scanner<\/span><\/strong>, <\/span>iThemes<\/span><\/span> Security<\/span><\/strong> (formerly Better WP Security),\u00a0<\/span>BulletProof Security<\/span><\/strong> and <\/span>All In One WP Security & Firewall<\/span><\/strong>are among the other good scanners and security plugins you may want to have a look at.<\/span> Most of these plugins, apart from scanning your site for malware, will also help you Harden File Permissions, delete ReadMe files, hide WordPress version, and more.<\/span><\/p>\n