WordPress Security: 14 Steps to Secure Blog From Hackers

Do WordPress Security matters to you?

WordPress users are always on a threat of website or blog being hacked.

The reason being, WordPress is open-source software and hosted on third-party hosting services. Brute Force attacks are quite common and well known among WordPress users.

Strengthen your WordPress Blog Security hosting on powerful and secure oriented Host like Hostinger.

But, thinking of it, will you stop using WordPress?

I am sure you said no. As WordPress has immense robust features that simplify your blogging process and beautify it. So, no one can resist it. Agreed?

Every product or tool has its pros and cons, so do WordPress. There are plenty of ways how you could secure your WordPress blog from hackers.

Now, if you are not taking care of the security measures at all, sorry to say it would be your fault if the blog is being hacked.

How to secure WordPress website from hackers

Intentionally or unintentionally, maybe after creating a blog you forget to apply some security to it, resulting blog hacked.

Instead, cursing on your self later, it’s better to prevent WordPress hack now.

Makes sense?

If it does let jump into and see some awesome WordPress security tips and create a shield out there around your blog.

HEADSUP – If you think these are too many steps to secure your WordPress website or don’t wanna manage your website manually, simply Get Astra Security.

It is a full Proof solid security system that keeps away from all the DDoS attacks, malware injections, in fact, any kind of security threats and hacks.

---

1. Create a Site Backup

First things first, it is always advisable before making any changes to your website always make sure that you are taking a backup of your WordPress backup.

For doing the same there are plenty of WordPress backup plugins out there that you can make use of.

Both free ones and paid are available, few of the recommended ones are,

• BackBuddy (from Ithemes)
• UpdraftPlus
• WP-Backup

I assume you have installed one of the backup WordPress plugins and performed a backup. Now you are good to go with the next steps.

I recommend one should schedule their backups after every post is published. Or even after making any changes to the posts or the blog database.

---

2. Change Your WordPress Username

While creating a blog, you will be having an option called username, which is used to login to your blog or website.

Generally, most of the people keep it as default “admin” and forget to change later on.

Just assume how easy it could be to guess that for even by a mediocre hacker. haha! I had a smile on your face.

You have to make it a unique one, which could not be guessed at all. If you don’t know how to do that, here I have created a guide to change the WordPress username with ease.

---

3. Change the WordPress login URL

Again by default, WordPress creates a URL for your website to make a login. I hope you have already observed it. It starts some like yourdomainname/wp-admin

This goes common for any of the websites, and easily guessed by hackers too. So rename it sooner as possible and get rid of the sword hanging on your head all the time. Here is the guide to change the WordPress login URL.

---

4. Don’t Ignore Lockdown feature

Saying Lockdown means, you should set up a lockdown feature for your WordPress blog.

Why?

WordPress hacks can be done manually and through bots as well. So, in this case, you should minimize the failed attempts.

That states if someone guessed the wrong username or password, their IP will be locked down for further attempts. And that makes complete sense. Isn’t it?

You will have the full control to assign the failed attempts with the security plugin.

How many attempts should you assign? – It’s completely up to you, generally, it’s wise to keep 3 failure attempts. 2 can also make sense, but don’t make it to 1, as sometimes even you can mistype your username or password. In that scenario, you would be locked down too. haha!

Wordfence and similar many plugins have lockdown feature. And if your security plugin doesn’t have such a feature, then you can always make use of the popular plugin Login Lockdown.

---

5. WordPress Regular updates

WordPress comes up with regular updates, by adding many bug fixes. A WordPress user should upgrade it frequently, whenever it notifies.

Many frequently updated security features can secure your WordPress website.

These updates can only strengthen the WordPress security process to a further level.

---

6. Remove the WP version

As we have already talked about the WordPress updates. Now it also makes sense, that you should hide your WordPress version from hackers.

Wondering how they can see the WordPress version that you are using as you have the login credentials?

It’s easy for hackers to check the WordPress version by the source page. They just need to

right-click( on the webpage) – View Page source –  CTRL F(Search for Version). It will look something like the below tag.

<meta name=”generator” content=”WordPress 4.8.2″ />

---

7. Two-factor authentication(2FA)

Have you ever used two-factor authentication for your gmail. If you are familiar with that, you might have already guessed what I am talking about.

Two-factor authentication security is a way to protect the WordPress site from hackers with ease.

If you connect your blog to your mobile phone for two-factor authentication, you will receive an OTP while login. Putting that number in you would be able to log in.

This extends the security to a further level and adds one more layer to it. Here is a quick tutorial on WordPress Two-factor Authentication.

---

8. Start using an SSL

An SSL Certificate encrypts the data and makes the job difficult for hackers. SSL is useful in many ways.

And these days it’s quite easy to get one at a very reasonable cost from well-known brands.

It also increases the trust of the visitors to buy a product from your website by making an online transfer. Their data would be safe with an SSL, which keeps the information safe.

SSL makes sure that the transfers between the browsers and the servers are safe and secure. And there is no leak in between.

It’s wise to go with it, even if you don’t sell anything on your WordPress website as well.

Why?

Google has already mentioned SSL as a ranking factor on their official blog along with many other factors.

Furthermore, not having SSL also affects user experience. Popular security tools such as browser VPN extensions and HTTPS Everywhere software discourage their users from using unsecured websites. The two factors combined can significantly impact your traffic.

---

9. Choose the best Security plugin

Apart from adding many layers of security, it’s good to go with an awesome security plugin.

There are plenty of good security plugins in the WordPress repository, though I can list a few of the best ones.

• WordFence
• Ithemes
• All in one security

These plugins are available for free, with quite decent security features. However, you can upgrade to their pro version for more extended features.

A security plugin does a lot of blocking jobs in the backend.

It keeps the spam away and blocks the IPs throttled for accessing your WordPress blog quite frequently. Scan your website for any malicious threats.

Set a decent firewall against brute force attacks DDoS attacks and much more. So, don’t avoid installing a security plugin and protect the WordPress site from hackers.

---

10. Create Strong Passwords

You might do a lot of stuff to secure your WordPress website, but seldom do folks avoid keeping the basics right. 🙂

You do it for other social profiles and email accounts as well, creating strong passwords.

Similarly, it’s important to follow the same for your WordPress site, as WordPress sites get hacked like anything. Now it doesn’t matter what the blog size is. Hackers find interest in all. LOL!

Saying a strong password means, don’t use anything which is related to you. Avoid almost everything, Name, Birthdate, Employee ID, girlfriend name, haha anything which could be guessable.

Having trouble coming up with great ideas for your passwords? You can always take the help of some online password generator tools, I use LastPass Password Generator to create a secure password.

Alternatively, you can also use the below tools,

• Dashlane Password Generator
• Secure Password Generator

There are plenty of ways to change the WordPress login passwords. Like from your WP Dashboard or the WordPress database PhpMyAdmin as well in case no access to the WordPress dashboard.

Simple way – Quickly hop into WordPress Dashboard – Users – Your Profile and scroll a bit down to see the New Password button in the Account Management Section.

Hitting the button will give you a unique strong password and finally hit the Update profile button to save the changes.

Your WP login password has been changed, hoping you have copied that new password with you, or else we need to reset the password from the database.

---

11. Change the Database Table Prefix

While installing WordPress on your servers, you might have already observed a dialog box asking for a certain prefix to start something like wp_. That means. This is basically for your WordPress database. The folder starts with wp_.

No wonder, whatever is common, can be guessed by the so-called hackers. So it’s also advisable to change the prefix of something of your own. You can add anything mywpsite_, friendswp_, and so on.

This can easily be done by getting into your website database. But, if you are not that familiar with all the techie stuff, plugins are always there.

Quickly install WP-DB Manager, to get this job done.

---

12. Don’t use Null themes and Plugins

WordPress theme hack is quite known. Say a big no to themes, this is one thing that doesn’t need any effort to hack by the third person. You are doing it you’re self if use null themes or plugins.

Many blogs are offering some free themes and plugins as a giveaway. Installing those could be dangerous from the perspective of WordPress security.

Why?

The codes might be already injected into those to extract the data from your website.

I am not saying all the website does such things. But, it’s always wise to give a try to those plugins or themes on your demo site. Makes sense?

Try it for a while to check how legit those products are. Never install those on your WordPress website which is already live.

So be wise while installing Plugins or themes. WordPress repository offers all the checked themes and plugins. But, if you are buying it from third-party websites, do check up once.

---

13. Protect WP-config.php file

WP-config is an important part of your WordPress website. All the sensitive data gets stored over there. It can be located in the root directory public_html, where all your WordPress files are.

This is the file if accessed can expose your complete website. I am sure none of the WordPress users want that.

Trust me, if you hide this file in some other directory, it could be really head-scratching for the hacker to step into.

Note: Don’t worry even if you change the location of it, the site won’t break, check out the below steps, on how you could Change the Wp-Config location.

How to protect WP-config.php file

There are a few ways to do so via .hta access and through your file manager as well.

The most easier way would be through the file manager, assessing the root directory public_html.

Find your WP-config file there and move it to the up level. That’s it. Now, it won’t be accessible at all. Your WP-Config file is secure now.

---

14. Disable Directory browsing via .htaccess

This is another, step which a webmaster looks into. Which is not well known when it comes to securing the website.

But if the browsing of your root directory is not disabled. A reader, visitor, or hacker can access files like themes, plugins, images, and much more.

Here is the step-by-step guide on how you can disable directory browsing in WordPress via .htaccess.

---

Final Words on Securing your WordPress Blog

An approach towards Securing your WordPress blog might take some time, but once and all.

And it’s worth it. Before spreading the news on social media “my website got hacked.” It’s wise to take care of some security measures, as your hard work on your blog matters.

And make sure you have given a great shed for your blog to live.

As per experience, I found Hostinger host to be one of the best in terms of powerful and optimized performance and security.

You Turn, Are you ready to prevent website hacking?

Consider sharing, if this helps. Thanks!