How to secure WordPress website [Easy guide]

Introduction

WordPress is a content management system(CMS) that can be used to your website or blog.
Its widely used to create websites and blogs and it can be modified to fit your needs to create a business website, portfolio website, shopping website, blog, etc.
It is very easy to create a website in WordPress and over 35% of websites on the internet are built on WordPress.

Once you have made a website on WordPress, it is very important to secure your website from hackers.

Points  to remember before starting using WordPress

Before we start to securing a WordPress website, we first need to fulfill the pre-requirement for keeping our base for the website secure.

Choosing a Secure hosting

Web hosting plays an important role in keeping your website secure. It is important to choose a hosting provider who provides a secure hosting environment for your website.

Use the latest PHP version

Using an outdated PHP version is a risk factor for Webserver(hosting). Having outdated software at the server level can also be a reason for your website getting hacked.
At the time of writing this tutorial, PHP 8.1 is the latest PHP version.
PHP version 8.1 should be used to run your website. We recommend that you at least using PHP 8.0 to run your website which is also secure to use.

Points  to remember when installing WordPress

Before you start installing WordPress, below the important points to be followed.

Change Table Prefix

Using default wp_ table prefix is considered as a security risk. Always change the default table prefix to random for example, website_ when installing WordPress.

Use Unique username and strong password

We recommend not to use that you do not use the common usernames ‘Administrator’ user such as admin, administrator, adm, admin1, hostname, manager, qwerty, root, support, sysadmin, test, user, etc.
Also, always use a strong password which is not easy to guess. Avoid using easy passwords such as admin, 123456, 666666,111111, 12345678, qwerty, etc.
Other common passwords include using phone number, Date of Birth, etc.

Securing WordPress site from hackers

It might seem hard to secure WordPress website from hackers but it’s easy as 1,2,3.. if you follow the guide properly.
WordPress websites will be secure if these points are kept in mind.

Keep WordPress CMS updated

Keeping the WordPress version updated is the ‘core’ to keep your website secure. The updated version may have vulnerability fixes and other security bug fixes to keep your website up and running.
Older version of WordPress may have 0-day or anything vulnerability that might have got fixed in the latest version, hence keeping WordPress CMS updated is the ‘core’ to secure full website.

Keep Plugins and theme updated

Once you are using updated WordPress CMS, it is now important to keep the extra things on your websites such as theme and plugins.
Always keep your theme and plugins updated on your WordPress website.

Do not use nulled/cracked version of theme/plugin

Always use theme/plugin downloaded from ‘their’ official website. Using theme/plugin downloaded from websites providing paid theme/plugin for free may harm your website.
Avoid using anything which is named as ‘nulled’.

A possibility is, it may contain a virus, malware, trojan, backdoor, etc which can be used by the hacker to damage/hack your website.
Nulled/cracked things are free but they may harm your website later(99% chances).
Below is an example of websites providing ‘nulled themes/plugins’

Change default wp-login page

Using the default WordPress login link is like you are providing theft the door to your home(website).
Hacker is just one step away from gaining access to your website if you have used a weak username and password.
You can do it by simply installing WPS Hide Login plugin.
Note: If you have an e-commerce or a website where your customer login into your website, you should skip this step

Add limit on login attempts

A hacker when trying brute-force attack to hack into your website, he attempts a lot of passwords and username combination to find the correct one.
This results in getting hacked when you have used an easy username and password.
Also when brute-force attack is carried on login page, a lot of hosting resources are used resulting in slow website or full website down.

Adding a limit to the login page removes the chances of a brute-force attack.
It can be simply done by installing Limit Login Attempts Reloaded plugin.

 

Disable xmlrpc

WordPress xmlrpc.php can also be used to carry out brute-force attacks resulting in the same issues such as the WordPress login page mentioned above.
We recommend disabling it if you want to keep your WordPress website secure from a brute-force attack.
Warning: This should not create any issues if you are running a simple WordPress website without any ‘automation’.
If you use remote software to post on your WordPress website, it will stop it.

To disable XML-RPC, add the below code in your .htaccess file located normally under public_html

#XMLRPC protection by HostatHash
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

Enable Two-Factor Authentication

Last but not least, enable Two Factor Authentication in your website.
Enabling this will add one more security layer to your website.
We highly recommend enabling Two-factor authentication
You can install Google Authenticator plugin

 

Disable File editing and plugin add/update option in WordPress

Add the below code in your wp-config.php file just above the line “/* That’s all, stop editing! Happy publishing. */”

define( 'DISALLOW_FILE_EDIT', true ); /** Blocks edit plugin and theme code in WP Dashboard */define( 'DISALLOW_FILE_MODS', true ); /** Blocks add/update theme and plugin in WP Dashboard */

 

Conclusion

Once you have followed all the above mention points carefully, your ‘core’ website is secure from hacking.
It simply means that chances of getting your website hacked due to ‘vulnerabilities’ are fixed.
Also, strongly recommend updating the theme/plugin on a daily basis but do not forget to take a backup first.