Unlike other CMS systems like Shopify, WordPress requires you or your hosting company to largely manage your own security. Because of this it is important more than ever to make sure that you are completely up to date on your knowledge about security on your WordPress site.


Tips and Tricks to Improving Your WordPress Site Security

What is WordPress?

WordPress is a free and open source CMS specializing in managing websites, blogs, and other related content. Today WordPress is the most popular CMS used, with over 75 m
illion active sites. However with WordPress’s popularity comes security flaws, and since WordPress is largely the biggest CMS out there, there is constantly new malware and techniques for hackers to gain access to your website.

Because of this, website security is on the forefront of every web developers mind and ensuring proper security procedures can extremely difficult. We at eCorporatteste end up spending a lot of time with security, researching it, testing it, and improving it, all to protect our website and data. In this blog we will be sharing some tips and tricks on what you can do to improve your website security.

WordPress –

Unlike other CMS systems like Shopify, WordPress requires you or your hosting company to largely manage your own security. Because of this it is important more than ever to make sure that you are completely up to date on your knowledge about security on your WordPress site to be completely safe from malicious software or hackers. In this part of the blog I’ll be explaining basic but effective ways to make your webpage a lot more secure on WordPress.

Update WordPress

Like numerous modern software packages, WordPress is constantly being updated to keep up with new security issues that may arise. Improving software security is always an ongoing concern for WordPress and they will constantly have new and improved ways to keep your websites safe. These new updates will significantly help to protect your website from malicious content, however you do need to make sure that you remember that you have the most up to date version on WordPress to get all the benefits.

Additionally since WordPress 3.7 you can enable auto updates, allowing all security updates and core updates to be done automatically as soon as they’re available.

 

Disable file editing

An additional small way that you can protect your website is by disabling the file editing on your Wo
rdPress Dashboard. By default the WordPress Dashboard allows admins to edit all kinds of PHP files. This is quite often a target for hackers since it’s a unprotected part of the website that allows code execution. However WordPress has a constant to disable editing from Dashboard. Placing define(‘DISALLOW_FILE_EDIT’, true); In the code of the php file wp.includes removes the capabilities of hackers to use these fragile tools to harm your website.  This will not prevent an attacker from uploading malicious files to your site, but might stop some attacks.

Sever – Side Passwordsdata prot

Another way to protect your website from hackers to by adding server-side password protection (such as BasicAuth) to /wp-admin/ this adds another layer of protection around your admin area, the log
in screen, and your files. This will force the attacker or bot to attack this second layer of protection instead of your actual admin files hence it will prevent or atleast significantly slow down the attack made by the hacker or the malicious software bots.

Plugins

Using Plugins to help keep your website secure is a great small way of improving your website’s security. There are tons of plugins that can act as a mini firewall for your website preventing malicious content or hackers to get onto your website. One popular example of an extremely useful security plugin is Akismet. This plugin is used by millions and is used to protect your website from spam 24/7.

However plugins can end up being a security risk for your website. If your plugins aren’t updated to keep up with current versions of WordPress they can act as a gateway for hackers to harm your website. Hence it’s extremely important to make sure your website is always fully updated. Plugins are also end up being security risk if the plugin itself is designed with dangerous intentions. Hence advised that when you are picking plugins you only use the ones that are on the official WordPress sites, and are rated 4-5 stars by a high amount of users.

Generic Security tips –

Network Security –

The network on both the host side and the client network side needs to always be trusted. Being on a a safe and secure network can range from you annually updating firewall rules on your home router and being careful about what networks you work from. An Internet cafe where you are sending passwords over an unencrypted connection, wireless or otherwise, is not a trusted network.password

Passwords –

Passwords are the first line of defence for your website. The stronger your password is, the more protected your website will be from malicious software or hackers.  If you’re having trouble creating a A strong password
you have confidence in always try to follow these tips :-

  • Atleast 8 characters (including numbers, capital letters, and possibly symbols)
  • Doesn’t contain any personal information e.g. date of birth
  • Different from other passwords you’ve created.

Data Backups

Protecting your data isn’t all about website security but it is also equally about measures you have taken to recover easily if hacked, an often ignored but crucial way to protect your data, is simply just backing it up (creating a copy). When creating a back-up it’s important that the back-up of the data isn’t in the same place and easily accessible since this can hinder the back-up useless. It’s often recommended when backing up your data you use external hardware like a USB stick.  Creating a backup like this will ensure that if your website did get hacked you would be able to easily recover.

Monitoring (http://www.jeffbullas.com/2013/01/11/5-big-reasons-to-monitor-your-website/)

Sometimes prevention is not enough and your website might still get attacked by hackers and/or malicious bots, that are why intrusion detection and monitoring is very important. Monitoring your website is crucial because finding the attack early is likely to prevent a lot of the damage that may happen to your website. Furthermore it will allow you to react faster, find out what actually happened and know the most efficient way to recover your website.

Some common monitoring checks that can be done:-

  • Ping monitor – To check the connection to your website
  • Http monitor – To check how your website is responding to requests.
  • TCP monitor – To make sure no data is loss during connection to another network device

However you don’t need to do these checks yourself and there is plenty of software out of the web, that can constantly properly monitor your website for problems. One example of this is https://www.monitorscout.com/. Also It’s worth investigating into what your hosting company can actually offer, since usually they can provide additional security for your site. An example of this is the hosting company we use, provides us with site lock which is designed to automatically detect any malware that is trying to, or has gotten into your website.