10+ WordPress Security Tips to Protect Your Websites

Your website’s security has a lot to do with the loopholes and weak spots in your website. As a matter of fact, if your theme or plugin or any function does not respond properly, it will naturally generate an error message. These error messages may help you solve the problem but for hackers, these are some of the entry points to get access to your website. 

These messages contain the server path, that’s what all hackers are always on the lookout for. Therefore, it is always suggested to disable this error message. This can be done by adding a code in the wp-config.php file. Simply copy and paste this code anywhere in your wp-config file. 

error_reporting(0);
@ini_set(‘display_errors’, 0);

3. Disable Dashboard File Editing

By default, WordPress comes with an option to edit your theme and plugin files right from your dashboard i.e. appearance -> editor. In case, a hacker gains access to your site, he/she can easily make changes in the code and execute anything he/she wants.
Therefore, it is always a bright idea to disable file editing option from your dashboard by adding this code snippet to your wp-config.php file. 

define( ‘DISALLOW_FILE_EDIT’, true );

4. Regular Backups

As we discussed earlier, hacking cannot be stopped, it can only be prevented. Thus, if ever any hacker finds an entry point to your website, or hacks it completely, there is no way you can recover without having a secondary copy of your site. Regularly backing up your website offers you an option to recover your site if something goes wrong with it.

5. Always use Security Plugins 

WordPress comes packed with many security plugins that automatically backs up your website on a daily basis as well as secures it against hacking and spamming.
Some of the best plugins are: 

WordFense security plugin, BulletProof security, and Sucuri Security plugin.

6. Hide your WordPress Version

Well, you probably are wondering why? WordPress is growing and every now and then you encounter a new upgrade of WordPress version. If you run a WordPress website, you probably have heard that you should keep your website up-to-date to prevent security threats. 

If in case, you cannot update your WP version for a reason or two, you are giving an open invitation to hackers to hack your website. However, you can keep this threat at bay by hiding your current version. Reason? As the bugs of previous versions are well known to everybody on the web who uses WordPress, hackers can easily use those loopholes and get access to your website. Hiding WordPress version gives you full control over the update of the latest versions while keeping hacking threats at bay. 

There are certain ways to do so:

Using an older theme? Write this code in your theme’s header.php file

(‘version’); ?>” />

For newer themes, use this code instead

<? remove_action(‘wp_head’, ‘wp_generator’); ?>

7. Use 2-Factor Login Authentication

2-Factor login authentication, as the name suggests, is a two level of login to a service or page. WordPress provides many plugins that help you efficiently implement this 2 level login authentication to your website and make your site more secure. Clef and Rublon are two most popular WordPress plugins that help you implement this strategy. 

Clef makes use of your phone camera to set up the login authentication. However, Rublon uses emails for two-factor authentication. 

You may also like to explore more two-factor authentication plugins for WordPress.

8. Protect Your Files: Htaccess

If you have been running a WordPress website for quite some time, you probably are familiar with the .htaccess file. Well, as a matter of fact, it is one of the most important files of your website. .htaccess file directly affects the permalinks of a website and how it deals with the security issues. .htaccess file can help you prevent your site against any hacking by allowing you to add various code snippets in it. However, make sure whatever code you add in the file should be outside #BEGIN WordPress and #END WordPress tags.
First of all, you should hide your wp-config.php file completely since it is responsible for everything on your website and includes plenty of important details such as database details, user details and more.

Add this code to hide it:

order allow, deny
from all

By adding the following code snippet into a new .htaccess file and upload it to the wp-admin, you can restrict admin access.

order deny, allow
from 192.168.5.1
deny from all

You can also restrict wp-login.php in the almost same way.
Add the following code to your .htaccess file.

order
Deny from all
# access from my IP address
from 192.168.5.1

There are various other ways in which you can modify your .htaccess file and secure your website against hackers and spammers.

9. Use SSL Certificates to Encrypt Data.

Using a Secure Socket Layer (SSL) certificate is a very smart move to secure the admin panel of your WordPress website. The SSL certificate always ensures a safe data transfer between the server and user browser. This makes it difficult for the hacker to spoof into your information or breach the connection.

For a WordPress website, it is very easy to set up an SSL certificate. You can either purchase it from the dedicated and authorized SSL reseller like www.cheapsslshop.com at a huge discount price or you can also ask your hosting service provider to provide you with one. Most of the hosting service provider arranges it as a part of their service.

The SSL certificates also give a boost to your Google ranking. If a website doesn’t have SSL certificate then it will be ranked lower than the one which has the certificate. This will definitely increase traffic on your WordPress website.

10. Change the WordPress database table prefix.

Do you know that the files in the WordPress database table have a prefix “wp-”? Why am I telling this in public, the hackers will get benefited right? They already know that it is just you who didn’t know this (If that’s a shocker to you). Any hacker can hack into your database files just by simple SQL injection.

Hackers and spammers run automated codes for SQL injections. Most of you didn’t bother that all the files in the WordPress database start with the initials “wp-”. You need to change the prefix as this can potentially harm your website.

In order to change the prefix of the WordPress database table, you can either do it manually or with the help of WordPress plugins. In either way, you can easily change the WordPress database table prefix. Plugins like WP-DBManager or iThemes Security can help you do the job with just a click of a button. (Make sure you backup your site before doing anything to the database).