WordPress is a great platform for your website and/or web blog. However, it requires measures in place to keep your website safe and secure.
Here is a list of recommended steps you could take to try and secure your WordPress website. Some of these recommended steps below are with using CPanel as your web hosting control panel.
Table Of Contents
- Secure password and change regularly, never give out through unsecure email.
- Make those usernames unique do not use on front end anywhere.
- Enable Two Factor Authentication (2FA) on your login.
- Hide your default WordPress login links.
- Limit login attempts on your WordPress website & disable registration.
- Use a rate limiter such as Word Fence or Cloudflare to limit bots.
- With any forms such as contact, use reCAPTCHA from Google.
- Allow comments from registered users and do not allow trackbacks and pingbacks.
When you use CPanel for your Control Panel, I would recommend the following to help with your WordPress website security and vulnerabilities.
- Always use cPanel two factor authentication when logging into your cPanel account.
- Add security headers to block several things such as clickjacking and cross-site scripting.
- Security Hardening with WP Toolkit for cPanel.
- Disable XML-RPC and block access to xmlrpc.php.
- Firewall, intrusion detection, malware scanning service and protection against brute force and DoS attacks.
Secure password and change regularly, never give out through unsecure email.
Understanding the Importance of Secure Passwords
When it comes to managing a WordPress website, safeguarding your content and sensitive data should be a top priority. A secure password is your first line of defense against unauthorized access. To maintain the security of your WordPress site, it is crucial to create strong passwords that are hard to guess.
Creating Strong Passwords
A strong password should include a combination of uppercase and lowercase letters, numbers, and special characters. Aim for a minimum of 12 characters to enhance your password’s strength. Additionally, avoid using easily obtainable information such as birthdays or common words that can compromise your site’s security.
Regularly Updating Your Password
One of the best practices in maintaining your WordPress site’s security is to change your password regularly. It is advisable to update your password every three to six months. This routine, coupled with the use of unique passwords for different accounts, can significantly reduce the chances of unauthorized access.
Importantly, never share your password via unsecure email or any other insecure communication methods. If you must share access to your WordPress site, consider using secure channels and tools designed for sharing sensitive information.
Make those usernames unique do not use on front end anywhere.
Understanding WordPress Usernames
When you set up a WordPress website, your usernames are often displayed publicly. This can lead to privacy concerns and unwanted attention. Therefore, many website owners want to take proactive steps to hide their usernames and instead display a nickname or an alias.
Benefits of Using Nicknames
Using a nickname instead of your original username on WordPress can enhance your privacy. It reduces the risk of targeted attacks, spam, and unwanted queries. Moreover, nicknames can create a more approachable and friendly atmosphere on your website, encouraging more engagement from your visitors.
Enable Two Factor Authentication (2FA) on your login.
Understanding the Importance of Two-Factor Authentication
In today’s digital landscape, securing your website is more critical than ever. With a significant number of cyber threats targeting WordPress sites, implementing robust security measures like Two-Factor Authentication (2FA) becomes essential. By requiring a second form of identification, 2FA significantly reduces the risk of unauthorized access to your account.
How to Enable 2FA on Your WordPress Site
Enabling Two-Factor Authentication on your WordPress website is a straightforward process. Begin by installing a reliable 2FA plugin from the WordPress repository. There are many high rated plugins to choose from, which are user-friendly and effective.
After installing the plugin, navigate to the settings and configure 2FA by linking your account to a mobile authentication app. This link typically involves scanning a QR code that will be displayed during the setup process. Once linked, each time you log in, you will enter a temporary code generated by the app, adding an extra layer of security.
Hide your default WordPress login links.
A great plugin to use for this is WPS Hide Login which you can set your own private login and the default login will be ignored and not used.
Limit login attempts on your WordPress website & disable registration.
A well known plugin that works great on your WordPress website is Limit Login Attempts Reloaded. You can set the number of failed logins which will block the IP if not successful for a period of time you set.
Use a rate limiter such as Word Fence or Cloudflare to limit BAD bots and spam.
Introduction to Rate Limiters
If you’re running a WordPress website, combating bots and spam is likely a major concern. One effective strategy to protect your site is to use rate limiters like Wordfence or Cloudflare. These tools help manage traffic to your website by limiting the number of requests from bots, preventing malicious activities, and enhancing your site’s overall security.
How Rate Limiters Work
Rate limiters function by monitoring the number of requests received within a specific time frame. When a user exceeds this limit, their access is temporarily restricted. Tools like Wordfence and Cloudflare employ various algorithms to analyze traffic patterns, thereby distinguishing between legitimate users and harmful bots. This proactive approach minimizes server load and decreases potential vulnerabilities.
Benefits of Implementing Rate Limiters
Implementing rate limiters on your WordPress site offers several advantages. First and foremost, it reduces the likelihood of spam attacks and DDoS threats. By effectively filtering out unwanted bots, you ensure that genuine visitors have a seamless experience. Additionally, rate limiters can enhance your website’s loading speed by preventing excessive requests from overwhelming your server. In conclusion, using tools like Wordfence or Cloudflare is essential for robust security, helping safeguard your site against various online threats.
Allow comments from registered users and do not allow trackbacks and pingbacks.
Always use cPanel two factor authentication when logging into your cPanel account.
Add security headers to block several things such as clickjacking and cross-site scripting.
Vulnerability exploitation
Security headers make it more difficult to exploit client-side vulnerabilities, such as cross-site scripting (XSS) and clickjacking.
Malicious code.
Security headers can limit the sources of embedded content, which can reduce the risk of malicious code.
Unauthorized access
Security headers help protect sensitive user data from unauthorized access and manipulation.
TLS communication
Security headers can configure browsers to only allow valid TLS communication and enforce valid certificates.
Server certificate
Security headers can enforce using a specific server certificate.
Implementing security headers on your WordPress website is essential for enhancing its security and protecting it from various online threats. These headers serve as a crucial defense, reducing risks like cross-site scripting and clickjacking while providing better privacy and data integrity for your users. Properly configured headers not only reinforce your website’s defenses against attacks but also build trust with your visitors, ensuring their sensitive information is safe as they interact with your content.
Using htaccess to add security headers to your WordPress website
Place the following code in your .htaccess file for each website and place it right after the closing
# END WordPress
<ifModule mod_headers.c>Header set Strict-Transport-Security "max-age=31536000" env=HTTPSHeader set X-XSS-Protection "1; mode=block"Header set X-Content-Type-Options nosniffHeader set X-Frame-Options DENYHeader set Referrer-Policy: no-referrer-when-downgrade</ifModule>Security Hardening with WP Toolkit for cPanel.
Wp Toolkit offers a comprehensive set of tools designed to enhance your security measures, safeguarding against prevalent vulnerabilities, unauthorized access, and possible threats.
Disable XML-RPC and block access to xmlrpc.php.
Why should I disable XML-RPC?
Brute Force Attacks – Where an attacker can use xml-rpc to test hundreds of username and password combinations until they are eventually able to gain access to your site.
DDoS Attack – Where an attacker can use xml-rpc to pingback thousands of IPs.
Using .htaccess file
Go into your file manager and locate your .htaccess file and if its not shown, you might have to click the gear icon and show all hidden files within cPanel. Go to where it says:
# END WordPress
Then add the following.
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
allow from xxx.xxx.xxx.xxx
</Files>
If you wish to give a certain user remote access to your site, then simply replace ‘xxx.xxx.xxx.xxx’ on line 5 with their IP address. You can add multiple IP addresses by separating them with spaces.
Or, if you want to disable XML-RPC completely, then delete the line with the ip (xxx.xxx.xxx.xxx) altogether.
Using WP Toolkit to disable XML-RPC
- Login to your control panel, could be Cpanel or Plesk.
- Open WordPress > example.com > Fix vulnerabilities > Security Measures.
- Select Block unauthorized access to xmlrpc.php and click Secure.
- Repeat for all your WordPress websites.
Firewall, intrusion detection, malware scanning service and protection against brute force and DoS attacks.
Imunify360 uses a multi-layered approach to protect your server, including:
- Firewall: An advanced firewall with machine-learning rulesets.
- Antivirus: Automatic scanning and removal of viruses and malware.
- Patch management: Rebootless kernel patch updating.
- Intrusion detection and protection system: A collection of rules for blocking known attacks.
- Website reputation monitoring: Analyzes if your website or IPs are blocked by blacklists.
- Proactive defense: Blocks potentially malicious executions against websites running PHP.
A good Firewall will block IP’s and even Countries. Its essential that you have a complete suit that will help you with security on your server. I would recommend using ConfigServer Security & Firewall (CSF) with Imunify360 on your server.
Bonus content for WordPress sent email
Solution: use a SMTP plugin
There is an easy-to-use Setup Wizard and detailed documentation guide that will help you through the process.
WP Mail SMTP is free and has everything you need to reliably send your WordPress emails.
With any forms such as contact, use reCAPTCHA from Google.