How To Safeguard your WordPress Website- WordPress Security Tips

Don’t use the default admin user. After WordPress installation, the default user comes as admin. Hackers try and hit that factor first. So it is always recommended to create a new username with administrator rights and then delete the default admin user. But if you are keeping the default user, make sure you change the role from administrator to subscriber.

And if creating a new user, then always try and create a username which is hard to be guessed and then you can also use your e-mail id to login. There is a plugin called All In One WP Security & Firewall which can help you for this purpose.

And always use strong passwords for the usernames to boost the security. You should always limit the number of unsuccessful attempts to log in. In this way you are keeping your site a step further from being hacked.

You have to secure your WordPress directories from the outside world and for that you have to open your .htaccess file in WordPress root directory and provide the line “Options – Indexes” on top.

This will prevent others from viewing the files listed in the directories in case the index.html or index.php is absent.
Not only you have to prevent users from browsing the directories, you also have to make sure that you are not letting others write to your WordPress directory. And for that you have to do the following. First of all you have to login to WordPress Linux Shell and execute the following command to get a list of open directories.  The command is “find . -type d -perm -o=w”

After that you have to run following two commands to set the permissions.
find /your/wordpress/folder/ -type d -exec chmod 755 {} \;
find /your/wordpress/folder/ -type f -exec chmod 644 {} \;

755 (rwxr-xr-x) means the administrator has write permission but others can read and execute & for files 644 (rw-r–r–), the administrator has both read and write permission but others can only read files.

Make sure your WordPress website/blog does not display the WordPress version. This will notify the outsiders that you are running on outdated or non-patched version of WordPress.  You also have to delete the readme.html file from the directory as it also displays the version.

Always stay updated with the latest version of WordPress as the updates provide you the security fixes of all the time. You will get notification on your dashboard for all kinds of updates such as WordPress  version update, plugins update and theme updates. So make sure you don’t ignore the notifications related to updates thinking it can disturb your themes or plugins. Secure WordPress  

WordPress database tables have default names like wp_users, wp_posts etc. It is ideal to change the names of default database tables by changing the prefix of tables to some random value.  Changing prefix means changing the “wp_ “ part. There is a plugin available called “Brozzme DB Prefix & Tools Addons” which can help you on this part.

You should update the WordPress security keys. First generate six security keys and then open the wp-config.php file. And then overwrite the default keys with new ones. The advantage to this is if no one can logs in to your WordPress without your information as the cookies will go invalid.

It is definitely required to protect your .htaccess file and wp-config.php file. For that we have to place the following code in your .htaccess file.
<Files .htaccess>
order allow,deny
deny from all
</Files>

Similarly  you can protect your wp-config.php file by providing the following code in your .htaccess file.
<Files wp-config.php>
order allow,deny
deny from all
</Files> 

By keeping error logs of WordPress php and database, you can get hints of invalid file request hitting your WordPress. To enable error logging, the following code has to be added. The error.log file should be placed in folder not accessible from the browser.

define(‘WP_DEBUG’, true);
if (WP_DEBUG) {
define(‘WP_DEBUG_DISPLAY’, false);
@ini_set(‘log_errors’, ‘On’);
@ini_set(‘display_errors’, ‘Off’);
@ini_set(‘error_log’, ‘/path/to/error.log’);
}

You should protect the wp-admin folder of your WordPress as this section is not meant fro public. Even the authorized users will have to provide two passwords for logging in.

To get the list of users who logged in your WordPress server with their IPs, you can use the “last –i” command. If you find an unknown IP address, its high time you should change the password.

There are some plugins available to monitor your website. Some of them are Exploit scanner, WordFence Security,  VIP Scanner, WordPress Sentinel. These plugins will scan the files, detect the suspicious codes and spam links if any. You can also check online your website’s security for free by Sucuri Sitecheck

It is always advised to keep a back up of your site. If possible keep a weekly back up and that will keep your website safer. The free plugins available for back up are Backup WordPress & WP DB Backup. Another great paid one is vaultpress

Last but not the least is you should secure your hosting. Avoid free Hosting because we know that to have something good, you need to shell out some money. So do a proper research before hosting your website. And then your own machine should be secured because if there is a malicious logger on your machine then that logger can help in getting your website hacked.

Try to keep your WordPress spam free. You can use these 2 plugins – Spam free WordPress or Akismet

In your google webmaster central, try to check your site as “Fetch as Googlebot” and check for any abnormality. Sometimes malicious scripts hide changed title tags or add some other text content or links to your site that are not visible from page source. This tool would help you to find that.

Use WP security plugins such as WordFence, Limit Login Attempts, All In One WP Security & Firewall plugin.

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against man-in-the-middle attacks such as cookie hijacking. So when you use SSL with your self hosted wordpress site, make sure you use HSTS also. There is a plugin WP Force SSL that can help on this.

Use these 2 lines in your htaccess file.
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
sameorigin: When the X–Frame-Options header is set to sameorigin, content can only be loaded in a frame that has the same origin as the page itself.
 header X–Content-Type-Options: nosniff . This prevents the client from “sniffing” the asset to try and determine if the file type is something other than what is declared by the server.

It’s best to update your PHP version to the latest and active stable release such as PHP8.1 or 8.2

Always keep your theme and all plugins updated and regularly checked.