How to Secure or Harden Your WordPress Website

This article was originally written in Feb 2014 and receives regular updates as tactics change.

Tip: If your website is currently hacked, this isn’t the guide you want. Check out our guide to cleaning a hacked WordPress site. Then come back here to harden it after the website has been cleaned.

How and why do websites get defaced, hacked, or corrupted?

Most sites are compromised by known vulnerabilities in outdated web-based scripts and applications. Simply put, this means if you run outdated versions of popular software such as message boards, blogging software, or content management systems, your website could be at risk. The second most common method for compromising a website is via admin login and password. One method is via low-strength passwords (too short, not enough variation of characters), and another is when you reuse the same password across websites and any one of the sites has been hacked in the past. This gives hackers large lists of potential email/password combos to try on other sites.

Why would anyone want to hack my website? I don’t store any personal or financial information on my site so I shouldn’t worry about this right? Many people feel that because they think no one wants to compromise their website they don’t need to worry about its security. This is false.

Although hackers may not want any of the information on your site, the most common reason to hack a website is to spread viruses, spyware, or deceive visitors. Most compromised sites we see have malicious code injected into the site files or database in order to do exactly this.

Security Plugins and Tools

After someone has gained access, it’s difficult and time consuming to trace their steps, so it’s considerably more important to block them in the first place.

You might be thinking “with only 9 tips here, aren’t you missing dozens of other security practices?!” Perhaps you’ve read about them on other blogs or from other hosting providers or WordPress experts. There’s a bunch of articles out there with 50+ security improvements you can make to WordPress… in our opinion anything more than what you see below is overkill, likely intended to fill out unique content for web scrapers. The majority of those 50+ tweaks are designed to slow down automated tools from inflicting damage after they’ve already gained admin access to your website. Following each step of this guide will instead set you down a path towards preventing malicious visitors from accessing protected parts of your WordPress website in the first place.

9 ways to harden your website

#1 Tip: Take regular backups! (If you host with us, here’s how to automate backups) If you have a backup, restoring a backup is orders of magnitude faster and simpler than cleaning a hacked WordPress site.

1. Use a plugin that limits login attempts

Note: this is optional if you host with us. The reason why can be found in the box below.

This type of plugin will limit the number of unsuccessful login attempts for your WordPress dashboard. This will protect against people trying to login to your website with random passwords over and over again in an attempt to “brute force” the system. Here’s a few you can select from:

• Limit Login Attempts Reloaded: can be downloaded here, which will set the limit to 3 attempts by default. If you have used our one-click web applications installer than this plugin may be installed by default.
• WP Security Ninja: despite the goofy name, we’ve found it to be quite effective at limiting login attempts and providing 2fa via an app authenticator.
• WordFence or WordFence Login Security: the OG of security tools for WordPress provides great login security as well as 2fa capabilities. Its WAF (web application firewall) rules can be helpful as well, however our hosting provides Imunify360 built in, which includes its own WAF that utilizes same-day security rules, whereas WordFence is 30 days out of date unless you buy the commercial version.

Tip: our WordPress hosting comes with server-level tools to automatically detect multiple login attempts from the same IP and ban the malicious IP addresses? It doesn’t do any harm to install a plugin, but with our hosting, it’s no longer essential!

2. Admin Users: Use secure passwords & audit them

Never create a user with a “temporary” password that you plan on going back to change later – it’s too easy to forget to adjust. When you go to change your password in WordPress under Users, it defaults to providing an autogenerated secure password. Please use what it provides and do not try to use one of your own, which will be weaker.

If you have trouble keeping/remembering long passwords, we don’t blame you: use a password manager like 1Password that will keep track of all of your randomly generated passwords for you and lock them all with one strong master password.

We also recommend auditing your admin users every few months by deleting admin users you do not require. Set a task in your to-do list software of choice to do this quarterly.

Tip: if you do need to provide a temporary login, such as to a contractor doing some work on the site for a day or a week, there are plugins for exactly this purpose! Search the WordPress.org plugins for “Temporary user” to find and install one.

3. Always update your software

Note: updates are 100% automated – by default – if you host your wordpress site with us and use 1-click web apps to manage your sites. Ensure any premium plugins or themes have their licenses activated, and have auto updates enabled in 1-click web apps.

This includes the core WordPress software, all plugins, and all themes that you have installed. This step combined with secure passwords, are the two most important steps. WordPress and plugin and theme developers release updates to both add features and repair security flaws. It is crucial that you update your software whenever a new version is available.

If you are using commercial plugins or themes, make sure to follow their instructions to save a license key to the plugin’s settings to enable auto update. This is an option for most commercial plugins like BeaverBuilder, Gravity Forms and WooCommerce extensions.

If your commercial theme or plugin does not support auto-update, you will need to add a recurring task to your to-do list software of choice to regularly check for updates and install them manually. When we encounter such plugins, we the developer to add auto-update and, if they do not intend to, we’ll find an alternative. This is because it’s not worth the time necessary to stay on top of manual plugin or theme updates.

4. Delete old software

The same is true for installed plugins and themes. If you’re not using them, remove them!

This also goes for staging or development sites. Often they are forgotten and no longer utilized after a redesign or a couple changes are tested, and that can create an unexpected intrusion point. Once you are done with a staging or development site, it’s best to remove it – you can always create a new development site when you need it, and it will be based on the latest version of the site.

5. Use a security plugin or CloudFlare firewall

Tip: If you’re hosted with us, a security plugin is not essential, but can still be handy in some cases. Our servers utilize a combination of security practices that block just about all the same types of intrusion attempts as a plugin can, from bruteforce attacks to vulnerability probing.

Many security plugins are a sham that only make recommendations and don’t actively protect your website.

We find WP Security Ninja and WordFence to be the best of the bunch, with Sucuri a close third.

If you’re on a VPS, it doesn’t hurt to enable weekly WordFence scans. If you’re on shared hosting enabling those scans may eat up resources unnecessarily, particularly if you’ll be implementing everything else on this list and if you host with us.

Tip: if you use CloudFlare’s firewall, it’s unlikely you’ll also need a security plugin. The same is true in reverse from a security perspective (it’s different for performance).

6. Deny access to login to anyone but yourself

This step isn’t essential if you already have very secure passwords for all your admin level users, however there’s no harm in applying it if you like wearing a tinfoil hat.

Read our guide to learn how to password protect your wp-admin folder with HTTP authentication. When following the guide, the folder to enter will be the wp-admin folder.

Once completed, you will have two levels of password entry before reaching the admin, HTTP Auth, and your standard WordPress admin login. Be sure to make the passwords different; if they are the same then a bot trying to guess them won’t have any trouble after getting through the first layer.

7. Run the latest PHP In Fast-CGI or FPM mode whenever possible.

If you are using a control panel that is current you’ll be able to choose between running PHP by FastCGI or Apache PHP. Choose the FastCGI or FPM method when possible.

In WordPress, there are many themes and plugins that think they need global access 777 permissions set in order to properly write to the folders and upload content. They’re wrong in most cases. “777” means that everyone hosted on that server can read, write, and execute any of the files that have those permissions.

This is a big security risk and is a major problem if you are on a shared web hosting environment. If another website is compromised on the same server, they will be able to access any of your files and folders that have the 777 permission set.

Using FastCGI or FPM mode forces PHP to run as your username and will avoid these problems altogether and work great with default file and folder permissions. If you’re hosting with us then FPM or FastCGI mode is the default for your website.

Be sure you’re running the latest version of PHP. Only the latest couple of major versions are regularly supported by the PHP developers, so running older versions like 7.0 or older (as of Dec 2019) could create security risks for your site.

8. Never store your passwords on your computer unless they are encrypted

Many programs on your computer actually store your passwords in plain text. This means that if you have a virus or a particular piece of spyware on your computer it may be able to access the FTP or web-based credentials for your WordPress or website installation.

If you want to save your passwords in your applications be sure to verify if they are encrypted or stored in plain text. For example, any application which stores passwords using Apple’s Keychain system, has fully secured password storage. Unfortunately FileZilla is not one of these apps, so saving your password in FileZilla’s site manager tool could be problematic if your computer is ever infected by a virus that knows to look for FileZilla data files.

9. Ensure you are always running anti-malware software on your computer

Although this one should go without saying, it’s very common that people don’t run either of these. It doesn’t matter how secure your website or the server is if people are able to get your passwords from your personal computer.

---

If you follow these tips, there are only two remaining methods that could be used to hack your site:

1. Zero day vulnerabilities, which are impossible to predict and protect against. The best answer to them is fast updates to the software, which our 1-click web apps utility handles for you, and to the firewall rules, which our Imunify360 WAF provides for you.
2. Social engineering, where someone tricks you into giving up your password. To prevent this, be vigilant and do not give out your password.