25 WordPress Security Tips to Keep Your Site Secure

Today, I plan to discuss quite a few simple WP security tips that can help you secure your WordPress site even more.

After implementing these tactics and following up with continual WordPress security checks, you’ll be well on your way to secure your WordPress website for good.

Table of Contents:

• 👉 Secure your web hosting
• 👉 Prevent login attacks and brute force
• 👉 Secure your WordPress dashboard
• 👉 Secure your WordPress database
• 👉 Secure your themes and plugins

Why WordPress security is so important

Before we explore the WordPress security checklist, it’s important to understand why WordPress security is so important. This way, you gain peace of mind, since you’ll know exactly why you spent time securing your website, or why you paid to hire that WordPress security expert.

Overall, WordPress security is important for a few reasons:

1. WordPress is popular: The system works so well that over 43.5% of the internet uses WordPress ^[1]. Yet, this means that it’s a recognizable interface, even for hackers.
2. You’ll have failsafes setup before problems occur: Although unlikely, a compromised WordPress site could cause it to crash or run poorly. Failsafes like offsite backup storage and quick backup restores mean you can resolve attacks even after they happen.
3. WordPress has many moving pieces: From third-party plugins to themes, and hosting companies to the core software itself, multiple elements come together to make WordPress one of the most customizable content management systems around. But with all these moving pieces, vulnerabilities may arise, like if you install a plugin with questionable code or don’t automatically update your WordPress theme.
4. It has a login area: To this day, one of the most common forms of hacking is the brute-force attack, which involves a bot or person trying multiple usernames and passwords to break into your site. Like all technology, WordPress has a login module, so you must do everything you can to protect the login area and strengthen credentials. The same goes for FTP and hosting login credentials.

Now that you know why WordPress security is crucial, keep reading to dive into the ultimate WordPress security guide, with 25 WP security tips to keep your site secure at all times.

Part (a): Secure your WordPress website by making sure your hosting is safe

Almost all hosting companies claim to provide an optimized environment for WordPress, but do they?

1. Work only with good hosts

You should only work with reliable, high-quality and secure hosting. This piece of advice seems obvious, right?

More or less, everyone thinks their hosting is great until something breaks for the first time. In the real world, not all hosting companies and hosting offerings are created equal.

If you take a look into one of our hosting surveys, you’ll see how different people’s experiences are in terms of overall hosting quality and also individual aspects of their hosting setups, like security, reliability, speed, etc.

Some hosts are simply sub-par and don’t do well under stress.

The bad news here is that most of the time you don’t even know that your host isn’t taking your website security seriously enough. Things like increased hacker attacks, frequent downtime, low performance, might all be a result of inadequate security mechanisms in place.

The reality is that you’re not really going to “fix your host.” The easiest and the best solution is to switch to a different host that’s more secure.

Generally, the more you pay, the better your new host will be, but there are also some budget options you can consider.

If you want to get to the bottom of the topic, we have comparisons of the best hosting options post available in the links box at the top of the page, plus the aforementioned surveys where you can see what other people say.

Here’s a short recommendation if you’re in a hurry:

• 💪 Best power setup. Kinsta. For $115 / month, you can host up to 5 websites and welcome ~100,000 visitors.
• 🚗 Entry-level managed host. Flywheel. For $13.00 / month, you can host one website and welcome ~5,000 visitors.
• 💰 Budget pick. SiteGround. For as low as $2.99 / month, you can host one website.

2. Protect the wp-config.php file

The wp-config.php file holds crucial information about your WordPress installation, and it’s the most important file in your site’s root directory. Protecting it means securing the core of your WordPress blog.

This tactic makes things difficult for hackers to breach the security of your site, since the wp-config.php file becomes inaccessible to them.

As a bonus, the protection process is really easy. Just take your wp-config.php file and move it to a higher level than your root directory.

Now, the question is, if you store it elsewhere, how does the server access it? In the current WordPress architecture, the configuration file settings are set to the highest on the priority list. So, even if it is stored one folder above the root directory, WordPress can still see it.

3. Disallow file editing

If a user has admin access to your WordPress dashboard they can edit any files that are part of your WordPress installation. This includes all plugins and themes.

If you disallow file editing, no one will be able to modify any of the files – even if a hacker obtains admin access to your WordPress dashboard.

To make this work, add the following to the wp-config.php file (at the very end):

4. Set directory permissions carefully

Wrong directory permissions can be fatal, especially if you’re working in a shared hosting environment.

In such a case, changing files and directory permissions is a good move to secure the website at the hosting level. Setting the directory permissions to “755” and files to “644” protects the whole file system – directories, subdirectories, and individual files.

This can be done either manually via the File Manager inside your hosting control panel, or through the terminal (connected with SSH) – use the “chmod” command.

For more, you can read about the correct permission scheme for WordPress or install the iThemes Security plugin to check your current permission settings.

5. Disable directory listing with .htaccess

If you create a new directory as part of your website and do not put an index.html file in it, you may be surprised to find that your visitors can get a full directory listing of everything that’s in that directory.

For example, if you create a directory called “data”, you can see everything in that directory simply by typing http://www.example.com/data/ in your browser. No password or anything is needed.

You can prevent this by adding the following line of code in your .htaccess file:

Here’s the thing: if hackers know which version of WordPress you use, it’s easier for them to tailor-build the perfect attack.

You can hide your version number with almost every WordPress security plugin that I mentioned above.

For a more manual approach (and to also remove the version number from RSS feeds,) consider adding the following function to your functions.php file:

function quick_remove_version() {
  return '';
}
add_filter('the_generator', 'quick_remove_version');Code language: JavaScript (javascript)

Final thoughts on how to secure your WordPress website

If you are a beginner then that was a lot to take in. You might feel like you just finished reading the ultimate WordPress security guide. The good news is that you don’t need to be a WordPress security expert to put it to use.

Everything that I mentioned in this article is a step in the right direction and something you should consider doing to help secure your WordPress site. Think of it as a 25-step WordPress security checklist and go through each step one at a time until you finish. Remember that the more you care about your WordPress security, the harder it gets for a hacker to break in.

With that being said, probably equally as important as security is website performance. Basically, without a website that loads quickly, your visitors will never get a chance to consume your content. The average website visitor will only wait for 2 seconds before getting frustrated and leaving.

Here are some resources that can help you win the performance game and make sure that your website loads lightning fast:

• 🕸️ Use a quality CDN. Some of them are even free. Here’s a comparison of the top options: MaxCDN vs CloudFlare vs Amazon CloudFront vs Akamai Edge vs Fastly
• 🏎️ Tune up some things under the hood of your site. Check out 11 ways to speed up WordPress by scrolling back to the top of this page and clicking on the link in the related posts box.

If you have any questions on how to secure your WordPress website, let us know in the comments and we’ll answer them! So what are your WordPress security challenges?

Written by Ahmad Awais, Joe Warnimont, Karol K.