Keeping your WordPress site secure is crucial for every website owner. With WordPress powering over 30% of all sites on the web, it has become a prime target for hackers using attacks like SQL injection, cross-site scripting (XSS), and brute force attacks to break into sites.
Luckily, by following some key WordPress security best practices, you can help lock down your site and stop the vast majority of hacker attacks. In this comprehensive guide, I‘ll cover everything you need to know to properly secure your WordPress site.
Why WordPress Security Matters
Before diving into specific techniques, it‘s important to understand why having proper WordPress security matters in the first place:
- Prevents your site from being hacked – The #1 reason is to prevent unauthorized access to your site. Proper security helps stop attacks that aim to gain access, steal data, or spread malware to your visitors.
- Protects sensitive data – If you collect any visitor data or store sensitive business info, security helps safeguard that from falling into the wrong hands.
- Maintains uptime and performance – If your site does get hacked, it often means taking the site down entirely until the issue is cleaned up. Proper security helps avoid this downtime.
- Saves you time and money – Dealing with hacks can consume a lot of time and money for fixes. Good security is preventative medicine.
- Inspires visitor trust – Visitors expect sites to protect their data and info. Security reassures them your site is trustworthy.
As you can see, having proper security measures in place has huge benefits and saves major headaches down the road.
WordPress Security Threat Statistics and Trends
Recent statistics around WordPress reveal the scale and urgency of staying secure:
- Over 455 million cumulative brute force attacks targeted WordPress sites in 2021 alone according to Wordfence data.
- WordPress currently powers 43% of all websites globally – representing an attractive target.
- Attacks aimed at plugins now make up over 80% of WordPress security incidents.
- Outdated plugins and themes drive around 330,000 new infections yearly.
Hacking techniques have also evolved including:
- Advanced social engineering tactics leverage admin password resets and support impersonation increasingly.
- The weaponization of artificial intelligence to dynamically generate malicious code at higher volumes to find vulnerabilities faster via scanning.
- A 400% increase in supply chain attacks targeting the wider WordPress ecosystem vs just sites themselves.
Keeping your security strategy aligned to current trends protects against emerging attack methods before they become highly prevalent.
Now let‘s explore the top specific actions – or security best practices – you should implement to lock down your WordPress site.
12 WordPress Security Best Practices
1. Use Strong Passwords
One of the most basic yet critical things you can do is using very strong passwords, especially for your main admin login.
Some tips for creating ultra-secure passwords:
- Minimum 12 characters (longer is better)
- Mix of uppercase, lowercase, numbers, and symbols
- Don‘t use real words or personal info
- Unique for each site and account
- Store in a password manager vs typing each time
You can also have WordPress automatically generate very strong 14 character passwords for each user account.
Enable two-factor authentication (2FA) via plugins for all admin accounts when possible, requiring a code from your phone or authentication app to login.
2. Limit and Vet Administrative Users
Keep the number of users with admin access strictly limited – every admin user is another doorway for hackers to try entering your site through.
Vet each admin user thoroughly and review permissions so users only get access relevant to their roles. Don‘t use admin credentials in nonprofit or client sites.
3. Always Keep Software Updated
Running outdated, vulnerable software is one of the biggest security risks. WordPress and plugins/themes update very frequently with security patches that plug holes used in attacks.
Using automated background update plugins helps ensure you never miss an important update. Manually check weekly for core and plugin updates as well – treat this as essential maintenance.
4. Install Trusted Security Plugins
Security plugins provide extra protections and threat detection on top of what WordPress offers out of the box. I recommend using a combination for layered security:
Wordfence
- Enable Live Traffic + Blocking features
- Schedule weekly malware scans
- Enable password auditing
- Brute force protection via rate limiting
Sucuri Security
- Integrate sitewide IP blacklists
- Schedule security audits
- Enable post-hack security actions
iThemes Security
- 404 detection for scans and blocks
- Two-factor authentication
- Strong password enforcement
These plugins nicely complement each other based on their different core focuses. Use all 3 to start and tweak over time.
5. Scan Regularly for Malware
If your site does get hacked, attackers often leverage vulnerabilities to upload malware or backdoors. Security plugins like Wordfence include malware scanners to detect this.
Schedule regular malware scans (Wordfence offers a free option) and quarantine or remove any dangerous, suspicious files immediately. This helps ensure your site stays clean.
Here is an example default .htaccess rule Wordfence includes to block suspicious PHP files often tied to malware:
# Block any script that contains ‘base64_decode‘
RewriteEngine On
RewriteCond %{SCRIPT_FILENAME} base64_decode.*\.php [NC]
RewriteRule .* - [F]
Custom rules like this at the edge provide firewall-like filtering against common malware heuristics.
6. Carefully Vet Plugins and Themes
The biggest vulnerability many WordPress sites have comes from outdated or insecure plugins and themes. With over 55,000+ plugins alone, quality varies hugely.
Research plugins thoroughly before installing them, favoring well-known ones with strong ratings/reviews and an active development team behind them.
Avoid nulled (cracked) plugins or themes which have often have backdoors inserted into them by hackers. These commonly become sources of site infections.
7. Set Proper File Permissions
While permissions might sound highly technical, they represent one of the easiest ways for hackers to modify files or insert backdoors if not properly set.
As a quick rule of thumb, most files should be 644 or 640 permissions while folders are set to 755 for standard WordPress installs. Ownership should belong to your user account.
Work with your host to tweak permissions – setting application-specific permissions in cPanel is another option.
Here is a sample permission configuration command for secure settings:
find /home/public_html/wp-content/ -type d -exec chmod 750 {} ;
find /home/public_html/wp-content/ -type f -exec chmod 640 {} ;
This recursively adjusts directories to 750 and files to 640 ownership, locking things down.
8. Disable File Editing Within WordPress
Allowing file editing directly within the WordPress admin area sounds like a nice convenience feature. In reality, it opens up an easy way for malware or backdoors to be inserted if an attacker gains access.
Simply add the following line inside wp-config.php file to fully disable:
define( ‘DISALLOW_FILE_EDIT‘, true );
This forces editing files only via SFTP outside of WordPress.
9. Choose a Security-Focused Web Host
Not all web hosting providers are created equal when it comes to the underlying security they offer for your servers.
Features like email alerts for failed login attempts, DDoS protection, regular malware scans, firewalls, and single tenant servers are key to prevent and detect attacks quickly.
Important note – Avoid cheap, low-quality shared hosts especially for sites holding sensitive data or taking payments. The extra few dollars a month for managed WordPress hosts like WPEngine or SiteGround is well worth it.
10. Backup Your Website Frequently
No security strategy is flawless. In the worst case of a site hack or data loss from an accident, full site backups make sure you can fully restore everything quickly.
Use automated backup plugins like UpdraftPlus which support scheduled backups to remote destinations so you have offsite copies as well.
Test actually restoring from backups routinely to different environments to ensure your process works when needed most.
Here is a sample wp-config.php tweak to enforce daily backups for UpdraftPlus:
define(‘UPDRAFTPLUS_BACKUP_TIMERS‘, array(‘sunday‘, ‘monday‘, ‘tuesday‘, ‘wednesday‘, ‘thursday‘, ‘friday‘, ‘saturday‘));
This runs automated backups 7 days a week.
11. Disable Unused Features and Services
The more running services, plugins, theme functions, etc that you have active, the larger your potential attack surface grows.
Disable or uninstall anything not directly needed for your site to limit what hackers can target and exploit such as:
- Unused default themes
- Inactive plugins
- XML-RPC if not using the API
- Embeds module if not leveraging
- File upload features unused
Minimizing plugins and access points hardens security significantly.
12. Follow WordPress Security Standards
Standards like the WordPress Security Checklist from the Open Web Application Security Project (OWASP) outline industry-accepted security best practices.
This covers item like sanitizing database inputs, guarding against CSRF, proper encryption, and using 2FA authentication among other checks.
Here is a sample custom wp-config.php hardening rule to sanitize all globals:
if ( ! defined( ‘WP_SANITIZE_GLOBALS‘ ) ) {
define( ‘WP_SANITIZE_GLOBALS‘, true );
}
Reviewing and implementing OWASP standards helps ensure you follow the leading guidelines. Automated security scanners like Sucuri‘s help spot areas not aligned with standards.
Advanced Alternative Security Options
While WordPress-specific hardening and plugins provide the first line of defense for most sites, larger enterprises and ultra-high value targets require more advanced protective measures including:
Web Application Firewalls (WAF)
- Cloud-hosted WAF like Cloudflare Rules provides strong protections and custom rule creation to block entire classes of attacks without site modification.
- On-premise WAF appliances available too for advanced users needing extreme control.
Microsegmentation
- Adopt zero-trust architecture principals to isolate the WordPress server completely from other systems via VLANs.
- Reduce each server function to only communication endpoints absolutely essential for operation.
Kubernetes Container Deployments
- Leverage container orchestration platform to autoscale WordPress safely while making updates fast and disaster recovery easier.
- Limits potential impact radius when a single container might be breached.
Evaluate your specific situation to determine if additional infrastructure solely focused on security could be warranted based on the value of your digital assets and tolerance for risk.
Proactive Monitoring and Threat Alerts
In addition to proactive hardening steps, it‘s vital to monitor your site continuously for emerging threats and attempted attacks.
Make use of features like Wordfence alerting about failed logins, locked out IP addresses, flagged files, malware scans, country blocking, etc. Tight integration with email and Slack notifications is extremely useful.
This allows responding immediately to block attackers and remedy issues before they can turn into full site takeovers or data breaches.
You can also leverage external site monitoring tools like UptimeRobot to continuously check uptime and notify you the moment outages occur which could indicate an attack.
Creating a WordPress Security Checklist
The list of specific WordPress security best practices highlighted in this guide can feel overwhelming to tackle all at once.
I recommend creating a simple security checklist breaking down tasks into 2 phases:
Initial Hardening
- Inventory all plugins, themes and accounts
- Remove unneeded extras
- Update WordPress + plugins + themes
- Strong admin passwords
- Limit admin users
- Install security plugins (Wordfence, Sucuri, iThemes)
- Tweak file permissions
- Disable file editing in WordPress
- Configure backups
Ongoing Security Hygiene
- Daily or weekly WordPress updates
- Backup site regularly
- Regular malware scans
- Monitor alerts from security plugins
- Annual security audit using service like Sucuri
- Review OWASP guidelines periodically
Use this checklist to tackle the most critical items upfront in a methodical manner then stick to essential, routine security hygiene.
Don‘t Go At It Alone – Leverage Managed WordPress Hosting
Understanding what WordPress security best practices to follow is only half the battle – actually implementing everything on an ongoing basis is challenging and time consuming.
For the most secure and hands-off approach, use a specialized managed WordPress hosting provider such as WPEngine or Pagely.
These services include:
✅ Hardened server configurations
✅ Dedicated firewalls
✅ Automatic patching and updates
✅ Daily backups
✅ DDoS protection
✅ 24/7 human security monitoring
The cost is low compared to the immense time and money savings from not having to worry about securing sites yourself. Many plans can also cover unlimited sites.
Keep Your Guard Up!
With hackers and threats increasing every year, properly securing your WordPress site using this comprehensive collection of tips and best practices is more crucial than ever before.
No single fix is a silver bullet against all types of attacks – you need layered security monitoring and hardening to lock sites down.
The good news is following this guide will get you 80% of what you need to stop the vast majority of external hack attempts and keep sensitive data much more secure.
Consistency is vital – don‘t let things slip through the cracks over time. Stick to essential security operations like scans and updates religiously.
I welcome any feedback on additional WordPress security best practices I may have missed! Over time, keep reviewing changes in hacking trends and security standards and adjust accordingly.
