Is your WordPress site safe from hackers? Click here for 7 critical WordPress security tips to secure your site and prevent hackers from stealing information.
The complete security of your WordPress site is of the highest importance. Without following critical WordPress security tips, you are leaving your site and all its information wide open to hackers.
Whether we want to believe it or not, hackers are everywhere -- and constantly trying to steal sensitive information. While it's impossible to know exactly how many hackers exist, what we can be sure of is that many of them are highly skilled at getting the information they want.
In fact, in February of 2017, over 1.5 million WordPress sites were hacked after the release of WordPress 4.7.2. WordPress patched the issue as quickly as they could, but a lot of damage had already been done to unprotected sites.
If your site was not affected, consider yourself fortunate. If it was, I'm sure it opened your eyes to how quickly hackers can get into your sensitive information.
Knowing this, what WordPress security tips can you put into place to keep hackers at bay?
Here are 7 critical tips you need to know and implement before it's too late.
1. Don't Get Carried Away With Plugins
Plugins are a great way to add automatic functionality to your WordPress site without the need to learn any code.
We all use them and love them. But running too many can be a security issue.
First off, make sure to delete any plugins that you're not using. Even if they aren't activated they can still leave vulnerabilities within your site.
Next, use the fewest amount of plugins possible to give your site the functionality you require. Look for plugins that serve multiple purposes and get rid of plugins that the multi-purpose plugins replace.
Running the fewest amount of plugins possible is a great way to limit hacker's access into your site.
Scaled-back plugin use isn't just for security either. Running too many plugins can dramatically reduce the speed and performance of your site and drive away visitors.
2. Turn on Automatic Core Updates
If you're running an older version of WordPress, your site is vulnerable. Hackers can spot these sites with relative ease.
Older versions of WordPress do not have up-to-date security and contain many flaws that the latest version has fixed.
If you don't log into the WordPress Dashboard often to manually approve these major updates, there's some simple code you can place in the wp-config.php file that will automatically run major updates for you.
Simply copy and paste the following code into the file:
# Enable all core updates, including minor and major:define( 'WP_AUTO_UPDATE_CORE', true );
Keep in mind that sometimes major core updates can cause problems or plugin conflicts on your site, so you'll want to keep an eye out for this.
3. Keep Plugins and Themes Up To Date
Out of date plugins and themes can have just as many security risks as running an old version of WordPress.
To set your site up to auto-update plugins, use the same wp-config.php file and enter the following code:
add_filter( 'auto_update_plugin', '__return_true' );
For theme updates, use this code:
add_filter( 'auto_update_theme', '__return_true' );
Also, make sure to remove any themes that you aren't running. The only theme to have is the one you are currently using to run your site.
4. Regularly Change Your Site Passwords
One of the best WordPress security tips? Change your passwords on a regular basis.
Use a strong password generator to create passwords with many random uppercase, lowercase, and special character passwords.
Consider changing your login password about once a week to deter hacking efforts -- especially if your site is getting over 100,000 visitors per month.
While this may sound like common sense, you'd be surprised at how many site owners don't continually create new passwords.
5. Protect the WP-Admin Directory with a Password
Wp-admin is at the very heart of every WordPress site. If it is breached by a hacker, it can take your entire site down within seconds.
The best way to protect the wp-admin directory is to protect it with a password. This way, in order to get to the directory a hacker would need to know two different passwords -- the one that allows access to the site's dashboard, and the new one that lets them into wp-admin.
By password protecting this directory, you cut a hackers chances of success in half.
6. Always Employ SSL Encryption
In 2018 this should be a no-brainer for any website owner.
It's become very easy to implement an SSL certificate on any WordPress site. Most site hosts offer this as part of a hosting package, or for a small additional fee.
If you value your website security and the security of your user's information, this is a step you absolutely cannot skip.
Additionally, Google looks much more favorably on sites that employ SSL encryption. This will help you quickly move up in Google search results.
7. Adding Additional User Accounts
If you're running a large blog site and have many authors and editors that access the Dashboard, consider using a plugin like Force Strong Passwords.
Hackers can enter your site through any of your user's login information. Many of your authors and editors are probably not as concerned about security as you are and set simple passwords.
By forcing additional Dashboard users to create hacker-proof passwords, you will vastly increase your site's security.
Wrap Up
Knowing where the danger is coming from is not nearly as important as knowing how to protect yourself from it.
These WordPress security tips are a great start to keeping your site secure from outside danger.
