A WordPress site is a little like a sailing boat moored in harbor: as long as the hull is sound and the mooring lines hold, it rides out the storms without a shudder. Left unwatched, with a hatch open, it becomes an easy target. WordPress runs more than 40% of the world’s websites, according to W3Techs, which makes it the most widely used platform and therefore the one most often hit by automated attacks. The good news is that securing a WordPress site calls for neither a doctorate in computer science nor a serious budget. A handful of firmly anchored habits is enough to keep hackers at bay.
Here is a step-by-step guide, open to anyone, to protecting your WordPress site.
Why WordPress is a target
WordPress is no more fragile than any other system, but its popularity makes it rich pickings. The attacks are rarely personal: they come from bots that sweep the web around the clock, probing thousands of sites in search of a flaw. A weak password, a plugin left without its update, an outdated version: the smallest breach can be enough.
The consequences of a hack are serious: a site that cannot be reached, compromised data, pages stuffed with dubious links, lost rankings and lost trust. To grasp that the threat is automated and never sleeps is already to have the right frame of mind. Security is not an optional extra: it is a sea wall, and a sea wall has to be maintained.
Passwords and access
The first barrier is the door to your admin area.
Choose strong passwords. Banish “admin123” and the other old favorites. A good password is long, unique and mixes letters, numbers and symbols. A password manager spares you having to remember any of it.
Avoid the username “admin”. It is the first name the bots try. Create an administrator account with a username of your own and delete the default “admin” account.
Turn on two-factor authentication. Even if your password leaks, a second check (a code sent to your phone) stops the intruder at the door. It is one of the most effective protections there is, and one of the simplest to set up.
Updates and plugins
An up-to-date site is a protected site. Every update to WordPress, to your theme or to your plugins closes known security holes. Putting those updates off is leaving a door ajar.
A few rules of common sense: keep only the plugins you genuinely use and delete the ones you no longer need, even when they are deactivated. Download plugins and themes from official sources only. A pirated or abandoned plugin is a major risk. Fewer plugins also means fewer potential ways in, and a faster site.
Firewall and security plugins
A web application firewall filters out malicious traffic before it reaches your site. Several well-regarded security plugins offer one, along with functions worth having: detection of suspicious login attempts, blocking of brute-force attacks, file scanning and alerts when something looks wrong.
One security plugin, properly configured, is enough in most cases. There is no point stacking several: they are liable to get in each other’s way and weigh the site down. Here too, restraint is an ally of security.
Automatic backups
This is your lifebuoy. Whatever happens (a hack, a slip of the hand, an update that goes wrong), a recent backup lets you restore your site in a matter of minutes.
Schedule automatic, regular backups, at a frequency that suits your business. Keep those copies somewhere separate from your hosting: a backup stored on the same server as the site goes down with it when something serious happens. Above all, test from time to time that the restore actually works. A backup that has never been checked is a false sense of security.
What to do if you are hacked
For all the precautions, an incident remains possible. Hold your course: panic is a poor adviser. Start by putting the site into maintenance mode to protect your visitors, change every one of your passwords, then restore the last clean backup. Next, work out where the breach came from and close it, or the problem will come back. If the situation is beyond you, call in a professional: a hacked site that has been badly cleaned can stay infected for a long time.
If you would rather not handle the database yourself, you can have a technician work on your site for the clean-up and the hardening that has to follow.
This is often the moment when people take the measure of regular support, which prevents far more effectively than it cures.
Securing a site once is not enough. Our WordPress maintenance in Pau page, written from our base in south west France, sets out the rhythm to keep.
Conclusion and call to action
Securing a WordPress site comes down to a few steady habits: locked-down access, updates kept on top of, a firewall in place and backups you can rely on. None of these calls for specialist skills, only regularity. If you would rather leave that watch to expert hands and sail with an easy mind, our team keeps an eye on your site’s security day in, day out. Bring your WordPress site into safe harbor, out of reach of the storms.
Also worth reading: Web hosting: how to choose the right host for your site
Have your site securedPack of 5 support ticketsReport a security alert
