How to Secure Your WordPress Site in 2017

One of the most common questions we get asked at Netmage is, “How can I secure my WordPress site?” Now, unless you’ve been living under a rock, you’ll know that WordPress is one of the most popular content management systems around. With so many sites built on top of it, it’s quite surprising that website security wasn’t taken into consideration more when WordPress first came around.

In 2017, it’s quite imperative that you consider securing your site. Why? Two reasons:

• A lot has changed when it comes to securing websites from malicious attacks. Especially when it comes to the likes of WordPress, where every aspect of the platform can be modified via the backend. Meaning, even if you have a secure login page, you can still be breached if someone gets to the backend and changes the credentials.
• The second reason is even more important: WordPress is very common, and many people don’t bother to change default settings or install additional plugins. Meaning, if someone gets to the backend and starts changing stuff, then it’s quite likely that they’ll find their way to the website’s frontend as well.

So, in order to secure your WordPress site, you’ll need to make a few changes. And to do that, let’s take a look at each element of the platform and how you can make changes to improve security.

WordPress Settings

One of the most important aspects of a secure WordPress site is the settings. In order to change them, you’ll need to log into your WordPress account and access the Settings menu. From there, you can set a number of options, such as your site’s name, domain name, and username. In case you’re wondering, the latter two are quite important. Without a unique username and password for your site, anyone can have access to all your content, and you won’t be able to remove them. Even if you change your password, the issue will remain. Having a unique username and strong password is therefore critical for the security of your WordPress site.

After you’ve set those three elements, you can move onto other options. For example, you can adjust the theme’s settings as much as you like. However, doing so will essentially brick your site, as it prevents you from backing it up and moving it to another host. So it’s quite important to be careful there.

PHP Settings

Another important setting to secure your WordPress site is the PHP settings. If you’re using PHP, then you’ll need to make sure that the PHP execution is set to Safe Mode. Once in Safe Mode, you can change a lot about how PHP handles your site’s data and how it interacts with databases. For example, you can change the error reporting level, the maximum execution time, and the register globals setting.

If you decide that you want to use PHP, then you’ll need to download and install the SSL certificate before you use it. To do that, visit your site’s SSL certificate page and download the certificate for free. Then, upload the certificate to your sites’s certificate directory and restart the web server.

Security Measures

Even if you’re using the best security practices, bugs exist. Sooner or later, you’ll face a hacker, and when that happens, they’ll try to get into your site and do what they can. For that reason, it’s important to be on the lookout for security issues and take the necessary measures to fix them. A few things you can do to improve the security of your WordPress site:

• Change the passwords for all of your accounts. Even if you use different passwords for each one, combining them all in one makes it easier for someone to access all your accounts. So, create a random password for each one and make sure you don’t use any of your previous passwords. Doing so can significantly improve your site’s security.
• Set up a regular backup and update your WordPress installation to the latest version. Having a backup of the site can be quite helpful in case you lose all your data due to a hack or similar incident. Regular backups should be done daily, and you can restore them as often as needed. The most important thing is to make sure you update your WordPress installation to the latest version. This will make sure you’re always running the latest version of the software, which offers the best security and is also completely compatible with all the newest plug-ins and extensions. If you update regularly, then any potential issues will be fixed before you even have the chance to experience them.
• Change the URLs of all your important pages and posts. If someone gets to your site’s frontend and manages to input the URL of a phishing site, then they’ll be led to it. Unless you have a login page for those sites, then they’ll most likely input the URL of your WordPress site, which will then redirect them to the phishing site.
• Use a VPN to keep your personal information secure when browsing the web. VPNs (Virtual Private Networks) are a great way to ensure that your personal information, including your website’s URL, is kept private while you’re online. Furthermore, logging into websites with a VPN ensures that your credentials are not sent to the server, meaning that even if the site is breached, your data will be safe.
• Use a strong password for your WordPress account. If you use the same password for your account as you use for your website, then it will be quite easy for someone to gain access to both. Using a password manager is a great way to avoid this issue. A strong password should be at least eight characters long, contain a mix of numbers, symbols, and uppercase and lowercase letters, and be difficult to guess.

With these tips in mind, you’ll be able to secure your WordPress site and keep your data safe. Hopefully, these tips will help you figure out how to secure your WordPress site the right way. If you have any other tips or suggestions, then please feel free to leave us a comment below! Happy securing!