1. Set up a website lockdown feature and ban users
A lockdown feature for failed login attempts can solve the huge problem of continuous brute force attempts. Whenever there is a hacking attempt with repetitive wrong passwords, the site gets locked, and you get notified of this unauthorized activity.
I found out that the iThemes Security plugin is one of the best such plugins out there, and I’ve been using it for quite some time. The plugin has a lot to offer in this respect. Along with over 30 other awesome security measures, you can specify a certain number of failed login attempts before the plugin bans the attacker’s IP address.
2. Use 2-factor authentication
Introducing a 2-factor authentication (2FA) module on the login page is another good security measure. In this case, the user provides login details for two different components. The website owner decides what those two are. It can be a regular password followed by a secret question, a secret code, a set of characters, or more popular, the Google Authenticator app, which sends a secret code to your phone. This way, only the person with your phone (you) can log in to your site.
I prefer using a secret code while deploying 2FA on any of my websites. The Google Authenticator plugin helps me with that in just a few clicks.
3. Use your email to login
By default, you have to input your username to log into WordPress. Using an email ID instead of a username is a more secure approach. The reasons are quite obvious. Usernames are easy to predict, while email IDs are not. Also, any WordPress user account is created with a unique email address, making it a valid identifier for logging in.
Several security plugins allow you to set up login pages so that all users must use their email addresses to log in.
4. Rename your login URL to secure your WordPress website
Changing the login URL is an easy thing to do. By default, the WordPress login page can be accessed easily via wp-login.php or wp-admin added to the site’s main URL.
When hackers know the direct URL of your login page, they can try to brute force their way in. They attempt to log in with their GWDb (Guess Work Database, i.e. a database of guessed usernames and passwords; e.g. username: admin and password: p@ssword … with millions of such combinations).
At this point, we have already restricted the user login attempts and swapped usernames for email IDs. Now we can replace the login URL and get rid of 99% of direct brute force attacks.
This little trick restricts an unauthorized entity from accessing the login page. Only someone with the exact URL can do it. Again, the iThemes Security plugin can help you change your login URLs. Like so:
Change wp-login.php to something unique; e.g. my_new_login
Change /wp-admin/ to something unique; e.g. my_new_admin
Change /wp-login.php?action=register to something unique; e.g. my_new_registeration
5. Adjust your passwords
Play around with your passwords and change them regularly to secure your WordPress website. Improve their strength by adding uppercase and lowercase letters, numbers, and special characters. Many people opt for long passphrases since these are nearly impossible for hackers to predict but easier to remember than a bunch of random numbers and letters.
LastPass is one of the easiest ways to get on top of your passwords. It’ll not only generate safe passwords for you but then store them inside a browser add-on, which will save you the hassle of having to remember them.
6. Automatically log idle users out of your site
Users leaving your WordPress site open on their screens can pose a serious security threat. Any passerby can change information on your website, alter a person’s user account, or even break your site altogether. You can avoid this by ensuring that your site logs people out after they have been idle for a certain period of time.
You can set this up by using a plugin like BulletProof security. This plugin allows you to set a customized time limit for idle users, after which they will automatically be logged out.
7. Protect the wp-admin directory
The wp-admin directory is the heart of any WordPress website. Therefore, if this part of your site gets breached, then the entire site can get damaged.
One possible way to prevent this is to password-protect the wp-admin directory. With such a security measure, the website owner may access the dashboard by submitting two passwords. One protects the login page, and the other secures the WordPress admin area. If the website users are required to get access to some particular parts of the wp-admin, you may unblock those parts while locking the rest.
You can use the AskApache Password Protect plugin for securing the admin area. It automatically generates a .htpasswd file, encrypts the password and configures the correct security-enhanced file permissions.
8. Use SSL to encrypt data
Implementing an SSL (Secure Socket Layer) certificate is one smart move to secure the admin panel. SSL ensures secure data transfer between user browsers and the server, making it difficult for hackers to breach the connection or spoof your info.
Getting an SSL certificate for your WordPress website is simple. You can purchase one from a third-party company or check to see if your hosting company provides one for free.
I use the Let’s Encrypt free open source SSL certificate on most of my sites. Any good hosting company like SiteGround offers a free Let’s Encrypt SSL certificate with its hosting packages.
The SSL certificate also affects your website’s Google rankings. Google tends to ranks sites with SSL higher than those without it. That means more traffic. Now who doesn’t want that?
9. Add user accounts with care
If you run a WordPress blog, or rather a multi-author blog, then you need to deal with multiple people accessing your admin panel. This could make your website more vulnerable to security threats.
You can use a plugin like Force Strong Passwords if you want to make sure that whatever passwords users make are secure. This is just a precautionary measure, but it’s better than having several users with weak passwords.
10. Change the admin username
During your WordPress installation, you should never choose “admin” as the username for your main administrator account. Such an easy-to-guess username is approachable for hackers. All they need to figure out is the password, then your entire site gets into the wrong hands.
I can’t tell you how many times I have scrolled through my website logs, and found login attempts with username “admin”.
The iThemes Security plugin can stop such attempts by immediately banning any IP address that attempts to log in with that username.
11. Protect the wp-config.php file
The wp-config.php file holds crucial information about your WordPress installation, and it’s the most important file in your site’s root directory. Protecting it means securing the core of your WordPress blog.
This tactic makes things difficult for hackers to breach the security of your site, since the wp-config.php file becomes inaccessible to them.
As a bonus, the protection process is really easy. Just take your wp-config.php file and move it to a higher level than your root directory.
Now, the question is, if you store it elsewhere, how does the server access it? In the current WordPress architecture, the configuration file settings are set to the highest on the priority list. So, even if it is stored one folder above the root directory, WordPress can still see it.
12 Disallow file editing
If a user has admin access to your WordPress dashboard, they can edit any files that are part of your WordPress installation. This includes all plugins and themes.
If you disallow file editing, no one will be able to modify any of the files – even if a hacker obtains admin access to your WordPress dashboard.
To make this work, add the following to the wp-config.php file (at the very end):
define(‘DISALLOW_FILE_EDIT’, true);
13. Connect the server properly
When setting up your site, only connect the server through SFTP or SSH. SFTP is always preferred over the traditional FTP because of its security features that are, of course, not attributed with FTP.
Connecting the server this way ensures secure transfers of all files. Many hosting providers offer this service as part of their package.
14. Set directory permissions carefully
Wrong directory permissions can be fatal, especially if you’re working in a shared hosting environment.
In such a case, changing files and directory permissions is a good move to secure the website at the hosting level. Setting the directory permissions to “755” and files to “644” protects the whole file system – directories, subdirectories, and individual files.
This can be done either manually via the File Manager inside your hosting control panel, or through the terminal (connected with SSH) – use the “chmod” command.
For more, you can read about the correct permission scheme for WordPress or install the iThemes Security plugin to check your current permission settings.
15. Update regularly
Every good software product is supported by its developers and gets updated now and then. These updates are meant to fix bugs and sometimes have vital security patches. WordPress, and its plugins, is no different.
Not updating your themes and plugins can mean trouble. Many hackers rely on the mere fact that people can’t be bothered to update their plugins and themes. More often than not, those hackers exploit bugs that have already been fixed.
So, if you’re using any WordPress product, update it regularly. Plugins, themes, everything. The good news is that WordPress automatically rolls out updates for its users, so you’ll receive an email notifying you of the update and information on the fixes in your dashboard.
As for the plugins, these must be updated manually by going to Plugins in your dashboard. When a plugin has a new version, it notifies you and provides a link to update now.