WordPress Security can be hardened, simply by increasing the degree of difficulty to hack.
WordPress Security Tips
- Host your blog with a reputed host.
- Always Keep WordPress Updated.
- Use secure themes, and make sure you regularly.
- Delete unused WordPress themes.
- If not required disable new user registration in WordPress.
- Make your nickname different than WordPress login username.
- Change WordPress “Display name publicly as” to something different than login username.
- Use long complex password for WordPress login.
- Create new WordPress administrator with login username other than “admin”.
- To avoid brute force attack, create new WordPress login page.
- Disable WordPress login hints in login error messages.
- Remove lost password link from WordPress login.
- Redirect failed WordPress login to homepage.
- Redirect lost password link to homepage.
- Disable XML-RPC completely if you do not connect to external service.
- Remove WordPress Version Number from Head, RSS, and Query Strings.
- Plugins are the biggest reason WordPress sites get hacked.
- Make minimum use of WordPress plugins.
- Delete unused WordPress plugins.
- Always keep plugins updated.
- Create WordPress Blog Specific Plugin for code snippets specific to your site.
- Change WordPress database table prefix to avoid SQL injection attack.
- Change WordPress user ID to hide login username from your-site.com/?author=1 which redirects to author url [your-site.com/author/username/].
- Change WordPress Author URL Base, and Slug (user_nicename).
- Keep a log of WordPress Database and PHP errors.
- Enable HTTPS.
- Force WordPress blog to HTTPS.
- Remove unnecessary server response headers like Server, X-Powered-By, X-backend, etc…
- Enable HTTP Strict Transport Security (HSTS)
- Enable Content Security Policy.
- Enable XSS protection.
- Enable referrer policy.
- Only allow authorized applications to access WordPress Rest API.
- Block global access to readme, license, quickstart, and changelog file.
- Activate web application firewall to filter traffic.
- Always use SFTP or SSH to connect to server.
- Disable directory listing for WordPress files and folders.
- Disable PHP execution in WordPress uploads directory.
- Enable TLS 1.3.
- Disable direct access to your server IP.
- Secure WordPress Login from Bruteforce attacks by enabling Jetpack Plugin or Cloudflare Access.
Aim of the above guide is to minimize loopholes, and secure WordPress website from hackers.
You can also outsource WordPress Security by hosting your site with Managed WordPress Hosting company.
Moral of the Story
Remember, Prevention is always better than cure.
