WordPress Security: Best Practices

WordPress security is not something you can ignore. With over 43% of all websites in the world running on this platform, it is a frequent target for attackers. Every day thousands of hacking attempts are made against WordPress sites, and sites without adequate protection are the most vulnerable.

In our WordPress maintenance services, security is an absolute priority. We have protected hundreds of sites and recovered others that were compromised. Here we show you the best practices we implement.

The Most Common Threats

Before protecting yourself, you need to understand what you are protecting against:

• Brute force attacks: automated attempts to guess passwords
• SQL injection: insertion of malicious code through forms
• Cross-Site Scripting (XSS): injection of malicious scripts into web pages
• Malware: malicious code that infects files and database
• Backdoors: hidden access points that allow unauthorized entry
• Pharma hacks: injection of pharmaceutical spam links into your site

Security Fundamentals

1. Keep WordPress Updated

Updates not only bring new features but also critical security patches. 39% of hacked WordPress sites were running an outdated version. Set up automatic updates for WordPress core and minor updates. For major updates, test in a staging environment first.

2. Use Strong Passwords

Use unique and complex passwords for all users, especially administrators. A secure password should have:

• At least 16 characters
• Combination of uppercase, lowercase, numbers, and symbols
• No dictionary words or personal information
• Be unique for each account

Consider using a password manager like LastPass, 1Password, or Bitwarden to generate and store secure passwords.

3. Limit Login Attempts

Plugins like Wordfence or Limit Login Attempts Reloaded can prevent brute force attacks by limiting login attempts. We recommend configuring a maximum of 3-5 attempts before temporarily blocking the IP, and a longer block after multiple lockouts.

4. Change the Login URL

The default /wp-admin and /wp-login.php URLs are known to all attackers. Changing this URL with a plugin like WPS Hide Login adds a layer of security through obscurity that stops most automated bots.

Advanced Measures

5. Two-Factor Authentication (2FA)

Add an extra layer of security by requiring a second authentication factor in addition to the password. Even if an attacker obtains your password, they won't be able to access without the second factor. Google Authenticator or Authy are free and reliable options.

6. SSL Certificate (HTTPS)

An SSL certificate encrypts communication between the user's browser and your server. This is mandatory for sites that handle sensitive data, and Google penalizes sites without HTTPS. Most hosting providers offer free SSL with Let's Encrypt.

7. Correct File Permissions

Configure file permissions correctly:

• Directories: 755
• Files: 644
• wp-config.php: 600 or 640
• .htaccess: 644

8. Regular Backups

Backups are your last line of defense. Schedule automatic daily backups and store them in external locations. If your site is compromised, a clean backup allows you to restore it quickly without paying ransoms or losing data.

9. 24/7 Security Monitoring

Use tools that monitor your site continuously for suspicious activity and unauthorized file changes. Services like Sucuri or Wordfence Premium offer real-time monitoring and instant alerts.

10. Web Application Firewall (WAF)

A WAF filters malicious traffic before it reaches your site. Cloudflare offers a basic free WAF, while Sucuri and Wordfence offer more advanced options. A WAF can block SQL injection, XSS, and other common attack vectors.

What to Do If Your Site Was Hacked

1. Don't panic, but act quickly
2. Put your site in maintenance mode
3. Scan all files for malware
4. Restore from a clean backup if possible
5. Change all passwords (WordPress, hosting, FTP, database)
6. Update everything: core, plugins, and themes
7. Review admin users and remove unknown ones
8. Implement the security measures mentioned above

WordPress security requires constant attention. If you prefer to leave security in the hands of professionals, check our support plans that include security monitoring, updates, and proactive protection.