WordPress is an open source project and developed by the community from all over the world. A lot of experts spent their time to make WordPress as secure as possible. But I’m not in the position to say that it has bulletproof security. You can see there are a couple of security issues that have been reported, fixed and disclosed in WordPress HackerOne. You can report any security issue too — if it is valid, you’ll get a bounty!
With that said, I would like to share a couple of best practices I follow to harden my WordPress site.
Add https to your WordPress site
You must have https for your site. Now SSL certificates are free and easy to install. And if you are on shared hosting, ask your hosting provider to add the free SSL certificate for you.
I’m on Vultr VPS, and I’m using this guide to add Let’s Encrypt SSL certificate for this blog: Install Let’s Encrypt SSL on One-Click WordPress App.
If you are on shared hosting with cPanel, it has AutoSSL feature enabled by default (should be). All you need is to open a ticket to your hosting provider support and ask them to enable SSL for your domains.
Or you can use free SSL from Cloudflare. Open an account in Cloudflare, and follow their instructions to move your nameserver and DNS over to Cloudflare. And from your WordPress admin, install the Cloudflare plugin and activate the SSL feature.
Enable 2-step authentication for your admin login
Enable WordPress.com sign-in from the Jetpack security settings page. Then also enable “Require two-step authentication”. You need to follow the setup instructions to enable that.
Always code review a plugin/theme before installing or updating
Most WordPress hacks come from plugin vulnerabilities. These are the steps to review a plugin/theme:
- Always get the plugin from a trusted source
- Read the plugin reviews
- Check the plugin in the WPScan Vulnerability Database
- Open the source code and do a code review based on WordPress Coding Standards and 10up Engineering Best Practices.
- Test it in a local environment/staging
If a plugin/theme is poorly written and goes against the coding standard and best practices, I’d rather not install it and find something else. When I really need to use that plugin, I’ll patch the code and remove the high-risk code before installing. Sometimes I email the plugin owner with my patch so they can fix their plugin. This is the beauty of open source.
Keep your WordPress up to date
By default WordPress has auto-update for security releases. But just in case you haven’t updated your WordPress, always keep it on the latest release.
Daily maintain your website
Check your website daily — use it, write content. Most WordPress sites get hacked also because they are being abandoned.
That’s all I can share today. I hope it’s useful for you. Remember: your site is only as secure as you care to make it.