Essential Security Measures for WordPress
1. Basic Security Setup
Strong Authentication
- Use complex passwords with mixed characters
- Change the default 'admin' username
- Enable two-factor authentication
- Limit login attempts
Recommended plugin: Wordfence Security
- Offers firewall protection
- Malware scanning
- Login security features
File Permissions
Set correct file permissions:
// WordPress files: 644
// WordPress folders: 755
// wp-config.php: 600
// .htaccess: 644
2. Keep Everything Updated
- WordPress core
- Themes
- Plugins
- PHP version
Auto-update configuration in wp-config.php:
define('WP_AUTO_UPDATE_CORE', true);
define('AUTOMATIC_UPDATER_DISABLED', false);
3. Secure WordPress Configuration
Hide WordPress Version
Add this to functions.php:
function remove_version_info() {
return '';
}
add_filter('the_generator', 'remove_version_info');
Disable XML-RPC
Add to .htaccess:
# Disable XML-RPC
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>
Disable File Editing
Add to wp-config.php:
define('DISALLOW_FILE_EDIT', true);
4. Database Security
- Use strong database prefix (not wp_)
- Regular backups
- Secure database credentials
Recommended plugin: UpdraftPlus
- Automated backups
- Cloud storage integration
- Easy restoration
5. SSL Implementation
- Install SSL certificate
- Force HTTPS
Add to wp-config.php:
define('FORCE_SSL_ADMIN', true);
define('FORCE_SSL_LOGIN', true);
6. Firewall and Security Headers
Security Headers
Add to .htaccess:
<IfModule mod_headers.c>
Header set X-XSS-Protection "1; mode=block"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
7. Regular Maintenance
- Monitor security logs
- Scan for malware regularly
- Remove unused themes/plugins
- Regular security audits
Recommended plugin: Sucuri Security
- Activity monitoring
- Security scanning
- File integrity monitoring
Common Pitfalls to Avoid
- Using nulled themes/plugins
- Neglecting updates
- Weak passwords
- Unnecessary plugins
- Unsecured file permissions
Additional Security Tips
- Move wp-config.php above root
- Restrict access to wp-admin
- Use security keys
Generate new security keys:
define('AUTH_KEY', 'unique-phrase-here');
define('SECURE_AUTH_KEY', 'unique-phrase-here');
define('LOGGED_IN_KEY', 'unique-phrase-here');
define('NONCE_KEY', 'unique-phrase-here');
define('AUTH_SALT', 'unique-phrase-here');
define('SECURE_AUTH_SALT', 'unique-phrase-here');
define('LOGGED_IN_SALT', 'unique-phrase-here');
define('NONCE_SALT', 'unique-phrase-here');
Remember to:
- Regularly test security measures
- Keep backup copies offsite
- Document security procedures
- Monitor site activity regularly
These measures create multiple layers of security, making it significantly harder for attackers to compromise your WordPress site.