WordPress is the most widely used CMS (content management system) for publishing content online. It’s used by many security conscious companies to power their blogs. Companies such as Facebook, eBay, Mozilla, CNN and NASA all use it.
WordPress’ popularity makes sites hosted on it a regular target to brute force login attempts. These attacks are automated across all the hosting platforms. They attempt to find blogs that use the default username, weak passwords and outdated software.
Don’t let this happen to you. Use a strong passwords for your account. Keep your WordPress installation and plugins updated to the latest version.
These are the simple security measures that any blogger can implement today. Do this to secure your WordPress blog, help prevent hacking attacks and keep your content safe.
1. Create a new user account
It is harder for a hacker to break into your site when both username and password have to be cracked. That is why you should create a new user and delete the WordPress default “admin” user. This is one of those things I do as soon as I setup a new site.
Usernames such as the default “admin” are the most frequent targets of these attacks. They should be deleted and not used.
You create a user by going into “Users” then “Add New” in the WordPress menu. When creating the new user, make sure to give it the role of an “Administrator”. That will ensure that you have the full authority over your site.
Now just log out from your default “admin” account and log in with the new user details. In “Users” delete the default admin username. Make sure to choose the option to transfer your old posts to your new username when deleting the “admin” account. Do this first before going to the next step.
2. Use a strong password
Do not use simple passwords on your WordPress. Simple passwords might make it easy for you to remember it, but they are also easier for a hacker to crack. Use stronger and more secure passwords instead.
Your password should be at least eight characters long. It should include numbers, special characters, and uppercase and lowercase letters. This is a tool that helps you create strong passwords.
Change your password now before going to the next step.
3. Set a new nickname
You do not want your new username to be the author name that is shown on all posts. This way the hackers will have an easy way of finding your actual username. That means they will know 50% of the details they need to know to log in to your admin.
Make it harder for them to figure out your username and password. Set the nickname WordPress uses as author name to something different from your username. You do this in “Users” under “Your Profile” in the Nickname field. Choose a new nickname and set “Display name publicly as” to your new nickname.
4. Turn on 2-Step Verification
Brute force attacks on your login page are the most common way of hacking WordPress. This type of attack is increasing as can be seen by the chart below from Sucuri.
There’s an easy way to stop these attacks. Turn on the two-step verification. This adds an extra layer of security to your WordPress login. You sign in with your password and then a code is sent to your phone number that you need to type in too. Without having access to your phone, it is simply impossible to break through the login page.
WordPress has created Jetpack plugin which allows you to turn on the Secure Sign On. This lets you log in to your self-hosted blog with your WordPress.com credentials. It also allows you to require a two-step authentication. You also have the ability to disable the default WordPress login form.
Simply install and activate Jetpack plugin in your WordPress admin. Turn on the “Single Sign On” option. Tick the box to “Require Two-Step Authentication”.
Insert this code to your theme’s functions.php file to disable the default login form:
add_filter( ‘jetpack_remove_login_form’, ‘__return_true’ );
Now you can only log in through your WordPress.com login details. Remember to make sure that you use a strong password there too.
5. (optional) Disable logins from certain IP addresses
Two-step verification is the recommended option. If you don’t want to use it, you have some alternatives.
Jetpack’s Protect is a plugin that monitors all failed login attempts on the network of blogs hosted by WordPress. It then automatically blocks all these unwanted tries from the rest of the network.
Limit Login Attempts plugin works on a local level. It records the IP address of every failed login attempt on your blog. If a certain number of login attempts are detected within a short period of time, the login is disabled for all requests from that IP range.
If you review unsuccessful login attempts, you will recognize why the step number one is essential. Majority of login attempts are made using “admin” username. Please do make sure to remove it and use a different username.
(optional) Blacklist IP addresses from logging into your admin
You could also blacklist everyone from logging to your admin except yourself. Go into the /wp-admin/ folder of your WordPress installation and open the .htaccess file. Add this code anywhere in the file but make sure to add your IP numbers. Type “what is my IP” in Google to find your IP address.
deny from all
# whitelist home IP address
allow from YOURIPNUMBER
# whitelist work IP address
allow from YOURIPNUMBER
# whitelist holiday IP address
allow from YOURIPNUMBER
You can put more than one IP address in there. It’s useful if you’re a nomadic blogger and move quite a lot. Now when someone tries to access the login page of your site they will get this message:
Forbidden. You don’t have permission to access /wp-admin on this server.
The big downside is that if your IP address changes you would need to update the document with your new IP. This can become a boring thing to do especially if your IP address changes often.
Another negative is if you travel a lot of use internet from different locations. Every time you would need to login to FTP, find your IP address and put it into the .htaccess file.
(optional) Block bots from accessing WP-Admin login page
This means that if and when a bot stumbles upon your site and tries to log into your WP-Admin it will be blocked. It won’t be able to do any damage.
To prevent the bots, you need to locate your .htaccess file on your server in your main directory. It’s not the same one in /wp-admin/ folder that we used in the step above. Paste this list at the top of your file.
6. Do not allow guest user registrations
You don’t have a membership site? Then there is no reason to allow visitors to register for a guest account on your site. Check that you’ve got registration turned off. Click “Settings” and make sure that “Anyone can register” option is unticked.
7. Do not allow pings
WordPress sites with pingback option enabled can be used in DDOS attacks against other sites. This option is enabled by default, so it is important to disable it. In “Settings” go into “Discussion” and in “Default Article Settings” tick off “Allow link notifications from other blogs (pingbacks and trackbacks)”.
8. Activate a security plugin
Several security plugins can help protect your site and prevent any hacking attempts. Two of the best options are Wordfence Security and Sucuri Security. They both do quite a few things to make your site safer.
This includes forcing you to use stronger passwords, and making you delete the admin username. They also do block bot traffic and help you do regular security scans.
9. Keep an eye on the Webmaster Tools
Google Webmaster Tools is a valuable resource even for your site security. Keep an eye on the “Security Issues” section. It notifies you if Google detects malware or any other security issues with your site. If you get a notification you should act quickly to fix it.
10. Set your WordPress and plugins for automatic upgrades
Always upgrade to the latest version of WordPress. Do the same for the latest version of your theme and plugins you use. Main reason developers release new versions frequently is the security vulnerability found in older versions.
25% of all WordPress security compromises in first quarter of 2016 happened through three outdated plugins. TimThumb, RevSlider, and GravityForms. All of them have been fixed in their most recent versions, so do make sure to upgrade.
Upgrading is simple, automated, one-click processes within the WordPress interface. When there is a new update available, WordPress will give you notice on top of your dashboard. It will say “WordPress X is available! Please update now”. Click on it and your upgrade is a simple one-click away. No excuses not to upgrade.
The most recent versions features automatic background updates. You may find that your WordPress upgrades to the latest version while you sleep.
Using Jetpack also allows you to set all your plugins to be updated automatically too. Even for your self-hosted blogs. Simply switch on “autoupdates” on WordPress.com in “Plugins” section of the “My site” area. Like this:
Are you afraid to upgrade because of some old WordPress theme you are using? Do you fear it’s not compatible with the new WordPress? Please switch over to something more modern. Something that you know has a serious developer and a community behind it.
I recommend you not to download themes and plugins from unknown sources. Use only the official WordPress directory and the official websites of premium themes and plugins. These are the quality signs to look for in a plugin or a theme:
- A high number of downloads
- Regular updates
- Recent last update
- Good reviews
11. Take regular backups automatically
Taking regular backups of your content and database is important. Any upgrade of WordPress could possibly lead to an unforeseen situation. The site’s database may become corrupted for example.
Hosting providers execute their system backups on their part. You should still take personal responsibility in doing regular backups yourself. WordPress site consists of two parts:
- Database: a place where all settings, pages, posts, and comments are stored
- Files: which consist of media, attachments, themes, and plugins.
It’s recommended to perform a full backup of the entire site. Both the database and the files. In case something happens to your site, you can always use the backup to recover your files.
The most convenient way for non-tech-savvy users is to use a backup plugin. There are a plethora of available plugins. One of them is BackWPup. Set it to automatically backup your site. It can send the backup file to your email address on a regular basis. It takes two minutes of work and you are in a much better place.
Do the first backup right now if you haven’t done it already. Really. You will continue building and growing your website with a much bigger confidence.
No more hacking problems
These simple steps can be executed fairly quickly and will make your site so much harder to break into. You probably won’t have a hacking problem. You’ll feel safer. You’ll be able to focus your time on creating exciting content and building an audience. Happy blogging!