Home » Uncategorized » WordPress Security

WordPress Security

WordPress is a safe system by itself, and most hacked sites are hacked because of old plugins, weak passwords or bad hosting. With a few good habits you can stop the most of the attacks.

Security checklist

  1. Keep everything updated: WordPress, themes and plugins. Most attacks use known problems of old versions.
  2. Remove what you do not use: delete (not only deactivate) unused plugins and themes.
  3. Use strong and different passwords, and a password manager. Turn on two factor login for admins.
  4. Give the lowest role a person needs. See Users and Roles.
  5. Install only trusted plugins and themes: from WordPress.org or known sellers, never nulled copies.
  6. Use HTTPS on the full site.
  7. Take regular backups and test them. See Backup and Update.
  8. Limit login attempts and keep an eye on the failed logins with a security plugin.

Check that the core files are not changed

WP-CLI compares your core files with the official checksums from WordPress.org. If a file is changed or added, it tells you:

Terminal output

$ wp core verify-checksums
Success: WordPress installation verifies against checksums.

Do the same for plugins from WordPress.org:

Terminal output

$ wp plugin verify-checksums akismet
Success: Verified 1 of 1 plugins.

Make the file editor off

The dashboard has a theme and plugin editor. If a hacker gets an admin login, he can put code with it. Remove the editor with one line in wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

Protect wp-config.php and uploads

# in .htaccess (Apache): block direct access to wp-config.php
<Files wp-config.php>
    Require all denied
</Files>

File permissions on most servers: folders 755, files 644, and wp-config.php 600 or 640. Never use 777.

What to do if the site is hacked

  1. Put the site in maintenance mode, or ask your host for help.
  2. Change all passwords: WordPress users, database, hosting and FTP. Create new salts.
  3. Reinstall the WordPress core and all plugins and themes from fresh copies. Check with wp core verify-checksums.
  4. Look for unknown admin users and unknown files in wp-content/uploads (PHP files should not be there).
  5. Restore a clean backup if you have one, and then update everything.
Note: A security plugin (like Wordfence or Really Simple Security) helps with scans, firewall and login protection, but it does not replace updates and good passwords. Next: WordPress Backup and Update.

Share this post:

Share on LinkedIn
Congratulations! Chapter Finished. Learn more about the similar topics:
Exercises & Assignments
No Content Found.
Interview Questions & Answers
No Content Found.