WordPress security essentials: protecting the platform behind so many business sites

WordPress powers a large share of the web, which makes it a constant target for automated attacks. The core software receives regular security releases; the risk is mostly in what surrounds it.

Keep everything updated

• WordPress core, themes and plugins. Most successful attacks exploit known vulnerabilities in outdated plugins.
• Enable automatic updates for minor releases and for plugins you trust.
• Keep PHP on a supported version.

Fewer plugins, better plugins

• Remove plugins and themes you do not use. Deactivated code can still be exploitable.
• Prefer well-maintained plugins with recent updates and a good track record.
• Never install "nulled" or pirated premium plugins; they often contain malware.

Lock down logins

• Strong, unique passwords for every account, and two-factor authentication for administrators.
• Do not use "admin" as a username.
• Limit login attempts.
• Give each person the lowest role they need: editors do not need administrator access.

Harden the installation

• Use HTTPS for the whole site.
• Disable file editing from the dashboard.
• Set correct file permissions; WordPress does not need its core files to be writable by the web server during normal operation.
• Use a web application firewall and malware scanning.

Back up and monitor

• Daily backups of files and database, stored off the server, with restores tested.
• Monitor for unexpected changes to files, new administrator accounts and unusual traffic.

Do not forget old sites

Forgotten staging copies and old campaign sites on the same server are a common way in. Remove them or keep them updated.

How IDX helps

IDX web hosting includes antispam and malware protection with Imunify360, and every IDX shared and web hosting plan includes a free SSL certificate and the Softaculous app installer for one-click WordPress installs. Our team can help clean and secure a compromised site.