We've compiled a list of recommendations to help you protect your WordPress site . As the most widely used content management system in the world, it's quite common to be targeted by hackers, brute-force attacks, and bots. If you have all the default security options enabled, you could experience security issues that could leave your website unusable or contain malicious code. See which of these actions you can take to significantly improve your protection.

1. Do not use the wp_ prefix for the database

From the very first moment of installing WordPress, you have to specify a series of information that you have to enter so that WordPress can communicate with the database.

Most of that information is provided by your hosting provider, such as the database name, username, and password. But there is one decision to make: choosing the prefix for the tables that will be created for WordPress.

By default, the prefix offered on this screen is wp_so that your tables will look like this: wp_options, wp_comments, wp_posts, etc.

And of course, this is something every hacker knows, and it's free information we give to any potential attacker , who knows that if you don't do a secure installation, the WordPress tables – which are standard – will have those full names if you don't change the prefix.

So The first place you should start securing WordPress is even before you install it., in this step: change the prefix for the default tables (wp_) by another of your choice, for example wptabla_ o X1jM_ or whatever you want. The important thing is not how long or complicated it is, but at least don't leave the default prefix.

2. Do not use the admin user to access WordPress

Another decision we have to make during the WordPress installation is the name of the first user to access the administration of our website , a user who by default will have full management permissions.

For years, WordPress has offered a default username that you should definitely not use. So, when choosing your first username to access WordPress, avoid common names like admin , Admin , root , etc., as these are the first ones a hacker trying to take control of your website will check.

3. Use a strong password

I know it's hard to get you to listen to me with this very basic trick, but it's crucial that you understand that the easier a password is to remember (for you), the easier it will be for attackers' automated brute-force access systems to crack it.

WordPress, in its latest versions, includes a strong password generator and suggests using it. This will always be the best option. You can, however, ignore this recommendation and use a simple, insecure password, but you would be making the biggest and most important security mistake of all.

It's unnecessary to use easy passwords these days, as all browsers offer the option to remember them for you on your computer. So always use strong passwords that contain lowercase letters, uppercase letters, numbers, and special characters.

If you have many registered users, you can even force password changes to ensure all passwords are secure, including the administrator password. For example:

• Forcing password changes every 30 days
• Resetting all passwords

4. Always use the latest version of WordPress

One of the most dangerous things is working on a network with outdated or insufficiently updated software. Hackers typically target sites with older, unupdated versions , as these tend to be more vulnerable due to a lack of adequate protection against known attack types.

Fortunately, WordPress offers an automatic update system, both for the WordPress core itself and for plugins and themes.

By default, you don't need to worry about WordPress maintenance and security updates, as they are performed automatically. It will simply notify you when an update is complete. However, you will need to perform updates to major versions, even if it only requires a single click.

For example, you don't need to intervene to update from version 4.3.1 to 4.3.2; WordPress updates it automatically. However, you do need to intervene when updating from 4.3.xa to 4.4, even though the process is as quick and easy as clicking a button.

[Tweet "Hackers primarily target websites with outdated versions because they are more vulnerable"]

5. Update installed plugins

WordPress is secure, and that's normal because there's a large community that takes care of its maintenance, development, and growth, but the same cannot be said for plugins.

However popular a plugin may be, many times behind it there is a single programmer who, for obvious reasons, does not have the resources or time to always keep their plugin up to date.

That is why the main entry point for attacks on a WordPress installation is mostly through outdated plugins.

WordPress offers a system for notifying and automatically updating installed plugins, so when you see that one needs updating, don't hesitate.

If you're not using plugins from the official directory, WordPress might not automatically detect available updates. In that case, you'll need to keep an eye on the developer's website.

6. Update the active theme

Equally important is always using an updated version of the active theme, as hackers know that they are not usually changed very often , giving them time to learn from your code and invent ways to make your life more complicated and even get you into trouble.

If you're using a theme from the official WordPress directory, WordPress will notify you of updates. And if you're using a plugin you purchased elsewhere, you'll need to keep an eye on its creator's announcements and update it when new features are available.

7. Do not use outdated plugins or themes

One of the most significant sources of vulnerability is outdated or abandoned plugins and themes. Frequently check the developer's page for your theme and plugins to see if they've recently updated their product, and if not, look for an alternative that offers the same features.

If you use themes and plugins from the official WordPress directory, you will find all the available information, such as the date of the last update and compatibility with the latest versions of WordPress.

In addition, the official WordPress directory automatically removes plugins and themes that have not been updated for more than two years, providing an additional guarantee.

If you use themes and plugins downloaded from other sites, you should check their own website and manually install any updates.

8. Delete any plugins and themes you don't use

In line with the previous point, having inactive plugins and themes installed is dangerous , for the simple reason that we pay less attention to them when they're not active. They not only take up space on your hosting but also represent an entry point for potential vulnerabilities on your website.

The only active theme you should leave installed is the latest available WordPress default theme (currently Twenty Fifteen ), which provides an additional layer of protection for your website. If WordPress detects a problem with your active theme and cannot load it, it will automatically attempt to activate the default theme if it finds it installed.

9. Download plugins and themes for secure websites

The safest place to download plugins and themes is the official directory, where you'll find updated, tested, and secure versions of the latest releases. These are the themes and plugins you can install using the installer included with your WordPress site, and which you can also access at the following addresses:

https://es.wordpress.org/plugins/

https://es.wordpress.org/themes/

In addition, there are marketplaces for themes and plugins such as Envato , Woothemes , or Elegant Themes , which offer high-quality products and are carefully curated.

Of course, never download plugins and themes from P2P networks like Torrent or eMule ; they are usually infected with viruses and malware.

10. Protect the WordPress configuration file

The WordPress configuration file, wp-config.php, contains very sensitive information about your server:

• Database name
• Database user
• Database password
• Database table prefix.

For this reason, it is vital to protect it from prying eyes and, of course, from unwanted modifications.

To do this, you can perform the following actions:

1. Move it to a higher folder, so that if it's located in the path …/public_html/mydomain.es/ move it to the folder …/public_html/.
2. Protect it from writing by changing the permissions to 444.
3. Add the following rules to your Apache .htaccess file to prevent unauthorized access:

   order allow,deny deny from all

11. Protect the uploaded files folder

The uploads folder , located at yoursite.com/wp-content/uploads, where you upload the images and documents you attach to your WordPress posts, is the most vulnerable to attacks. Therefore , it's crucial to protect it to prevent viruses or malicious scripts from running from within it.

WordPress does not allow executable files to be uploaded to this folder by default, but hackers use techniques to bypass this rule. Therefore, we must apply extra protection by explicitly defining which file extensions can be uploaded to it.

To do this, we will add the following lines of code to the hidden Apache configuration file .htaccess, located in the folder where you installed WordPress:

Order Allow,Deny Deny from all  Order Deny,Allow Allow from all

12. Make backups

If there's one fixed rule in security, it's that no matter what measures you implement, there will always be some new vulnerability we're not protected against; we'll always be one step behind malicious attacks. So, in the event of a disaster, the only thing that can save us from the potential loss of all our data is having backups.

Make sure your web hosting provider offers full automatic backups. Additionally, install a backup plugin like BackWPup , which allows you to schedule various backup tasks, saving your backups to another server, sending them by email, or even automating their storage on cloud services such as Dropbox, Amazon S3, or Google Drive, among others.

[Tweet "To prevent attacks from strangers on your WordPress site, rule number 1 is to have backups"]

13. Limit access attempts

Most current attacks against WordPress sites are carried out through massive login attempts via the login screen , so it is essential to protect internal access to your WordPress site.

To do this, we can apply different security measures:

1. Disable user registration, thus preventing malicious users from exploiting potential vulnerabilities to gain extra permissions on your installation and the ability to make changes to it.
2. Add a human verification system like reCaptcha, which prevents unwanted access by automated machines trying to gain access to your site.
3. Install a plugin to prevent mass login attempts, such as Limit login attempts, the module Protect by JetPack or the utilities of this type found in most security plugins, to block these types of attacks.

14. Install a security plugin

Many of the security measures we can apply to our WordPress installation are included in plugins specialized in securing WordPress.

Most of them contain settings to prevent brute-force attacks, code injections, and modifications to system files , including warning systems to keep you informed of any potential attacks in progress.

The most recommended ones are the following:

• WordFence
• IThemes Security
• Bulletproof

15. Use secure file and folder permissions

By default, WordPress applies read and write permissions to files and folders that can sometimes be modified, either automatically by some plugins, or manually when you upload files yourself from cPanel utilities or even through FTP clients.

The default permissions that files and folders should have in WordPress are as follows:

• Files: 644
• Folders: 755

Any file or folder with excessive permissions could be a source of vulnerability. You'll need to change them back to the default permissions using the cPanel file manager or your preferred FTP client.

16. Use a reverse proxy like CloudFlare

One measure that will not only improve security but also the security of WordPress is to use a CDN service , or remote content delivery network, such as CloudFlare , with a very complete free plan and plugins that facilitate its integration with WordPress.

In addition to offering a very powerful caching system, it also incorporates protection measures such as the following:

• Email obfuscation, preventing the capture of email addresses displayed on your website
• Blocking IPs of visitors with behavior suspected of being attackers
• Always online, to display a cached version of your website even when you are under attack.

17. Create an account in Google Search Console

Google's former webmaster tools , now known as Google Search Console , in addition to fundamental analytics and analysis tools for your website, offer extra protection for your WordPress site.

In short, it's essential that you register your site with Search Console so that Google can inform you about:

• WordPress Updates
• Code injections
• Notices of usability issues
• Speed ​​issues

Plugins like Yoast SEO or All in one SEO pack allow for easy integration of WordPress with Search Console.

18. Prevents access to sploggers

If for any reason you allow user registration on your WordPress site, you must protect yourself against so-called sploggers , users who register en masse on websites to try to access their settings, add spam comments, or even inject malware.

The ultimate solution for these types of users is, of course, to disable user registration (WordPress's default behavior). However, if you have enabled registration for loyalty or marketing purposes, you should install the best plugin available to detect and eliminate this threat : WangGuard.

19. Protect the .htaccess file

We have seen several actions that we can perform from the Apache file. .htaccess, But for the same reason, it is equally important to protect this same file.

The .htaccess file is an Apache server file that applies rules to any application installed on your hosting, in our case WordPress, allowing you to apply security and safety measures, among others.

To also protect the .htaccess file from unwanted access, you can include the following lines in the same file:

order allow,deny deny from all

20. Protect yourself from spam

One of the regular tasks of any content management system administrator, such as WordPress, is controlling spam in the comments. First, because it's a source of distractions and unwanted links in the comment forms. And second, because some hackers use these forms to inject code that could compromise the security of your WordPress installation.

To achieve this, we can, and should, apply different strategies:

• Add a Captcha human verification system using plugins Really Simple CAPTCHA or the previously mentioned WangGuard.
• Activate a spam checking plugin like Akismet.
• Protect the forms of the injection of special characters.

And, of course, without needing to install anything, apply spam control rules from Settings -> Comments in your WordPress installation:

• Manually approving all comments.

• Adding rules to automatically mark unwanted comments as spam.

21. Avoid the pingback vulnerability

There is a specific vulnerability, called the pingback vulnerability , that deserves special mention because, although easily fixed, it would disable important WordPress functions such as remote management, the use of mobile applications, or even the pingback and trackback system.

It is related to the XML-RPC protocol , which allows WordPress to connect, for example, with the WordPress app for iOS or Android, as well as offline editors and some content syndication systems, so in principle, disabling this protocol does not seem advisable.

The downside is that it's an open avenue for potential code injections by attackers.

However, if you are certain that you will never use this type of application, the solution is as simple as deleting the WordPress installation file called xml-rpc.php.

The only problem is that when you update WordPress, it will be recreated, so a more precise measure would be to add these lines to the already familiar .htaccess file:

# protect xmlrpc Order Deny,Allow Deny from all

22. Check for changes to your WordPress installation files

You should keep in mind that security must be a constant and active concern. But fortunately, WordPress helps us automate many of these tasks, almost always completely free of charge.

A great way to monitor your WordPress installation is by using plugins like iThemes Security or WordFence, mentioned earlier. These plugins will monitor the integrity of your WordPress installation files and detect any changes, attempting to prevent modifications and, when that's not possible, alerting you to these changes so you can revert them and stay secure.

Do you know any other tricks to improve security?

I hope these tips and tricks for protecting WordPress are helpful. They're not exhaustive, but they are the most important.

[hover_color align=»center» background=»» background_hover=»» border=»» border_hover=»» border_width=»0px» padding=»60px 60px» link=»https://selfish.com.mx/servicios/» target=»» class=»cta-blog themecolorbg» style=»»]Don't risk it, with Selfish Protect all your web projects!