
WordPress is a great way to build and manage a website. Like any online software though, there are steps you should take to secure your WordPress installation and keep it safe from hackers. Some are common sense for any internet site (secure website hosting and choosing a secure password) and others are specific to WordPress (such as the plugins recommended below). Here are 7 steps to secure your WordPress website.
1) Pick a Good, Reliable, Secure Web Site Host
Where you choose to host your WordPress website can make a difference of opinion in your security. 2 serious things to look for are server security and backups for restore.
Choose a host who offers you php5 and runs it in suEXEC mode. With suEXEC you are able to lockdown your files more tightly. You can find more technical (very technical) details in Wikipedia.
Also look for a host who provides a responsible backup system and will restore your site for you free in the event of being hacked on. Most hosts offer weekly and monthly backups at a minimum. Some web hosts also do nightly backups and incremental hourly backups. I'm hosted on a server with monthly, weekly, nightly, and incremental backups. This means that if my web site were to be hacked I could easily roll back to what it looked like 3 or 4 hours ago. I wouldn't loose much, if any, of my content or other files.
2) Use 1-click installation software to Install Your Blog (or Change Your Admin Username)
If you install yourself with FTP and control panel, you'll have a default user name of "admin" which is very easy to guess. By using 1-click installation software, you will be given the choice to pick a username and password that are unique. Plus, it's easier than an install with FTP and control panel. Either way, don't use "admin" for the admin username. And don't EVER use "password" for your password.
3) Use a Secured Password
Cyber-terrorist and bad people are constantly trying to crack into our online accounts and access everything from our email to our online banking records. How can you stop them from easy accessing your accounts? One great step is to use SECURE passwords that aren't easily guessed or cracked by their software.
Here are tips on how to make secure passwords:
• Don't use names, dates, phone numbers, or addresses
• Don't use common words from the dictionary
• Mix up letters and numbers
• Make it at least 8 characters long (longer is better)
• Change it often (for online banking or web hosting accounts)
You may also want to use an online random password generator.
4) Stay on Top of WordPress News
Subscribe to the updates at the WordPress website so you'll know directly when the developers release an update or patch for any security issues.
5) Keep Your WordPress Installation Up to Date
It's critical to your security to keep WordPress up to date. The new versions of the script make that very good and you can update in just a couple of clicks. It's under "Tools" then "Upgrade" on the menu on the left of your admin pages.
6) Keep Your Plugins Up to Date
Anytime a plugin is updated, be sure to update the version on your site. You'll know an update is available because when you login to your admin area, there will be a amount in bright orange-red circle next to the "Plugins" link on the left. Click "Plugins" and it will show you which have an update available. You can follow the steps to automatically upgrade your plugin(s) as needed (backup your site before you upgrade anything, including plugins).
7) Install Security Plugins
Here are two security plugins I run on my WordPress websites and recommend installing:
With these 7 steps you'll have a more secure installation of WordPress.