WordPress is one of the most popular content management systems available (CMS). Powering more than 38% of the web, it’s the CMS of choice for a whole range of uses, from personal blogs to government websites.
Its flexibility and ease-of-use make WordPress attractive to a huge and varied user base. Unsurprisingly, this user base makes WordPress sites particularly attractive to hackers.
Is WordPress secure?
While the WordPress Security and Core teams are continuously working to monitor and mitigate security risks, vulnerabilities in the software and third-party extensions do exist and hackers are quick to exploit them.
A 2019 report by security plugin Sucuri found that of the security breaches they investigated, 90% related to WordPress sites, with third-party themes and plugins the primary route of attack.
How to secure your WordPress website
Research has found that the average cost of a hacked website is $2,518. As anyone who has had to pay out to recover a site or has endured the stress of a breach will know, when it comes to website security, prevention is better than cure.
So what can you do to secure your WordPress website?
There are numerous ways you can protect your site against malicious attacks and data breaches – but where to start? We’ve put together five simple steps you can take to secure your WordPress website today.
Step one is a relatively quick and easy way to avoid pain later: make sure you’re running the latest version of any software used on your site.
Start by updating to the latest version of WordPress. Each version includes security patches and additional features aimed at helping to improve the security of your site, so it’s worth staying up-to-date.
But running a recent version of core alone isn’t enough. Every time you install a plugin or theme, you run the risk of opening up your website to security vulnerabilities. To mitigate this risk, WordPress recommends checking for updates via the Plugin Screen in your admin every three to six months.
Finally, make sure to use the latest PHP version. As well as increased security, your site will likely benefit from performance improvements. Like WordPress, PHP is maintained by a global community, all working to develop useful security features and patches. Ensuring you have the latest PHP release is a simple way to stay on top of the security game.
Take stock of your plugins
Following on from step one, if there are any plugins or themes you’re no longer using, don’t hang on to them for sentimental reasons – get rid. Your website will thank you.
By fully removing unused extensions, not only will you benefit from increased loading speeds thanks to all that freed-up memory, but you’ll also shut down potential access routes for would-be hackers.
Note that simply deactivating and deleting any old plugins might not be enough – you may also need to clean out unused database entries or extra code. Check each plugin’s readme file for full instructions on how to remove all traces.
Finally, when deciding to install a new plugin, make sure it has a positive reputation and, ideally, in-built security features to protect your website and your visitors’ data. For example, contact form plugins weForms and Forminator have been built with security in mind. They use reCaptcha to prevent bots spamming your site with unwanted entries and attempting malicious SQL injections.
Lock down access to your site
Step three sounds simple but is often overlooked: check your website access and permissions.
Easy-to-guess passwords and using ’admin’ as your default user are two surefire ways to a compromised website. Make sure all passwords associated with your site are unique and strong, then store them securely. For example, in 1Password or Last Pass.
Double-down your efforts by activating two-factor authentication. This will mean you’ll need to provide additional authentication each time you log in, but it will help to prevent malicious users from gaining access to your site.
While we’re talking about website access, did you know that by default WordPress doesn’t limit the number of login attempts on your site, leaving you open to attack from bots and hackers? Combat this by installing a plugin like Limit Login Attempts Reloaded and changing your settings.
Finally, make the most of native user roles. FortressDB uses the built-in roles in WordPress to ensure that any files stored on our servers can only be accessed by users with the correct user role and permissions, reducing the risk of sensitive data falling into the wrong hands.
Make sure your database is working for you, not against you
Step four: make sure your database isn’t leaving you exposed.
WordPress is accessible, easy-to-use and comes with several important security features, including SSL certificates, as standard. However, when it comes to keeping your data secure, WordPress has one key flaw.
By default, WordPress stores uploaded images, videos and all other media files in the wp-content/uploads folder. And the wp-content/uploads folder are public. This means that uploads to your site could end up in Google search results, making sensitive data visible to everyone. Worrying, right?
FortressDB was developed, in part, to resolve this very issue. The database plugin stores uploaded content directly onto its secure servers, removing any risk of it being made visible to the wider web.
Not only that, but all data sent from WordPress to FortressDB’s secure servers is sent over SSL. This means your data is encrypted and kept safe from prying eyes, even if you’re using an insecure public network.
Choose safe, secure WordPress hosting
Last, but not least: choose a reliable, security-focussed WordPress hosting provider.
Hopefully if you’ve taken the above steps to secure your website, you won’t have to handle a compromised website. However, hackers and bots are using increasingly advanced methods to target security weaknesses.
A recent report by SiteLock showed a 52% increase in website attacks in the past year, with the average website facing 94 attacks per day. With figures like these, it’s best to be as prepared as possible.
One final step you can take to prepare is to ensure you’ve chosen a reliable, security-conscious hosting provider. There are two key reasons for this: added protection and back-ups.
There are a number of well-known secure hosting providers including WP Engine, Kinsta and SiteGround, among others, which have all been developed with security in mind. They come with a range of features to help protect your site, from automatic WordPress core and plugin updates, to malware scans and features to protect your site from DDoS attacks.
In addition, most hosting providers will offer automated back-ups. This could prove essential in the worst case scenario that your site becomes compromised, helping to restore your content and reduce your website’s downtime.
With these benefits in mind, it’s worth doing your research and paying a little more for the added protection offered by a secure hosting provider.
If you’re interested in securing your WordPress website and protecting your visitors’ data, you might want to try FortressDB, a secure, safe and fast WordPress database plugin. With various pricing plans and a free trial option, there’s nothing to lose and a lot to gain.