7 Tips to Keep Your WordPress Website Secure

By Daniel Barnes

Did you know that as of this year WordPress powers more than 26% of the web? That’s a gargantuan amount of websites – all designed and built on the world’s most popular Content Management System (CMS), and for a very good reason too.

The robust framework and easy-to-use nature of the CMS is appealing to both small business owners and web designers alike. But with such a huge proportion of the internet running on the same system, isn’t the threat of a cyber attack something to be concerned about, and how do you keep your WordPress website secure?

The Ugly Truth

Websites get hacked – that’s a fact. There are many ways in which a website can get hacked, and unfortunately, no website in the world, no matter how well protected, is completely bulletproof. That may sound like a pretty morbid fact, and you wouldn’t be blamed for thinking so, but don’t despair.

Just because your website has the potential to be hacked, it doesn’t mean that it will. Think of your website as you would your home – there is always a risk you could get burgled but if you implement a few simple security steps you can help minimise your risk.

We’re all aware that giants like Sony, Citibank and even NASA have been the victims of hacking in the past. As long as there are websites, there will be people who spend their time trying to hack them.

WordPress is constantly being improved upon by a large community of talented developers who roll out security updates automatically whenever a major security vulnerability is spotted. Even so, there are simple measures that you can take to reduce your risk and help keep your WordPress website secure.

And what’s best is you don’t have to be a tech wizard to implement them!

Keep Your WordPress Website Secure

Scan Your Local Environment

Any machine on which you access the website’s WordPress admin panel should have adequate antivirus and firewall protection. These should be kept up to date and regular scans of your machine must be run. As a minimum, we recommend Windows Defender and Malwarebytes. If you’re using a Mac you’ll not be able to get Windows Defender, but you can switch on your firewall instead.

Keep on Top of Updates

All plugins and updates to WordPress core files must be updated as and when they become available. This is because the primary cause of hacks to a website are through plugins that haven’t been updated.

Use Strong Passwords

Any user accounts made for the website must have strong passwords – passwords with a minimum of 8 characters that must include numbers, upper and lowercase characters and punctuation. WordPress suggests very secure passwords for you and we advise using them.

Use Cryptic Usernames

Never create a user account with the name ‘Admin’ – this is always the first thing brute force attacks go for. It is also highly advisable not to create an account with the same name as your website for the same reason. Don’t make it easy for hackers.

Security is Key

Always keep your passwords and usernames secure – make sure that your account’s public display name is never your username. As well as this, always make sure that you sign out of WordPress when you’re finished. Especially if you’re signed in on a public device.

Work with Your Host

Most hosting providers offer special security software that acts as another barrier against malicious attacks – GoDaddy, for example, offers a premium service called SiteLock. Check with your hosting provider to see whether they offer a similar service.

These often come at a small monthly cost but are well worth the expense.

Choose Plugins Wisely

WordPress offers a plethora of third-party plugins which add various functionality to your website.

Choose your plugins wisely – it is important to read their reviews and check the frequency with which they are updated.

Not all plugins are created equal.