As someone who has worked with WordPress for a considerable time, I have discovered some straightforward ways to significantly enhance the security and integrity of a WP-based website.
In my experience, most successful attacks originate from existing admin accounts. Hackers often try to brute-force their way into every website by exploiting weak login credentials. This can be identified in the server logs.
Non-admin accounts with post publishing capability also pose a threat as they can be accessed by a bot that can create thousands of posts or add malicious code to existing ones. Depending on the size of your website, such hacks can be difficult to remove, as they would likely affect all your website’s articles.
I would suggest the following precautions:
- Limit access to the admin panel and monitor non-admin accounts. Disable or delete accounts that are not in use. This tip is applicable to all websites, not just WordPress.
- Keep the number of admins to a minimum and avoid sharing login credentials between accounts.
- Always use strong passwords and apply them to usernames and email addresses as well. Keep this information safe and avoid accessing admin panels from unknown computers or random wifi networks.
- Regularly check the site’s health to ensure it hasn’t been hacked. Websites left unattended often become vulnerable to attacks. It’s a good practice to monitor your MySQL database’s size regularly at a minimum.
- Keep in mind that a hacked website may not show any signs of being compromised for years.
Below are my recommendations for a managed WordPress website where the web admin has access to the server’s files and some knowledge of PHP.
- Set the recommended access rights to files on the server. Generally, it’s best practice to set 644 for files and 755 for directories. All files should be owned by the web server user and group*. Apply tighter access rights to .htaccess and wp-config.php files based on your environment.
- Turn off the admin panel’s file-editing capability. This serious security issue can be easily avoided by adding a single line to wp-config.php: define(‘DISALLOW_FILE_EDIT’, true); Without this clause, anyone with admin account access (usually bots) can alter any of your WordPress installation’s files without you even noticing. Your website may begin to send thousands of spam emails or create random, hidden posts.
- Turn off file modifications. Adding a line in wp-config.php: define(‘DISALLOW_FILE_MODS’,true) will effectively block anyone, even those with admin privileges, from tampering with your WordPress installation. File modifications should only be allowed temporarily while performing WordPress and plugin updates.
- Turn off the plugins screen in the admin. The plugins panel only needs to be available for updating or managing plugins. It’s good practice to disable it by default using remove_menu_page(plugins.php). This hook allows hiding tabs from the admin menu, but it won’t block access. To make it effective, redirect the http request (containing strings such as plugin, theme, and customize) to localhost. This will disable the relevant admin screens.
- Add define(‘FORCE_SSL_ADMIN’, true) to wp-config.php. This setting is typically only important on servers that don’t automatically redirect to a secure channel.
On most WordPress websites, you’ll see several attempts to break into the server logs by spamming wp-login.php and xmlrpc.php. There are numerous ways to secure these files based on your build and requirements. The quickest way would be to rename them and add a random string to the filename. This will make the login and logout process more complicated and might disable some functionality for xmlrpc.php. Another approach is to add an additional user and password requirement in the HTTP header, such as request.Headers.Add(‘UserID’ …). This approach is not recommended as a long-term solution in a production environment, but it’s effective as a quick fix.
In conclusion, if you follow these recommended precautions and ensure that your passwords are strong, your website’s files have the correct access rights, you have not installed any questionable plugins, and you keep your WordPress installation up to date, then you should be able to protect your website from most attacks.
Add a comment