Webguruz

How To Improve The Security Of Your WordPress Sites
WordPress is an online open source tool for website creation. It is written in PHP. It is one of the most widely used content management system (CMS). It is quite simple to use and is therefore quite popular. Despite being an open source tool, the site installation is quite secure. However, when a number of plugins, themes and custom codes are added to the site it becomes prone to attacks by hackers.

Hackers try to infect and control websites. Hacking becomes easy when a hacker finds a hole in a popular software or a plugin used by it. This is because they can infect a large number of websites when they infect just one software. Because WordPress is used by a wide variety of users, it has become vulnerable to attacks by hackers. Also, since it has an open source script, it is prone to security problems.

1. Humans:
This is when a person sitting at a keyboard manually probes and attacks a website. When a human attacks WordPress, he controls the speed at which he collects information about your site. This protects them from intrusion detection. He carefully attacks you a number of times so as to avoid detection.

2. A Single Bot:
This is when a hacker uses a single automated program or script to attack many sites in an automated way. A bot is basically a program written by hackers to target a large number of websites.

3. A Botnet:
This is when a group of machines run a program from a central command and control server and attack many sites in an automated way.

Most attacks on WordPress are accomplished by robots. Hence, they are not as sophisticated as human attacks.

Due to its attractive utility features, WordPress is one of the most sought after sites. It becomes the responsibility of the users to take steps to make the site more secure. In order to improve security of WordPress, some basic measures that can be taken are:

The user can add /wp-login.php or /wp-admin/ at the end of the domain name. Login page URL can be customized and even people’s interactions can be customized. Some steps that can be taken to secure the login page are:

a) A lockdown feature can be set-up which bans login after a certain number of login attempts. This will prevent brute force attacks on the website. A number of failed login attempts can be specified after which the hacker’s IP address can be banned.

b) The login can be enabled by a two-factor authentication code. This can be decided by the website owner. It can be the regular login password followed by a secret question or code.

c) Login can be done using e-mail id instead of user id. This helps in security because user names are easier to predict than email ids.

d) Login URL can be renamed. Hackers know the direct URL of the login page. They will try brute force to attack the URL. To prevent the attack by hackers, login URL can be changed to something unique.

e) The password can be adjusted by making it a combination of lowercase and uppercase letters/ adding special characters etc.It is the most difficult thing to attack. However, it still needs protection. Some ways of protecting it are:

a) One way of securing WP-Admin directory is by allowing access to the admin dashboard by submitting two passwords. One for protecting the login page and the other for the admin area.

b) Encrypting data using SSL. SSL or Secure Socket Layer is a means to secure data transfer between servers and user browsers so as to make it difficult for hackers to breach the connection.

c) If you run a WordPress blog, then there is a possibility of multiple authors accessing your admin panel making it more prone to security threats. In order to improve the security, a plugin like Force Secure Password can be introduced.

d) Avoid using ‘admin’ as the username for your admin account. This is a common username and it is easy to guess by hackers.

e) For extra admin security, you could monitor changes if your website files through plugins like Acutinex WP security, Wordfence, etc.Since all the information about the site is stored in the database, it is important to make this data secure. For this various measures that can be adopted are:

a) Changing the WordPress table prefix. The prefix used by WordPress is usually wp-table for its database. You can make your data more secure by changing it to something more unique.

b) It is beneficial to backup your site on a regular basis.

c) The password that WordPress uses to access the database should be strong. It should be a combination of lower case and upper case letters and special characters.

a) If a hacker can get access to the wp-config.php file, it is very easy for him to breach the security of your site. To improve the security, it is important to protect this file as it contains vital information about the site. It is, in fact, the most important file in the site’s root directory. Security can be improved by moving this file to a level higher than the root directory.

b) If a user has admin access to your WordPress dashboard they can edit files, plugins and themes which are a part of WordPress installation. In order to secure this, you should disallow file editing. In this case, even if the hacker is able to access your WordPress dashboard, they will not be able to modify any files.

c) Connect to a server in a secure manner. This can be done if you connect to a server only through SFTP or SSH instead of FTP as these are more secure.

d) Directory and file permissions on shared hosting can prove to be dangerous. In order to take care of this problem, you can change the directory and file to secure the website at the hosting level. You can set the directory permissions to “755” and file permissions to “644” to protect directories, sub-directories, and files.

e) If you introduce a new directory as a part of your website, your visitors can get an access to the full directory listing of everything in the directory. Directory listing can be disabled with .htaccess.Themes and plugins are vital to WordPress. But, they also pose security problems. In order to make WordPress themes and plugins more secure the following steps can be taken:

a) Updating your software regularly. Most good softwares need to be updated now and then. However, WordPress needs to be updated regularly in order to take care of the bugs in the system. Not updating themes and plugins on a regular basis makes them susceptible to attacks by hackers. Just updating will not suffice. You need to carry out regular maintenance of the site as well.

b) If your WordPress version number can be clearly accessed, it is prone to attacks by hackers. Hence, it is beneficial to hide the version number of every plugin.Firewalls work as reverse proxies which accept initial requests and reroute them to the servers eliminating all malicious requests.

a) There are many plugins which serve as firewalls for the website. Some of them work by altering your .htaccess file and restricting some access before it is processed by WordPress.

b) In addition to the above, a website firewall (WAF) can be added at the web server so as to filter the content before it is processed by WordPress.

c) A website firewall can be added in between the traffic from the internet and the hosting server.

Although the list provided above is not exhaustive, but it serves as a basic guidance to the steps that can help in securing WordPress.

As you can see, securing WordPress does not imply just setting up a security plugin. It has to be approached in a detailed, logical manner. You have to take care of various security problems associated with the site and address them. If you take care of your WordPress site, you can overcome all the security issues and stand to benefit from the site.

If you are looking for a website with secure WordPress, then we at Webguruz Technologies could definitely be of help to you. We have years of experience in providing secure WordPress websites to a number of clients. We have a team of technical experts who are available to satisfy your queries.