Complete guide to WordPress security

Here it is people – the complete guide to WordPress security. In this guide I’m going to cover everything you need to know to keep your WordPress site secure. Security requirements will vary – if you’re running a large store, the last thing you need is someone gaining access to your site, gaining access to your customer details, hacking your site and spamming people or even downtime for any length of time.

Whatever size of WordPress site you’ve got or whatever your security requirements are, I’ve got you covered in this guide. Before we get started, I need to go over some security basics.

Security Basics

Your security is ultimately only as good as your weakest link. Many people reading this will be worried about bot attacks – I cover that later – but if someone wants to hack into your site, the biggest weakness is YOU.

Do you do any of the following?

• Use the same password for your WordPress site and other sites?
• Stay logged in to your WordPress site? (clicking that little ‘remember me’ button?)
• Leave your computer unlocked?
• Write your passwords down anywhere?
• Record your passwords on your computer or online?
• Use an account called ‘admin’ on your WordPress site?
• Log into your site using plain HTTP rather than secure HTTPS?
• Fail to update plugins or themes?
• Buy themes which have bundled plugins?
• Give admin access to temporary developers?
• Install plugins or themes you downloaded illegally, e.g. through torrents?
• Use FTP rather than SFTP?

These are the most common weaknesses hackers are exploiting to gain entry to sites, servers and data. How likely you are to be attacked with these various weaknesses depends on how valuable gaining access to your site, servers or data is to would-be hackers. I’m not saying you should stop doing all of these – security is often a balance between being secure and getting on with your work. You often, for example, will need to give admin access to developers but follow this guide and you’ll rest assured that they haven’t left any backdoors on your website.

Firstly, you should ensure you don’t use the password you are using for your WordPress sites for any other websites. Unfortunately, many websites store passwords in plain text meaning an unscrupulous employee could access your password or even sell it on the black market. If you think this is far-fetched, think again. Stolen password lists are bought and sold constantly, and cryptocurrency makes it easy for hackers to sell them anonymously, so password theft is far more likely than most people assume.

Secondly, never leave your computer unlocked – it’s simply really bad practice. Get in the habit of locking it the moment you step away. On Windows hit Windows+L. On a Mac hit Control+Command+Q. Both lock your screen instantly, but only if you’ve set a password on your computer account, so make sure you have one. It’s also worth setting a screen-saver that locks the machine after a few minutes of inactivity, in case you ever forget. This matters most if you store passwords on your computer or stay logged in to your WordPress site.

Thirdly, if you’re going to record your passwords, use a proper password manager rather than a plain text file or a note under your keyboard. A password manager keeps everything encrypted behind one master password (more on that below). If you do keep a password file in cloud storage, listen out for hacks against that company and change your passwords if one succeeds.

Finally, ensure you have decent security software installed on your computer, be diligent about what you download or click on in emails, learn how to spot phishing attacks, and install some anti-malware software such as Malwarebytes for PC or Mac.

I go into more detail about securing everything else below, but get these basics right or you could get hacked at any time, regardless of the other steps you make.

Choosing, remembering and storing passwords

When choosing passwords, there are two major mistakes people make. The first is to re-use a password they use on another website – remember, other sites may be storing your passwords in cleartext (ever been emailed your password?) and the second is that they use a really simple password – e.g. dave123. If you do either of these things, your passwords are at risk of being hacked.

The best technique for passwords is to use a completely random string – bash on your keyboard for a bit and include some numbers and special characters. e.g. asd8u0io9478adupioAUI8034 is a great password (don’t use it now though!).

BUT how are you ever going to remember a password like that? You don’t have to. A password manager generates a long random password for every site, stores them all encrypted, and fills them in for you – you only ever need to remember one strong master password. Bitwarden is free and open source, and 1Password is a popular paid option. This is far safer than the old habit of keeping an encrypted file on Dropbox, and far easier to live with day to day.

To create the one strong master password you do need to remember, use a combination of these techniques:

• Use a three or four word phrase that is memorable to you but NEVER guessable from reading your social media profile, reading your snail mail or knowing you in person
• Use a mis-spelling of one or more of the words
• Replace characters of your choice in this password with another non-alpha-numeric character – e.g. you may choose to always replace ‘x’ with * or ‘i’ with ! or 1 or |. By choosing a couple of character replacements personal to you, you make it far harder for password crackers to guess your password
• Capitalise certain characters – e.g. you may choose to capitalise the 2nd letter of the first word, the 4th letter of the 2nd word and the 1st letter of the 3rd word. You then need to remember the password and 241 for 2nd, 4th, 1st characters to be capitalised.
• Intersperse non-alpha-numeric characters into your password – e.g. if you have a four word password (with certain characters replaced and some capitalised) then you could separate those words with different characters.

Preparing for the worst and backing up your WordPress site off-site

Hacking isn’t the only way your WordPress site can be destroyed – it could be destroyed by a storm, a fire, bankruptcy of your hosting company or user-error – e.g. you might run the wrong command on your server and delete everything by mistake, so backing up is not only to protect you from hacking. If you’re not backing up your WordPress site, DO NOT rely on your host doing it for you. It’s easy to set up.

1. Install UpdraftPlus (it’s free)
2. Set up off-site backups inside UpdraftPlus – they have a myriad of options included in the free version. I prefer backing up to Dropbox. NOTE: The free version of UpdraftPlus backs up your files in clear-text meaning if someone gets access to your Dropbox, they will get access to your database password (stored in wp-config.php). If you have everything else set up properly (specifically don’t allow remote MySQL log ins), your server will still be secure even if this happens. For ultimate security, back up to an encrypted storage drive. You can also back up using SFTP to another server you own or rent.

Preventing WordPress bot attacks

This is probably the most common complaint from new WordPress users. This problem really came to light back in 2013 when a massive botnet was discovered which was growing by the day – basically, it’s hacking into poorly protected WordPress sites using the ‘admin’ username and commonly used passwords. Every hacked WordPress site was then added to the botnet and used to hack other sites. The same brute-force pattern is still going on today, so the defences below matter as much now as they did then.

1. Never, ever have an account called ‘admin’. If you have an admin account, you can safely remove it by creating a new user called something else, give that user admin privileges, log out then back in as that other user then delete the ‘admin’ account and assign all posts and pages to your new admin user.
2. Install Wordfence (it’s free) and configure it properly to lock out failed attempts, email you every time a user with admin privileges logs in and some other nice things.
3. If you go for the paid version of Wordfence, there are some more features (e.g. country blocking for regions where a lot of attacks originate) but the free version is fine.

Stop hackers snooping on your WordPress login traffic and passwords

If you don’t have an SSL certificate on your website, this means every time you log in to your website your username and password is being sent in plain text. That sounds scary right? Anyone could read it? Well, not quite anyone. People who could access your passwords include anyone with access to any router between your computer and your server. e.g. If you’re at home, that’s your own router (sneaky child? borrowing the neighbours ‘free’ wifi? accessing your WordPress site from a coffee shop or an internet cafe?), your ISP, and then routers on the way to your server as well as your hosting company.

To prevent this you need HTTPS, and you need to ensure all logins use it. SSL certificates used to be expensive, but these days most decent hosts hand you one automatically for free through Let’s Encrypt. If your host doesn’t, a free Cloudflare account gives you SSL as well – and Cloudflare is also useful for blocking bot attacks since it remembers offending IP addresses. See my guide on configuring Cloudflare for WordPress and WooCommerce to set this up properly.

1. Get a Cloudflare account (or enable HTTPS through your host).
2. Force the dashboard and login page to use HTTPS by adding this line to your wp-config.php file:

define('FORCE_SSL_ADMIN', true);

Now all logins and dashboard traffic switch to HTTPS and no-one will be able to snoop your passwords as they will no longer be in plain text.

Mitigating WordPress back-door attacks

This is a tricky one to prevent completely. This is why you should always have daily backups running to an off-site location. A back-door attack is where some code on your site (e.g. in a plugin you installed) contains a security vulnerability. There have been plenty of high-profile examples over the years, such as the RevSlider vulnerability and the Fancybox vulnerability, both of which gave attackers complete access to the server.

To avoid this, you need to update your plugins before you get hacked. You can also make sure you use trusted plugins, but it’s very difficult without reading every line of code to be 100% sure that a plugin is secure.

Another way back-doors get in is developers you hire inserting their own back-doors directly into your code. They may modify the core WordPress files to do this. If so, Wordfence will alert you if it’s properly configured.

1. Update plugins as updates appear.
2. Turn on automatic updates. WordPress can now auto-update plugins and themes for you – enable it per plugin on the Plugins screen (you’ve got daily backups in case something goes wrong, right?).
3. Set up Wordfence to scan for any code changes made by developers or plugins.
4. Consider using a ‘sandboxed’ developer version of your website with different admin users and passwords when you’re hiring an external developer. This way you can test and scan on your dev.yourdomain.com site for any security vulnerabilities before they have the chance of hitting your live server.
5. Only give admin access to people you trust – you should know their address at minimum.

A note about themes with bundled plugins – e.g. themes from Themeforest:

If you’re buying themes on Themeforest or any other themes which come with bundled plugins, the plugin will not inform you about updates and it will not be updateable using the normal WordPress update method. This is because the theme author has bundled the plugin files which were up-to-date at the time of writing the theme, directly into the theme’s folders.

If you have a theme like this, set up an alert on the emails from Themeforest. You can configure Gmail, for example, to watch for emails from the Themeforest address which contain the word ‘upgrade’ or ‘update’. You can even combine this alert with a service like IFTTT to send you an SMS, but a Gmail alert is probably enough. Update your themes religiously – if something goes wrong, roll back or restore using UpdraftPlus.

Keep your server and your database secure

Many hosts have terrible security – they allow remote login for MySQL (why are WordPress users logging in over remote MySQL rather than SSH??), they email you root passwords, they allow FTP rather than SFTP. If you’ve got a host like this, consider moving to a better host.

1. Configure your server to disallow remote MySQL login. Get your developer or host to do it, or if you have SSH access to your server run the mysql_secure_installation command shown below.
2. Use key authentication to access your server over SSH – see my guide on how to use SSH keys to access your WordPress servers.
3. Use SFTP to access your server files, ideally with key authentication too.
4. Use different passwords for your FTP/SFTP account, your root server account and your WordPress admin account.

sudo mysql_secure_installation

Mitigating against WordPress denial of service attacks

A denial of service attack is where a botnet hits your server with thousands of simultaneous requests, ideally for large files or complex pages. If your server is poorly configured, it won’t keep up and it’ll fall over, preventing your legitimate users from accessing your site. I’d say this is on the softer side of hacking, since any damage is temporary – they don’t actually gain access to your site, they just prevent others accessing it – still, it’s a security concern so here’s what to do:

1. Set up page caching so that most requests are served as static HTML – a good caching plugin will mitigate the problem should a botnet attack you. Ideally put a reverse proxy such as Nginx or Varnish in front too.
2. Configure Wordfence to block repeat offenders. There are options to lock out IP addresses if they access more than X pages in less than Y seconds.
3. Install and configure Cloudflare – it absorbs and blocks most denial of service traffic at the edge before it ever reaches your server.
4. Consider installing fail2ban – it operates at a level above WordPress, so it’s even more lightweight on your server and has been mitigating denial of service attacks for years.

A note about installing Cloudflare:

To set up and configure Cloudflare I recommend two plugins. The first is a caching plugin with a Cloudflare add-on (W3 Total Cache still has one) so page rules and cache purging are handled for you. The second is the official Cloudflare plugin. This second plugin doesn’t increase your security, but it does fix problems you’ll otherwise have identifying where users originate from in Google Analytics or Wordfence, because without it every visitor appears to come from a Cloudflare IP address.

Consider using two-factor authentication for ultimate log-in security

If you’ve set up HTTPS, used strong passwords and everything else in the guide above, you’re going to have a really secure site, but for the ultimate in log-in security you should consider using two-factor authentication.

What happens is you log in to your WordPress site using your username and password, then you’re asked for a second one-time code before you’re let in. It’s more secure because an attacker needs your second factor as well as your password. Wordfence offers this option if you decide you want the additional layer.

Summary

I think I’ve covered everything you need to know about WordPress security. If there’s anything you think I’ve missed, or anything you’d like me to elaborate on, let me know in the comments below.

Further reading