WordPress security & hardening, the definitive guide

WordPress is massively popular. Around every one in five sites on the Internet uses WordPress in some form. Be that to run a humble blog, or a multi-site Content Management System (CMS) or e-commerce site. As a result, it is no surprise that WordPress websites are a very popular target for both experienced hackers and script-kiddies alike. Hardening wordpress

The last thing any webmaster wants is to find out that their website has been hacked; maybe taken hostage and is part of a botnet, spreading malware, or partaking in Denial of Service (DoS) attacks. In this article we’ll be sharing a number of tips and strategies to help you harden your WordPress website.

Is WordPress secure?

This is a question many system administrators ask, and rightfully so. While WordPress is overall well-built and secure, it has a reputation for being prone to security vulnerabilities and not being “enterprise-grade”. That reputation is not exactly fair. More often than not, issues lie in WordPress being an incredibly popular software package which is easy to set up while taking security shortcuts. Which brings us to our first topic — plugins and themes.

Plugins and themes

The number one issue which plagues WordPress security is also what makes it incredibly popular. WordPress plugins and themes vary far and wide in terms of quality and safety. While a lot of work has been done by the WordPress team to help developers build more secure plugins and themes, they still remain a security nightmare. This can be noticed when using poorly maintained plugins, or plugins obtained from a sketchy source.

Before we continue discussing WordPress plugins and themes, let’s first understand what a WordPress plugin actually is. Plugins are simply custom PHP code that WordPress runs in order to extend WordPress’s functionality. For a more detailed and technical explanation refer to What are WordPress plugins.

Similarly, WordPress themes allow for the customization of the visual aspects of your WordPress site. From an attacker’s perspective, there is very little difference between the two since both can be abused to run malicious code.

Run less software

So how can you tell if a plugin is malicious or not? That’s a complicated question, but fortunately we have an answer for you. We have written about this in detail in how to choose the best WordPress plugin for your WordPress website.

Even though you make all the necessary research, there are also chances that the plugin might still be a security threat. So one of the ways to reduce your risk is to only run the software you absolutely need and trust. Before installing a new WordPress plugin ask yourself if you really need to install that plugin. Can a small code snippet in a site-specific plugin do the trick, or do you legitimately need a fully blown plugin?

Important — be very vigilant with code snippets you find on the Internet. Never use a piece of code unless you fully understand what it’s doing — just because it’s on StackOverflow, it doesn’t mean it’s safe to use.

If you have a genuine need to run a plugin, make sure it’s actively maintained and regularly updated as we explain in our guide. As a rule of thumb, the more downloads and recent updates the plugin or theme has indicates that it is in wide use and that it is being actively maintained by its authors. This does not mean that the plugin will never have a vulnerability. However, if a vulnerability is found, the developer will act quickly and issue a fix quickly.

Try to avoid plugins which don’t have many downloads and critically, do not have an active community and regular updates. If something hasn’t received an update within a year, it’s generally a red flag.

                               Call +1-857-342-2365 for help and support of Hardening WordPress.