HOWEVER. A thing that no one can ignore is the fact that WordPress is often a victim of (brutal) hack attacks<\/strong>.<\/p>\n\n\n\n If you have been a true WP follower, lover and an active member in the community, then you know that one of the ways WordPress managed to overcome security challenges was by making security updates go automatically. But, that was not merely enough.<\/p>\n\n\n\n The bad news is that even nowadays WordPress sites are still not completely hacker-proof<\/strong>.<\/p>\n\n\n\n Yes, unfortunately, all WordPress sites are vulnerable and prone to security breaches. Random hack attacks happen all the time! And there are multiple reasons for that. A security breach can occur due to a vulnerability in a hosting provider or theme or just because you used weak login information.<\/p>\n\n\n\n So, to make sure your newly-built website has what it takes to scare the hackers away, you need a bit more than trusting the platform to do all the work by itself. Did you know that, according to Wpplugins.tips<\/a>, 41% of sites were hacked through a security vulnerability on their hosting platforms? Yes, you have read that right! Almost half of all the WP sites had security breaches thanks to their hosting providers.<\/p>\n\n\n\n As you can see, a hosting company can affect your chances of going under a hacker attack. If you don\u2019t want to gamble, we suggest you check out our article on how to choose the right hosting provider<\/a>. Some of the most critical factors you need to have in mind when picking a hosting company are:<\/p>\n\n\n\n There are thousands and thousands of WordPress themes. In this sea of templates, it can get hard to choose the right one for your business.<\/p>\n\n\n\n That is why we wrote an article that explains the steps of picking the right WordPress theme<\/a> that will make your competitors jealous.<\/p>\n\n\n\n But, aside from those tips, we also have one or two more.<\/p>\n\n\n\n If you have read the article, you might remember that we mentioned you should ALWAYS check for the theme\u2019s support<\/strong>. Not only will quality support help you solve all the potentials bugs and glitches, but they will also keep your theme updated. And you already know that having an updated theme means that you don\u2019t have to deal with security holes. This is one of the quickest WordPress security tips, for sure.<\/p>\n\n\n\n Although it may seem intimidating, this is one of the quickest tips from our list of WordPress security tips. Why should you do it straight away? Because a click on that \u201cUpdate Now\u201d button means that you are going to get a new WP version and with every new release comes improved security<\/strong>. Guys behind WordPress take care of all security vulnerabilities and bugs with each new version that comes out.<\/p>\n\n\n\n Just like you would update WordPress, you should update all your plugins. All you need to do is go to the Plugins <\/em>section in your Dashboard, then Installed Plugins<\/em> and check them all. If a particular plugin should be updated, WordPress will let you know. Also, if there is a plugin you don\u2019t use often or don\u2019t use at all, be sure to uninstall it \u4e00 there is no need for plugins to lay around and weigh down your website<\/strong>.<\/p>\n\n\n\n Keep in mind that having too many of these tools can actually lower your security level.<\/p>\n\n\n\n Sometimes, WordPress security tips are not just about updates and being tech-savvy. So, be careful. Even if you trust the people that are helping you build a business, keep in mind that WordPress offers six user roles for a good reason. Check out our WordPress vs. Joomla vs. Drupal article<\/a> to get to know user roles a bit better.<\/p>\n\n\n\n This is one of the quickest WordPress security tips out there.<\/p>\n\n\n\n A login URL is the one you use when you want to log into your admin dashboard. You know, the \/wp-login.php or \/wp-admin part of the URL? Adding a security question or two in the login screen is one of the WordPress security tips that will make any hacking attempt fail miserably.<\/p>\n\n\n\n Security questions are the ones you can add to your login screen to answer each time you want to log in. The best thing about them is that you can be creative with the questions. For example, you can add questions like Who is your favorite superhero?<\/em> or What was the name of your imaginary friend?. <\/em>Literally, any question only you or a handful of people can answer<\/strong>. These questions will act as additional security guards.<\/p>\n\n\n\n You can add these security questions by installing and activating the WP Security Question plugin<\/a> and configuring the settings. If you got lost somewhere in the middle, we would advise you to read this article on Wpbeginner.com<\/a>.<\/p>\n\n\n\n As you might know, by default, WordPress users can log in as many times as they want which represents a significant security vulnerability. So, how can you limit the number of login attempts? To do so, all you need is the right plugin. Install the Login LockDown plugin<\/a>, then choose Settings<\/em> and Login Lockdown Options<\/em> and decide how many attempts a user can have.<\/p>\n\n\n\n While we are on the topic of logging in, it\u2019s a good idea to mention inactive users. If you want to log out inactive users automatically, all you need to do is install and activate the Inactive Logout<\/a> plugin. The plugin is very intuitive, we are sure you won\u2019t have any issues setting up all the parameters.<\/p>\n\n\n\n Well, this is one of the most apparent WordPress security tips!<\/p>\n\n\n\n Just like you change your Instagram or Facebook password from time to time, you should remember to change the one you use to login to your website. We recommend you to do this step at least four times a year<\/strong>. Let\u2019s talk about one of the WordPress security tips, you probably never thought about doing. So, instead of showing a default error message, change into something like \u201cWrong! Try again, doll!\u201d<\/strong>. The most important thing is that the error message doesn\u2019t specify what the problem is.<\/p>\n\n\n\n To do this step, use the code snippet down below and place it in your functions.php file. For, example, you can add:<\/p>\n\n\n\n If all of these WordPress security tips seem Additionally, when it comes to backup, there is one more thing you should know. We would highly suggest you save full site backups not only to your hosting account but also to some remote location, a cloud service<\/strong>, like Amazon or Dropbox. By doing this step, you will make sure all the website data is secure and placed somewhere hackers won\u2019t care to look for. A firewall is, as you might know, a security tool that will help your site protect from viruses, malware, and hack attacks. That is why it is essential to have a tool that will scan your site daily<\/strong> and make sure you are protected 365 days a year.<\/p>\n\n\n\n When it comes to installing a firewall on your site, we would advise you to check iThemes Security<\/a> plugin. This plugin will scan your site for malware automatically, each day and if a problem occurs, an email will be sent to you with the details. This plugin also offers two-factor authentication (an authorization code that is sent to your mobile phone which allows you to log into your site), password security, password expiration, Google reCAPTCHA and many more. If you have invested in a premium WordPress theme, you might be looking for a way to minimize additional costs, and that is perfectly understandable. But, choosing the plugins is not the place to be cheap. Remember that all those sites that offer free premium plugins are probably illegal and that you are considering downloading something from an illegal website. How do you think that is going to go? Not well!<\/p>\n\n\n\n The wp-config.php file is the one file that contains all the information related to your WordPress installation. Since it is one of the most vital files of your site, you need to make sure you protect it from hackers. And that\u2019s it!<\/p>\n\n\n\n Well, we had to include one more, which will take a bit more than 10 minutes to complete. Fifteen minutes tops.<\/p>\n\n\n\n
In the following text, we are going to name all the steps you should take to protect your WP site<\/strong>. We promise that all of the mentioned WordPress security tips you can set up or do in 10 minutes or so, without making (significant) changes in the code:
Disclaimer: Themes Kingdom team is not affiliated with any of the mentioned plugins nor do we earn a commission if you end up purchasing any of the tools through referral links in this blog post. We merely wanted to name some services that can help you protect your WordPress website.<\/em><\/p>\n\n\n\nTip 1: Find a good hosting provider<\/h2>\n\n\n\n
Tip 2: Carefully choose the right WordPress theme<\/h2>\n\n\n\n
Tip 3: Update your WordPress regularly<\/h2>\n\n\n\n
As soon as you see an announcement that the new WP version is available (in the top portion of your Dashboard panel), update your website that second.<\/p>\n\n\n\nTip 4: Update your plugins<\/h2>\n\n\n\n
Tip 5: Be careful with whom you trust<\/h2>\n\n\n\n
One of the benefits of WordPress is the fact that many users can manage a site. Unfortunately, this is, at the same time, the downside of WordPress. Sure, it takes a village to raise a child (or a website), but in this case, if the village is not careful enough when it comes to security, \u201cthe child\u201d is pretty much doomed.<\/p>\n\n\n\n![\"You](\"https:\/\/acqo.tkdemos.co\/blog\/wp-content\/uploads\/2019\/02\/mulder-trust-no-one-meme-696x522-1.jpg\")
<\/figure>\n\n\n\nTip 6: Rename the login URL<\/h2>\n\n\n\n
Although this is an easy login URL to remember, it\u2019s also the one hackers know a bit too well. So, why wouldn\u2019t you play with their minds a bit? Change this URL to yourwebsite.com\/pokemon-name-you-loved-as-a-kid or whatever suits your personality the best. Guessing a custom login URL<\/strong> is much harder than choosing between the two most commonly used ones.<\/p>\n\n\n\nTip 7: Add security questions<\/h2>\n\n\n\n
Tip 8: Limit the number of login attempts<\/h2>\n\n\n\n
Think about it for a second. Why would any user on your website have the possibility to attempt to log in more than, let\u2019s say, three times? If users know their usernames and passwords, they are probably not going to be that reckless to make mistakes more than 3 times<\/strong>.<\/p>\n\n\n\nTip 9: Log out inactive users<\/h2>\n\n\n\n
It\u2019s not uncommon that a user logs in, spends some time on a website and wanders off to do read a post, watch a video or do something similar in another tab. There\u2019s nothing wrong with that, except the fact that it\u2019s much easier to hack into an active user account<\/strong> and that is why you should think about limiting the time inactive users spend on your website.<\/p>\n\n\n\nTip 10: Change your password often<\/h2>\n\n\n\n
Bonus tip: A strong password is between 10 and 15 characters long and includes numbers, capital letters, and symbols. If you are having a hard time coming up with the perfect password, you can always rely on the Strong Password Generator to help you.
Super bonus tip: This tip goes without saying, but be sure not to set your username as Admin. Having \u201cAdmin\u201d as a username makes it unbelievably easy for hackers to log in. If you forgot to do this step during the installation, we would suggest you create a new admin, with a new username, and delete the old one. Or just use the WPVN – Username Changer<\/a> plugin.<\/em><\/p>\n\n\n\nTip 11: Change the login error message<\/h2>\n\n\n\n
If you ever entered a wrong username or password, then you know that WordPress automatically puts out an error message suggesting that the mistake is made either in the password or the username section. If you ask us, that\u2019s TMI that hackers can\u2019t wait to get their hands on.<\/p>\n\n\n\nfunction custom_error_message() {\n global $errors;\n $err_codes = $errors->get_error_codes();\n\n \/\/ Invalid username.\n if ( in_array( 'invalid_username', $err_codes ) ) {\n $error = 'Wrong! Try again, doll!';\n }\n\n \/\/ Incorrect password.\n if ( in_array( 'incorrect_password', $err_codes ) ) {\n $error = 'Wrong! Try again, doll!';\n }\n\n return $error;\n}\n\nadd_filter('login_errors','custom_error_message');<\/code><\/pre>\n\n\n\nTip 12: Do the backup often<\/h2>\n\n\n\n
Backup is the process of saving all your site\u2019s content and data in one place<\/strong>. If a hacker attack occurs \u4e00 God forbid \u4e00 you need to be prepared.<\/p>\n\n\n\n
In the end, all that is left to answer is how often you should do the backup. There is no universal answer to this question, but if we had to mention a number, we would have to say once a day. Thankfully, you don\u2019t have to go through this torture every day by yourself \u4e00 there are plugins like VaultPress<\/a>, BackUpWordPress<\/a> or BackWPUp<\/a> that can help you.<\/p>\n\n\n\nTip 13: Install a firewall on your website<\/h2>\n\n\n\n
Bonus tip: You have might noticed that all of our WordPress themes are Jetpack optimized and there\u2019s a good reason for that. If you really want to boost your security level, we would advise you to do a bit of research on Jetpack<\/a>. You\u2019d be surprised what this tool has to offer! <\/em><\/p>\n\n\n\nTip 14: Don\u2019t be cheap!<\/h2>\n\n\n\n
Never, and we mean NEVER, buy premium plugins for free<\/strong>.<\/p>\n\n\n\nTip 15: Secure the wp-config.php file<\/h2>\n\n\n\n
According to Codex.wordpress.org<\/a>, all you need to protect it is to add the following piece of code in your .htaccess file:<\/p>\n\n\n\n<Files wp-config.php>\n\norder allow,deny\n\ndeny from all\n\n<\/Files><\/code><\/pre>\n\n\n\nBonus Tip: Use the SSL encryption<\/h2>\n\n\n\n