WordPress is the world’s most widely used content management system, which is why it is the main target of automated attacks. Most breaches are not targeted: bots search for weak passwords and known, unpatched security vulnerabilities. The steps below will protect you against these.

1. Updates

Most hacks occur through known vulnerabilities in outdated plugins or themes. Keep your WordPress core, theme and all plugins up to date; enable automatic updates for security patches – see the article on automatic plugin updates for more information. Do not just deactivate unused plugins and themes – delete them as well, because even when deactivated they remain on your hosting server and their vulnerabilities can still be exploited.

2. Strong passwords, unique usernames

Do not use the username ‘admin’, and set a long, unique password for each account, which you should store in a password manager. Our separate article provides more details on secure passwords.

3. Two-factor authentication

With a plugin that provides two-factor authentication (such as Two Factor or Wordfence Login Security), a password alone is not sufficient to log in. You should enable this for administrator accounts at the very least.

4. Limiting login attempts

You can use a plugin to limit the number of failed login attempts, so that brute-force attacks are unsuccessful. The security software running on the hosting server also blocks accounts after too many failed login attempts; in such cases, the article on IP blocking via the firewall will be of help.

5. Permissions

Everyone should be given only the rights they need: a content writer should be an ‘Author’ or an ‘Editor’, not an ‘Administrator’. Review the list of users from time to time and delete any accounts that are no longer in use.

6. Settings in wp-config.php

• Disabling file editing: the line define('DISALLOW_FILE_EDIT', true); disables the editing of template and extension files via the admin interface, meaning that a stolen admin password cannot be used to directly inject malicious code.
• File permissions: folders should typically be set to 755, files to 644, whilst wp-config.php should have stricter permissions, such as 600 or 640; see the article explaining file permissions (chmod, chown).
• Security keys: if you suspect a breach, replace the keys in wp-config.php (AUTH_KEY and related keys) using the WordPress key generator; this will log out all logged-in users.

7. XML-RPC

The xmlrpc.php interface is now used by very few applications, but it is a common target for attacks. If you do not use a service that requires it (such as certain Jetpack features or an old mobile app), disable it using a security plugin or via the WP Toolkit.

8. Only from reliable sources

Never install a ‘nulled’ template or plugin, as these often contain hidden malware; see: why ‘nulled’ templates and plugins are dangerous.

9. HTTPS and backups

The site must be fully HTTPS-enabled and have a recent, restorable backup: if everything else fails, it can be restored from this.

On aWh’s hosting plans

On our cPanel servers, ImunifyAV+ monitors files and flags malware. The ‘Security’ menu item in WP Toolkit carries out some of the above settings with a single click (such as disabling file editing or XML-RPC); this is covered in the article on WP Toolkit’s default settings. A detailed checklist can be found on our blog: WordPress security: a practical checklist.