Securing a WordPress website involves several steps to protect against vulnerabilities and potential attacks. The desire to invest in building a website is as important as securing the website. Each day, hundreds of thousands of websites are attacked and it has become necessary to deliberately develop a strategy to curtail the devastating consequences of website attack. So website security becomes a priority that must be invested in.

As of 2024, WordPress powers approximately 43% of all websites on the internet, translating to about 64% of the Content Management System (CMS), and that translates to over 30 million live websites belonging to major brands and media outlets. You’ll find this article very useful – WordPress: Code Is Poetry.

In another article, Why Website Security Is Important, we have dealt extensively with website security and why it is important for you secure your website, and it will be a good companion to this piece.

Meanwhile, here’s a comprehensive, but not exhaustive guide to help you enhance your WordPress site’s security:

1. Keep WordPress Updated

• Core Updates: Always update to the latest WordPress core version as they are released.
• Plugins and Themes: Regularly update all plugins and themes to their latest versions. Most times developers of plugins and theme coordinate their updates with major WordPress releases. Never used hacked themes and plugins, they are security time-bombs, and remove unused plugins and themes.

2. Use Strong Passwords and Usernames

• Admin Username: Be creative about your username and avoid using the default ‘admin’ username.
• Strong Passwords: Use complex passwords combining letters, numbers, and special characters. 12345 is not a password, so avoid a combination that can be easily guessed.
• Password Managers: You may consider using a password manager to create and store strong passwords.

3. Install Security Plugins

• Jetpack: Helps with brute force protection, malware attacks and when combined with Akismet can help safeguard your websites from spamming.
• Wordfence: Provides firewall protection, malware scanning, and login security.
• iThemes Security: Offers brute force protection, file change detection, and database backups.
• Sucuri: Offers a comprehensive suite including malware removal, firewall protection, and security audits.

4. Use a Secure Hosting Provider

• Reputable Hosts: Choose hosting providers known for strong security practices.
• Server-level Security: Ensure the host provides firewalls, regular malware scanning, and automatic backups.

5. Implement Two-Factor Authentication (2FA)

• 2FA Plugins: Use plugins like Google Authenticator or Two Factor Authentication to add an extra layer of security.

6. Secure Your Login Page

• Login URL: Change the default login URL from /wp-admin to something unique using plugins like WPS Hide Login.
• Login Attempts: Limit login attempts with plugins like Limit Login Attempts Reloaded.
• CAPTCHA: Add CAPTCHA verification to the login page to prevent automated login attempts.

7. Regular Backups

• Backup Plugins: Use plugins like Backuply, UpdraftPlus, BackupBuddy, or VaultPress to create regular backups. This is a life-saver in case of losing your data to devastating attacks.
• Offsite Storage: Store backups in remote locations like cloud storage (e.g. Google Drive, Dropbox, and other third-party facilities).

8. Secure wp-config.php

• Move wp-config.php: Move the wp-config.php file to a non-public directory.
• File Permissions: Set proper file permissions (e.g., 400 or 440) for wp-config.php to restrict access.

9. Disable File Editing

• Dashboard Editing: Disable the file editor in the WordPress dashboard to prevent unauthorized changes.

  // Add this line to the wp-config.php file
  define('DISALLOW_FILE_EDIT', true);

10. Use HTTPS

• SSL Certificate: Install an SSL certificate to encrypt data transmitted between your server and users’ browsers. Let’s Encrypt SSL is a free encryptor that are usually integrated by many host servers.
• Force HTTPS: If need be, you may need to use plugins like Really Simple SSL to force HTTPS across your site.

11. Monitor Activity and Logs

• Activity Logs: Use plugins like WP Activity Log to monitor and log user activities.
• Audit Logs: Regularly review logs for suspicious activities.

12. Restrict Access

• IP Whitelisting: Restrict access to the admin area by whitelisting trusted IP addresses.
• Disable Directory Indexing: Prevent directory browsing by adding the following line to your .htaccess file:

  Options -Indexes

13. Database Security

• Change Database Prefix: Change the default table prefix (wp_) to something unique.
• Secure Database Credentials: Use strong database usernames and passwords.

14. Regular Security Scans

• Online Tools: Use online security scanning tools like Sucuri SiteCheck or WPScan to scan your website.
• Scheduled Backend Scans: Set up regular scans with your security plugins.

By following these steps, you can significantly enhance the security of your WordPress website, protecting it from common threats and vulnerabilities. There are free versions of some of the plugins mentioned but depending on the value of your website content, you may need to subscribe to the premium version for enhanced features.