How to Secure Your WordPress Website in 2023 (Detailed Tutorial)

Last Updated on August 31, 2023 by Leave a Comment

Editorial Note: We may earn a commission when you visit links on our website.
How to Secure Your WordPress Website in 2023 (Detailed Tutorial)
Blog / WordPress / How to Secure Your WordPress Website in 2023 (Detailed Tutorial)
Play Button

WordPress has become one of the world’s most popular content management systems (CMS), with over 44% of websites built on it. As with any online platform, security should be at the top of your list of concerns. In this post, we’ll examine WordPress security concerns and provide tips on how to keep your WordPress website safe and secure.

Let’s dive in.

Is WordPress Secure?

WordPress.org

For the most part, yes. WordPress developers work hard to maintain the security of their platform through patches and updates occurring regularly. However, since WordPress is built on an open-source framework, hackers can analyze how it’s constructed and frequently develop new ways to gain control of WordPress websites. Because of this, WordPress security is crucial. Knowing the risks associated with using WordPress is important to understand better how to secure your website.

WordPress Security Concerns

When operating a WordPress website, there are several potential risks to be aware of. One of the biggest concerns is hackers. Because WordPress is so popular, it attracts the attention of nefarious actors who attempt to exploit vulnerabilities like outdated plugins or core files to gain unauthorized access to your site. They can employ methods such as backdoors, launching brute force attacks, pharma attacks, denial of service (DoS) attacks, or cross-site scripting (XSS).

If left unresolved, there can be serious consequences, such as malware (malicious code designed to steal your site’s visitor information), forwarding your website to a completely different one, adding content you’re unaware of, Google warnings that can hurt your position in the SERPs, or worse, being unable to log in to your website.

How to Secure Your WordPress Website

The following section will explore best practices to enhance WordPress security to protect your website against potential threats.

Subscribe To Our Youtube Channel

WordPress Security: Choose Good WordPress Hosting

The first step to take is partnering with a good WordPress hosting company. With so many choices available, it can be difficult to determine how to choose the right host. If you’re a beginner, it’s probably best to opt for a good managed hosting provider, such as SiteGround, that will provide all security updates for WordPress, while also maintaining the server it’s installed on. For those who are more tech-savvy, a cloud hosting provider, such as Cloudways, is an excellent choice.

SiteGround WordPress hosting

Either option will give you all the tools you need to ensure your website is safe and secure, including:

Keep Your WordPress Login Secure

Another easy thing you can do to boost your WordPress security is to lock down your login credentials. This can be done in several ways, including using a plugin to change the login URL from /wp-admin to something of your choosing. You can also add two-factor authentication (2FA) to your login and limit login attempts, which will help repel bots.

Google apps login

Another way to protect your login is by linking it to your Google account using the Google Apps Login for WordPress. Once your login is locked down, you should whitelist your users’ IP addresses. This ensures that only registered users can get in, even if they have managed to figure out your password.

Use a Suite of WordPress Security Plugins

Another very useful thing you can do is to install a good security plugin, such as iThemes Security. It will allow you to add 2FA, limit login attempts, schedule backups, and hide your WordPress login.

ithemes security plugin

In addition to a WordPress security plugin, consider installing a good backup plugin, like UpdraftPlus, if your host doesn’t offer backups. A backup plugin protects you from losing your site’s files, helping you to avoid rebuilding WordPress from scratch. You can easily restore your site with little effort if something goes wrong. Finally, incorporating an activity log plugin like WP Activity Log will allow you to pinpoint what went wrong and when.

Keep PHP Updated

WordPress requires three things to work correctly: PHP, MySQL, and HTTPS support. PHP, or hypertext preprocessor, is a popular open-source scripting language used in web development and is the backbone of WP. Like WordPress, being open source leaves it open for malicious actors looking to take advantage. To avoid these potential issues, it’s best to keep PHP updated. Not only does it help with WordPress security, but it also keeps your site running optimally.

How PHP works

Choose Strong Passwords

One of the most important aspects of WordPress security is choosing strong passwords for login. Weak or easily guessable passwords leave your site vulnerable to unauthorized access and expose your site to botnets. Botnets are a collection of computers that have been infected by malware and come under the control of a hacker. They are the leading cause of DDoS attacks on the internet, but you can prevent your site from falling victim to them by taking the correct precautions.

Password policy maker plugin

For example, you can protect your site by ensuring all users adhere to a password policy. One great way to do this is by installing a plugin like Password Policy Maker.

WordPress Security: Keep Software Updated

Another simple step in WordPress security is keeping your WordPress core, plugins, and themes updated. Leaving software out of date can have negative consequences on your website, including security breaches, the WordPress white screen of death, or any number of common errors.

You can either keep up with updates on your own or enable automatic updates. What is right for you depends on several factors, including time, expertise, and the type of software your WordPress install runs. Regardless of whether you handle updates or choose to update automatically, you should always make a backup before performing any updates.

Install SSL Certificate

If you partner with a good hosting provider, one of the benefits that come with it is a free SSL certificate. However, there may be situations where you’ll need to install one yourself. Most providers, like SiteGround, offer a free SSL that installs in a few minutes. As you read this, you might ask , “Why do I need an SSL certificate?”. Let’s explain.

SSL certificate WordPress security

image courtesy of Valery Brozhinsky | Shutterstock.com

SSL, or secure socket layer, expands the hypertext transfer protocol (HTTP) to hypertext transfer protocol secure (HTTPS), adding encryption and an extra layer of security. For example, a consumer who makes a purchase over HTTP risks their credit card information being exploited. On the other hand, their information would be protected if they had made the same purchase over HTTPS. Your site and its visitors are exposed and vulnerable without that secure connection. That’s why installing an SSL certificate on any new website is crucial.

Conduct a Security Audit

Once you’ve taken steps to secure your site, it’s important to conduct a WordPress security audit occasionally. Just as technology changes daily, so does a hacker’s arsenal of tools. Malware and other tactics are developed regularly, so securing your WordPress website isn’t a one-and-done deal. Schedule regular security checks, and look for signs that your site may be in trouble. If you notice your site loading slowly, your traffic drops, you discover new links you didn’t add, or you experience excessive login attempts, it may be time to run a security scan to ensure your site remains safe and secure.

Advanced WordPress Security Techniques

In addition to the steps listed above, there are a few more advanced techniques to incorporate into your site to enhance WordPress security.

Harden the wp-config.php File

One common point of entry for hackers is your WordPress website’s wp-config.php file. It houses information about your database, including the name, host, username, and password. Leaving this important file open can prove detrimental, so hiding it is always a good idea.

Move Your wp-config.php File

To move wp-config, you can drag it into your site’s root folder (public HTML), and WordPress will look for it whenever the site is pinged. However, if your site’s file structure includes a htaccess file, you can further protect it by adding a directive to deny access to it by using the following code:

<FilesMatch "wp-config/.php">
Require all denied
</FilesMatch">

Note: Before doing this, ensure your hosting provider hasn’t already taken steps to move your wp-config file for you. Some hosts, such as Kinsta, do this automatically to keep your site safe.

Change WordPress Salt Keys

WordPress salt keys

Another way to protect your wp-config file is by altering your site’s salt keys. These keys add an extra layer of protection while saving passwords to your database, signing in to cookies, and other important WordPress security aspects. If hackers can obtain your salt keys, they can access your site’s database and files, including stored credit card information, passwords, and other important information. Therefore, it’s recommended to change them periodically.

Change File Permissions

By default, files in your root directory are set to 644, which means they are both readable and writable, leaving them vulnerable to bad actors. According to WordPress, these should not be left at default permissions. Rather, they should be changed to 440 or 400 to prevent others on the same server from reading them. However, it’s important to check with your hosting provider before making any changes to your file permissions. They may have a unique system in place, so changing permissions could cause disruption to your site.

Disable XML-RPC

XML-RPC is a WordPress API that allows you to connect your website to third-party apps and tools. In recent years, it has been exploited by brute force attacks, allowing access to WordPress sites. It is primarily used for making Zapier connections or accessing your site remotely through an app. You should disable XML-RPC on your server if you aren’t using any of these connections.

There are several ways to do this, including disabling it through htaccess, using a code snippet, or with a plugin. The most advanced method, htaccess, can be tricky for beginners, so the most recommended approach is to use a code snippet.

For the htaccess method, use an FTP client to access your site’s files, then add the following code to your htaccess file:

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny, allow
 deny from all
allow from 123.123.123.123
</Files>

Note: Be sure to change the IP 123.123.123.123 with your own.

Alternatively, you can use the AIOSEO plugin’s tools htaccess tab to insert the code:

AIOSEO

If you’d rather disable XML-PRC using a code snippet, you can easily accomplish it using the WPCode plugin. It has a built-in snippet that you can use to disable the API.

disable XML-PRC

Hide WordPress Version

This is an often overlooked step when it comes to WordPress security, but an important one. By default, WordPress leaves a footprint in your site’s code that shows which version is installed. This might seem harmless, but by accessing the website’s source code, hackers can determine what version of WordPress you’re running. If it’s outdated, they can use that info to hack into your site by injecting malware or malicious scripts.

hide WordPress version

So, as an extra WordPress security measure, hide your site’s WordPress version to make it harder for hackers to take control of your site. There are good ways to do this. You can either implement a code snippet plugin that will remove the line in the source code or create a child theme and place it into your functions.php file.

function elegantthemes_remove_version() {
return '';
}
add_filter('the_generator', 'elegantthemes_remove_version');

Alternatively, if you’d like to remove the WP version in the meta tag, in database query strings, and in RSS feeds, use this code:

/* Hide WP version strings from scripts and styles
* @return {string} $src
* @filter script_loader_src
* @filter style_loader_src
*/
function elegantthemes_remove_wp_version_strings( $src ) {
global $wp_version;
parse_str(parse_url($src, PHP_URL_QUERY), $query);
if ( !empty($query['ver']) && $query['ver'] === $wp_version ) {
$src = remove_query_arg('ver', $src);
}
return $src;
}
add_filter( 'script_loader_src', 'elegantthemes_remove_wp_version_strings' );
add_filter( 'style_loader_src', 'elegantthemes_remove_wp_version_strings' );
 
/* Hide WP version strings from generator meta tag */
function wordpress_remove_version() {
return '';
}
add_filter('the_generator', 'elegantthemes_remove_version');

What to Do if Your WordPress Website is Hacked

Even if you do everything right, you may find yourself in a situation where your website has been hacked. Thankfully, there are steps you can take, including putting your site into recovery mode, restoring from your most recent backup, or resetting your passwords. If all else fails, your hosting provider may be able to help.

Final Thoughts on WordPress Security

By taking the necessary steps to boost your WordPress security, you can ensure your site continues to operate normally while being safe for your visitors. While WordPress offers tremendous benefits and ease of use, it’s important to understand its shortcomings. Thankfully, there are a number of WordPress security plugins like iThemes that can help keep things on track.

Looking for more information on WordPress? Check out some of our in-depth articles that will transform you into a WordPress expert in no time:

Frequently Asked Questions (FAQs)

Before we wrap up, let’s answer some of your most common questions about securing your WordPress website. Did we miss one? Leave a question below and we will respond!

How secure is WordPress?
WordPress is generally secure if you keep it updated with the latest security patches and plugins. However, it's not 100% foolproof and can be vulnerable to attacks if you don't take proper precautions, such as using strong passwords, limiting login attempts, and installing security plugins.
Why do I need to secure WordPress?
You must secure WordPress to protect your website from potential security threats like hacking, malware, and data breaches. Failure to do so can result in losing sensitive information, damage your reputation, and negatively impact your website's performance.
How can I secure my WordPress site?
To secure your WordPress site, keep your themes and plugins updated, use strong and unique passwords, limit login attempts, use a security plugin like iThemes Security, enable two-factor authentication, and regularly back up your site. Additionally, consider using a web application firewall like Cloudflare or Sucuri and choose a reliable hosting provider.
What are the most common WordPress security vulnerabilities?
The most common WordPress security vulnerabilities include weak passwords, outdated software, vulnerable plugins and themes, SQL injection attacks, cross-site scripting (XSS) attacks, and file inclusion exploits. These vulnerabilities can allow hackers to gain unauthorized access, steal sensitive data, inject malicious code, and take control of the website.
Are older versions of WordPress easier to hack?
Older versions of WordPress are easier to hack because they may contain security vulnerabilities discovered and exploited by hackers. These vulnerabilities may not have been patched in older versions, leaving them open to attack. It is essential to keep WordPress up-to-date with the latest security patches to minimize the risk of a successful hack.
What are the best WordPress security plugins?
The best WordPress security plugins include Wordfence, Sucuri, and iThemes Security offer malware scanning, firewall protection, two-factor authentication, login security, and more. You can check out our complete comparison here. It is recommended to use these plugins along with regular WordPress updates and backups to ensure maximum security for your website.
Can a WordPress site be hacked?
Yes, a WordPress site can be hacked due to vulnerabilities in outdated software/plugins/themes, weak passwords, and a lack of security measures. Hackers can gain unauthorized access to a site and inject malicious code, steal sensitive information, or take complete control of the site.
What percentage of WordPress sites are hacked?
It is difficult to determine the exact percentage of hacked WordPress sites, as it varies depending on the security measures each site owner takes. However, studies have shown that at least 4.3% of websites, or 1 in every 25 websites, have been hacked at some point in 2021.
Why do hackers target WordPress?
Hackers target WordPress because it is one of the most popular website platforms in the world, making it a prime target. Many WordPress sites are not adequately secured or updated, leaving them vulnerable to attacks. Hackers can exploit these vulnerabilities to access sensitive information, inject malware, or perform other malicious activities.
How do I prevent malware on WordPress?
To prevent malware on WordPress, it is important to keep your site and plugins updated, use strong passwords, limit login attempts, install security plugins like iThemes Security, and avoid downloading and installing plugins or themes from untrusted sources. Additionally, regularly scan your website for any malware or vulnerabilities and backup your site on a regular basis.

Featured Image via Pikovit / shutterstock.com

Top Picks
Product Image

Get Started With SiteGround!

Explore plans, pricing and features. Click here to get started. 👇

Visit SiteGround

Get Started With SiteGround!

Explore plans, pricing and features here. 👇

Explore SiteGround
Premade Layouts

Check Out These Related Posts

8 Best WordPress Chatbots for your Website in 2023

8 Best WordPress Chatbots for your Website in 2023

Posted on September 27, 2023 in WordPress

WordPress users have always wanted the most out of the platform. Adding chatbots to a website is one of the easiest ways to make it more engaging and helpful. And nowadays, creating, training, and rolling out a chatbot is easier than ever. We’ve sifted through the best WordPress chatbots for...

View Full Post
How to Make Your Own AI: A Beginner’s Guide (2023)

How to Make Your Own AI: A Beginner’s Guide (2023)

Posted on September 25, 2023 in Business

There are many reasons why you may want to make your own AI assistant or Chatbot. Perhaps you wish to create a virtual “second brain” to quickly access stored information. Alternatively, you could aim to assist website visitors or customers in finding the information they seek. You...

View Full Post
3 Best WordPress AI Page Builders in 2023 (Compared)

3 Best WordPress AI Page Builders in 2023 (Compared)

Posted on September 22, 2023 in WordPress

With the rapid advancement of WordPress page builders and the integration of AI technology, creating stunning websites has never been easier. By harnessing the power of generative artificial intelligence (AI), users can now experience AI within a drag-and-drop builder. AI page builders are...

View Full Post

Leave A Reply

Comments are reviewed and must adhere to our comments policy.

Get Started With Divi