WordPress Security
Don’t use “Admin” as your administrator username
For WordPress admin users “Admin” is the most common username. Hackers knows this very well. To make their life a more complicated, you should use any other username not “admin” and pick one with capital letters.
Strong Password
Some random strings of letters and numbers is sufficient to have strong password. If you are unsure of manual passwords, you can use Strong Password Generator or Norton Password Generator.
Keep WordPress up-to-date
The important thing is that you update WordPress regularly. Information about any security holes that were fixed from the previous version are now available to the public, which means an out of date site is all the more vulnerable. Whenever you login to the dashboard and see “Update Available”, click it and update your WordPress.
Change the WordPress database table prefix
If you have installed WordPress with “wp-” table prefix that is used by the WordPress database then I recommend you to change it to something unique.
Add two-step authentication
To prevent vulnerable attacks on website you can always set two-step verification. This can oftenly be in the form of something you know or something you have like string of numbers. Google, Dropbox or many other services provide you with the possibility to use this more secure way to login.
Also you can have setup like you enter password along with authentication code. This authentication code you can have sent on your phone in order to login to website.
Eliminate plug-in or theme editor
The easiest way to change your files would be to go to Appearance > Editor. To lift your WordPress security you can always disable writing of these files via Editor. Open wp-config.php and add below code in file:
define(‘DISALLOW_FILE_EDIT’, true);
You will also edit your templates outside editor and upload via FTP, you just won’t be able to do it via WordPress.
Install WordPress backup solution
Backups are most important to keep in case of any brutal attack on WordPress website. Backups allow you to quickly restore your WordPress site in case something bad has happened.
There are many free and paid WordPress Backup Plug-ins that you can use. The most important thing you need to know when it comes to backups is that you must regularly save full-site backups to a remote location (not your hosting account).
We recommend storing it on a cloud service like Amazon, Dropbox, or private clouds like Stash.
WordPress Security Plug-in
After backups, the next thing we need to do is setup an auditing and monitoring system that keeps track of everything that happens on your website. This includes file integrity monitoring, failed login attempts, malware scanning, etc.
List of best security plug-ins available for WordPress are:
Signup for Product Update
