Protect Your Website: 8 WordPress Website Security Tips

Key Takeaways

• Your WordPress website contains many different components, and all of those components need to be updated regularly to keep your website secure and functional.
• Ensuring that all the users on your website employ strong, unique passwords adds another layer of security.
• Using Wordfence, you can set up brute force protection rules and rate limiting rules on your WordPress website.

No matter what platform your website is on, such as WordPress, Wix, or Squarespace, website security is extremely important. Ever since the dawn of the internet, there have been hackers and bad actors that want to hack into your website.

However, website attacks have increased exponentially due to AI. Nowadays, hackers can command AI to execute brute force attacks to attempt to break into a website hundreds of times faster than a human can. Plus, using sophisticated VPNs, the hacker can change their IP address they are using to attack the website. 

Throughout our 15+ years in business, we’ve had to remove hacks from several of our client websites. Sometimes, the hacker would redirect the website’s URL to a scammy website. Other times, the hacker would change content on the site. And in other instances, the hacker did nothing but hack into the site and place a file in the main public_html directory that took credit for the hack. But most often than not, the hacker wants to steal a website’s traffic, data, or other information.

One thing we’ve learned through managing security for our client websites is that a WordPress website becomes vulnerable to hacks when either the server or the WordPress code is outdated. Security updates are required to ensure the website is as protected as possible.  

In this article, we will discuss how you can use Wordfence, one of the top trusted security plugins for WordPress.org websites, along with several other website security tips.

The State of WordPress Website Security

According to SQ Magazine, WordPress powers over 43.1% of all the world’s websites, which means that over 810 million websites run on WordPress. Because of this, hackers know to target WordPress websites, themes, and plugins. Just like anything, even the most basic security measures matter for each and every website. To put it plainly, if a website is using a weak password, it has a higher chance of getting hacked into.

There are several ways that hackers get into websites, including plugin vulnerabilities, backdoors, and brute force attacks. As a website manager, there are several things you can do to protect yourself from all of these methods, and one of the most important things you can do is to install Wordfence on your WordPress website. 

What is Wordfence?

The Wordfence plugin has over five million active installs on WordPress websites. They are a leader in security, as they release weekly vulnerability reports, expose known and active threats, and even offer a Bug Bounty Program. Their bounty program allows anyone that finds a plugin vulnerability to report it to Wordfence for a monetary reward. Some users have been awarded thousands of dollars for the vulnerabilities that they find. This incentive program ensures that even the average webmaster can make a difference to help secure WordPress for everyone else. 

At Blue Zenith, we actively install WordFence on all of the websites we build and maintain. We also see Wordfence block dozens upon dozens of attacks per website, and sometimes those attacks happen within a few minutes. By setting up the proper security measures in Wordfence, these attacks can be blocked as soon as they happen.

While Wordfence offers a paid subscription, for most websites, the free version contains everything you require. So you don’t need to pay to keep your site protected, unless you want access to more advanced features, such as country blocking. 

However, not every method to protect your website involves Wordfence. Keeping up with some of the more basic and mundane aspects of your website, like ensuring your plugins are up to date, make a big difference.

Our 8 WordPress Website Security Tips

1. Keep Your Plugins Up To Date

Every single WordPress website uses at least a handful of plugins. From website security plugins like Wordfence to contact forms, popups, ecommerce, website backups, and more, there are thousands of different plugins out there for you to use.

First, it is important to only install trusted plugins. This means plugins that are regularly updated and maintained and have thousands of installs. The number of downloads is important because the more installs, the more trusted that plugin is. If you see that a plugin hasn’t been updated in several months, take that as a warning sign that the plugin may be abandoned. If a plugin is abandoned, then you should find a replacement for it as soon as possible. 

Keep in mind that the WordPress repository of plugins does do its part to remove plugins that have not been updated or that have security vulnerabilities that have not been patched. However, removing a plugin from the repository does not remove it from your website – that is your job as the webmaster. 

For the plugins that you use on your website, ensure that you keep them up to date as regularly as possible. It is also highly advised to backup your website before you update anything on your website, as there are times when updating a plugin can completely break your website. If you backup your site beforehand, then you can always swap back to the previous version quickly. We use UpdraftPlus for our website backups, as they have a way to backup sites before updates directly on the update screen. 

You can also have WordPress automatically update plugins when new updates are pushed out, however, backups may not run in those cases. 

Finally, maintaining your list of plugins is also important. If you no longer use a plugin on your website, you should backup your site and delete the plugin. The more plugins you have, the more chances hackers have to get into your website.

2. Keep Your Website’s Theme Up To Date

In the same vein as your plugins, each WordPress website runs on a theme. Your website’s theme helps to determine the overall look and feel of your website. There are many popular themes out there, and at Blue Zenith, we most often use Divi, but we can also use Elementor and Beaver Builder as well.

No matter what theme you use on your website, you need to ensure that it stays up to date so you don’t miss out on the latest features and security patches. If you don’t keep your theme updated, then it can be another avenue for hackers to get into your website. 

As with your plugins, we highly recommend you backup your website before updating your website’s theme. And, just like with your plugins, you should remove unused themes from your website.

3. Keep WordPress Up To Date

Aside from your plugins and theme, keeping WordPress core up to date is incredibly important. Each new version adds additional features and security measures.

For example, WordPress recently released version 7.0.4, and that update patched multiple security vulnerabilities. Because this version was a security release, WordPress urged all users to update sites immediately. 

If you use SiteGround as your hosting platform, SiteGround can automatically take care of WordPress updates for you. However, it is still important to manually ensure that when your website updates, that your website is still online and nothing is broken.

Quick note on WordPress security updates: WordPress 7.0.3 was released on August 6th and WordPress 7.0.4 was released on August 12th. While it may be concerning that there were two security updates released within a week of each other, this is actually a good sign. By using AI, the WordPress community can now find security vulnerabilities faster than ever. This means that patches will arrive faster which will keep your website secure. The rate in which security updates are released does not mean that WordPress is insecure; again, it means the opposite. 

4. Use The Right Hosting Platform

We use SiteGround as our hosting platform. We have used other platforms in the past, but we have stuck with SiteGround for many years now because of their attention to security. SiteGround actively maintains their hosting platforms and updates them.

There are many hosting platforms out there (we won’t say any names) that do not actively update their hosting platforms. An older hosting platform that is not actively maintained can contain multiple security vulnerabilities, and hackers do take advantage of them if they find them. 

5. Keep PHP Up To Date

PHP stands for Hypertext Preprocessor and is used in many different applications. It takes care of various processes, including sending and receiving cookies, modifying your website’s database, and generating dynamic page content. Basically, your WordPress website requires PHP to function.

PHP is directly related to your website’s hosting platform, as the hosting platform provides the PHP version your websites run on. At the time this post was written, the most current version of PHP is 8.5.9. Each version of PHP is only supported for about four years until it becomes depreciated.

As with your website’s hosting platform, your PHP version must get regularly updated to ensure your website remains stable and secure. If you use Siteground, they can automatically update your website’s PHP whenever the next stable version is made available. 

Once again, keep in mind that updating your website to a newer version of PHP can break your website. If this happens, most of the time you can easily change your PHP version back to what it was. Updating PHP can break your site for various reasons, including plugin conflicts and outdated technologies.

However, the opposite can also be true–if your site is running an older PHP version, then newer plugins and themes may not work properly, and may even break your website. So, keeping all the different components up-to-date is highly important to ensure your website functions smoothly.

6. Prevent Brute Force Attacks

 

As we’ve mentioned, brute force attacks have increased exponentially due to AI and LLMs. The only way to protect your site against these attacks is to use a security plugin like Wordfence.

The screenshot displays the brute force protection rules that we often set up on our client’s WordPress websites. Keeping IP addresses blocked for two months allows us time to analyze what got blocked and if the IP should be permanently blocked. 

Also, by checking the box to immediately lock out invalid usernames, any IP address that attempts to sign in with an unregistered username will be stopped on the spot. However, using VPNs, hackers can instantaneously change their IP address to try again and again.

On a somewhat personal note, we find it very interesting that we’ve seen many of the same usernames be used by hackers on dozens of completely different, unrelated websites. The only relation between these sites is that we manage them. Some of these usernames we’ve seen hackers try and use include crander, matigan, yucaerin, yanz, and bury. Other very common usernames that hackers use during their brute force attempts are admin, root, adminuser, admin1, administrator, and other variations. This is why it is so important to never use the username ‘admin’ on your WordPress website. 

7. Rate Limiting Protection

 

While not as serious as brute force protection, rate limiting is another tool that Wordfence offers. For the most part, rate limiting pertains to bots that crawl your website, which is why many of the legitimate bots are allowlisted in order to bypass these rules. 

However, hitting someone’s website over 960 times per minute is not strictly limited to bots. Rate limiting can help prevent hackers from utilizing Distributed Denial of Service (DDoS) attacks, which can bring down even the largest of websites, including GitHub.

Once again, we provided a screenshot so you can see what rules we set up on our client’s websites to protect them against various attacks.

8. Employ Strong Passwords and 2FA

Our final tip may seem the most simple of them all, but it’s one of the most important. Every user on your website should be employing secure passwords. This means using upper and lowercase letters, numbers, and special characters, and ensuring that the password is not used anywhere else. This means that if you manage a hundred websites, that you have a hundred unique passwords for each of those websites. Also, the length of the password makes a big difference. If you can manage to create a password with sixteen or more digits, then it makes it that much harder for hackers to guess at your password.

Reusing passwords everywhere is unfortunately still a common practice today. And nowadays, anything and everything can get hacked into – your social media accounts, your banking accounts, and even your website. 

So, along with a unique password, Wordfence can help you set up Two-Factor Authentication, whether that means sending a code to your phone or using an authenticator or app. 

You Control Your Website’s Security 

At the end of the day, you control how secure your website and your clients’ websites are. By following our eight tips, we hope you can continue to keep your websites as secure as possible for as long as possible. 

Of course, the internet landscape is changing faster than ever before, which means that hackers are becoming exceedingly clever. What works for security today may not work two years from now. But that’s the nature of the job–we must adapt with the changing of the times. 

If you have any questions on how you can help keep your website secure, feel free to reach out to us.

Disclaimer

This post was not sponsored by Wordfence or any one else. We are simply sharing the tools that we use in the hope that we can help other webmasters better manage and protect their own websites. 

Protect Your Website: Frequently Asked Questions

Will hackers really target my website?

Short Answer: Unfortunately, yes, they will.

Explanation: It doesn’t matter how big, or even how small, your website is. Here at Blue Zenith, we’ve seen hackers attempt to get into every single type of website. So, even if you think of yourself as being too small to be hacked into, that isn’t the case. If it’s on the internet, hackers will try to break into it. 

Why is it so important to keep my WordPress website up-to-date?

Short Answer: Keeping your website up-to-date is extremely important for security and functionality.

Explanation: The internet is always changing and evolving, which means that new features get released and old ones become deprecated. Keeping your website up to date ensures that your website is using the latest technology. This means ensuring your plugins, themes, wordpress version, PHP, and hosting platform all get regularly updated, as outdated technology is easier to hack into. 

What are brute force attacks and how can a hacker use this method to break into my website?

Short Answer: Brute force attacks are when hackers attempt to force entry into your website by trying to guess at your username and password.

Explanation: If a hacker manages to determine a username that is registered to your website, then they will begin to guess at your password. They can do this at a rate of dozens of times per minute by using sophisticated AI tools and VPNs. This is why using a strong password with over sixteen characters is highly recommended.

What does rate limiting mean and why is it important?

Short Answer: Rate limiting lets you limit how many times your website gets hit per minute per user.

Explanation: While employing rate limiting strategies can help deter malicious bots, it can also prevent hackers from executing DDoS attacks on your website. Essentially, rate limiting helps to prevent bad actors from overloading the system’s resources and helps to keep your website online.