The Ultimate WordPress Security - Step by Step Guide (2022)
Do you want to improve your WordPress security? Read the ultimate WordPress Security guide which contains the top tips and tricks to make your website secured. Learn about the WordPress security best practices, tips and WordPress security plugins that you need to know. How to secure WordPress website from hackers?
For the many pros that come with WordPress websites, one significant con is how easy they can be to hack. If you do not ensure that you have a high level of WordPress website security in place for your site or blog, then you are at risk.
There are ways to make your site significantly more difficult to hack, however.
If a hacker is able to access your site they will likely insert bad-links, steal data, or other various activities that you will want to avoid having to deal with.
To help, we have put together some WordPress security tricks in the following step by step guide which will help you avoid any unwanted guests in your site.
There are ways to make your site significantly more difficult to hack, however.
If a hacker is able to access your site they will likely insert bad-links, steal data, or other various activities that you will want to avoid having to deal with.
To help, we have put together some WordPress security tricks in the following step by step guide which will help you avoid any unwanted guests in your site.
Attacks That Pose A Threat
There is a range of attack styles that your WordPress website security will need to defend, all of which come with a different level of severity. These can include:
- Bruteforce logins: This is a widespread technique that simply tries to log in to your site to take possession of your data and admin
- SPAM: This attack features bots that leave large amounts of comments which you will not be able to remove due to their sheer numbers
- Old plugins: Older versions of WordPress are the most vulnerable
- SQL injection: Not as common but by far the most severe, this attack gives access to sensitive information which the attacker can modify
The good news is, all of these attacks can be prevented. There is also additional protection available from hosting providers which are tailored to a specific CMS.
Step by step WordPress security tricks
Let's look at some things you can implement to ensure that your WordPress website security is up to scratch, all of which can provide some necessary extra layers of protection.
1. Choose a Difficult Password
We'll get the most obvious one out the way first. It seems simple enough, but you would be surprised how many people do not set a very difficult password. A difficult password is one of the best ways to create trouble for a hacker looking to get into your site.
If a hacker does guess your password they will immediately change it and start loading the malware, so make your password as complicated as possible. Include:
- Uppercase letters
- Lower case letters
- Random numbers
2. Updates
As we mentioned earlier, one of the most significant risks can be outdated plugins, as well as WordPress versions. Running the most up-to-date version is the most secure way to prevent malicious attacks as outdated versions of WordPress are far more vulnerable.
Hackers and viruses are constantly evolving and adapting, and version and plugin updates work to combat this. Most security updates are automatic, but significant releases often require a manual update, so keep on top of this and perform the updates when they become available.
3. Logins
Another great hacker prevention trick is limiting login attempts as this makes the task of infiltrating your site much more difficult for spammers with automated software. It would also help if you set your default membership role to Contributor which means people can submit a blog post for review but are unable to publish.
For your logins, however, you can use the Limit Login Attempts plugin which performs the function its name suggests. If you have someone attempt to log in to your account with an "admin," they will be blocked for a certain amount of time after a particular amount of logins that you dictate.
You can also block IP's and run a report to see who is attempting a login that shouldn't be so you can block them.
4. Usernames
The default "admin" username should be changed straight away, if not you have already done half the work for the hackers.
To do this, run the following query in Mysql:
update wp-users set user_login=’newuser’ where user_login=’admin’;
You can also create a new account with admin privileges then delete the original admin account, once you have logged in and tested the new one.
Take note that if you follow this point the "admin" username as mentioned in the last point will also need to change in your login attempt plugin.
5. SSL Certificates
A Secure Socket Layer (SSL) certificate gives you a HTTPS link which means your connection is encrypted and therefore, much safer. This also provides a level of comfort for visitors to your site, especially if you are asking for their information, as it shows you run a secure site.
There is a range of SSL plugins available that can help you with this.
6. WordPress Themes
As you may already have realised, there is no shortage of themes and plugins for your WordPress site, but you may not realise that not all of them are safe. Some themes can contain malicious code or security loopholes which is why you need to be careful when making your selections an only choose trusted themes.
A good way to ensure the theme is safe is by reading the reviews before downloading and only use trusted theme directory sites like MyThemeShop or Elegant Themes.
To really play it safe, only search for themes through the WordPress Free Themes Directory and check the developer’s site. After installing the theme, run a WordPress Exploit Scanner plugin which will ensure there is no suspicious code.
7. Access Settings
You should limit access to the important linking pages of your site.
Use the encrypted passwords of Secure FTP (SFTP) or Secure Shell access (SSH) as opposed to Simple FTP when adding files as this will make things significantly harder for hackers.
Delete your FTP account altogether if you are not using an FTP connection for sharing files, and if you are running your site on Linux, you have the ability to choose who can access which data. Keep your settings relatively locked down, especially for important folders.
Further to this, the folders which contain valuable data should be given a strict privacy setting and unique password. You can do this via the control panel under Security > Password protect directories. This will show you all of your folders, and you can select the ones you deem the most important.
Set a username and password then under security settings check the box “Password Protect this directory.”
8. Site Backup
It is vital that you always have your website backed up. This is handy not only in the case where it may get hacked but also if you are making changes in the software or updating things. Having an original copy website can prove invaluable.
By having all the database and files, you can regenerate your site and recover all the data in the case of hacking which requires you to delete and start fresh. Always ensure that you regularly update the copy of the backup as you make changes to your WordPress site.
Backup your site in the cloud or on your OS but be aware if using email or cloud that getting hacked means they may also get access to these places as well. Check out the sftp programs and find out how cloud file transfers stay secure at GoAnywhere.
9. Using Two Factor Plugins
You can add another layer of security to your WordPress plugins with a range of plugins that will prevent logged in users from making any changes until they have verified via a second factor of authentication.
This involves the user, once having logged in, being emailed a code, different every time, which is validated with a cookie added to the user’s session which removes itself once they have logged out.
10. Database Maintenance
There are some simple changes you can make in your WordPress database to make things more difficult for hackers. For example, the default name of every table will start with wp_, but this can be changed. By making this simple change, you are taking a certain level of information away from the hacker and placing an infinite number of new possibilities in front of them to make it harder for them to gain access.
The name of your database will also have a default ending which can also be changed so decoding it is made tougher. The more unique wording you use in these areas, the harder the shell will be to crack, it's as simple as that.
If You Are Hacked
All of the above advice is preventative, but what happens if the unfortunate occurs and you are hacked? The first thing you should do straight away is an attempt to reset your admin password, and scan your website for malicious content. You can also contact your host for assistance. There are various online services that can help you remove malware and repair any damage.
Any layer of security that you can add to your WordPress site is worthwhile. Your hosting provider has a level of responsibility in the configuration of the server to ensure the necessary security measures are in place, but you also must be diligent and ensure you keep everything up-to-date.
The extra effort you spend securing your website today can save you significant headaches tomorrow!
James Silverwood
He is the digital marketing manager for Perpetual Strategic Services which is the fastest growing Website Design Company in Jeddah . He helps clients grow their web visibility through all aspects of digital marketing.
51 comments
Just check your blog with below URL
https://www.bloggerspice.com/ads.txt
replace bloggerspice.com with your blog URL
just type this code in your browser and if you can see your AdSense publication ID then it is working.
If you can't see the script then go to your blogger dashboard and from Settings -> Search preferences enable the custom Custom ads.txt
sometime it automatically disabled the feature, so you must enable it.
https://uploads.disquscdn.com/images/cd924bf4e08b431bcc0ed471086c7cc2dc61170edeff24146b998f4c132bbd44.png
After https applying ,in robots.txt, it's begain,
Unfortunately there is not any option available to stop the fireworks. But you can control the fireworks speed and color.
Earnings at risk - One or more of your sites does not have an ads.txt file. Fix this now to avoid severe impact to your revenue
If your AdSense email different than blog email then it can be happen. But warning message will vanish within 2 days.
If you are using different email for your adsense then add your blog email into your adsense account as administrator.
From AdSense account dashboard
click Settings -> Access and authorization -> User management
now invite your blog email.
Another thing you can do-----------
remove the previous code and Disable the custom ads.txt
and again add the code and enable the custom ads.txt
wait for 24 hours and see the outcomes.
Google.com, pub-xxxxxxxxxxxxxxxx, DIRECT, f08c47fec0942fa0
Google.com, pub-xxxxxxxxxxxxxxxx, RESELLER, f08c47fec0942fa0
media.net, 8CUC64AF2, DIRECT
rubiconproject.com, 19398, DIRECT, 0bfd66d529a55807
rubiconproject.com, 19398, RESELLER, 0bfd66d529a55807
pubmatic.com, 157599, DIRECT, 5d62403b186f2ace
pubmatic.com, 157599, RESELLER, 5d62403b186f2ace
openx.com, 537100188, RESELLER, 6a698e2ec38604c6
google.com, pub-7439041255533808, RESELLER, f08c47fec0942fa0
districtm.io, 100600, DIRECT
rubiconproject.com, 17054, RESELLER
pubmatic.com, 156181, RESELLER
spotxchange.com, 211156, RESELLER, 7842df1d2fe2db34
spotx.tv, 211156, RESELLER, 7842df1d2fe2db34
http://www.hindikunj.com/ads.txt
https://www.bloggerspice.com/2015/12/improve-your-adsense-ad-unit-loading-speed-by-70-percent.html
add the below script above closing in your theme
first disable and then enable custom ads.txt
let me know the result.
You can see here
www.hindikunj.com
him/her to pay a visit this blog, Keep up the good job.
And i am glad reading your article. But should remark
on some general things, The site style is great, the articles is really nice : D.
Good job, cheers
I want to ask what happens to those with more than one ads partner. For example I use both Adsense and Mgid on my site, Should I add mgid information too?
I'm asking because i saw more than google ID on your ads.txt.
Thanks again.
What is the difference between direct and reseller?
Thanks so much.
Yes you have to add ads.txt code of both ads network. I am using AdSense and media.net so for
AdSense Code------------
google.com, pub-6974692108879141, DIRECT, f08c47fec0942fa0
media.net---------------------
media.net, 8CUC64AF2, DIRECT
rubiconproject.com, 19398, DIRECT, 0bfd66d529a55807
rubiconproject.com, 19398, RESELLER, 0bfd66d529a55807
pubmatic.com, 157599, DIRECT, 5d62403b186f2ace
pubmatic.com, 157599, RESELLER, 5d62403b186f2ace
openx.com, 537100188, RESELLER, 6a698e2ec38604c6
google.com, pub-7439041255533808, RESELLER, f08c47fec0942fa0
districtm.io, 100600, DIRECT
rubiconproject.com, 17054, RESELLER
pubmatic.com, 156181, RESELLER
spotxchange.com, 211156, RESELLER, 7842df1d2fe2db34
spotx.tv, 211156, RESELLER, 7842df1d2fe2db34
To get the magid ads.txt code you have to follow the tutorial from below URL
https://help.mgid.com/ads-txt/
difference between direct and reseller?
1. Direct means that the publisher works directly with the AdSense vendor to sell its inventory.
2. Reseller means tha…
clean and wonderful user pleasant design.
this, like you wrote the book in it or something.
I think that you can do with a few pics to drive the message home a little bit,
but other than that, this is fantastic blog. An excellent read.
I'll definitely be back.
Done.
Please can you show me an example of or how mgid ads.txt looks like?
Ofcourse you can add ads.txt code from other publisher. This is not only applicable for Google AdSense rather if anyone wants to use any ads network they must declare about the direct seller and reseller.
If you are using Blogger Platform then you are allowed to add upto 500 ads.txt code.
If you can see that your ads are generating income then don't worry about alert.
Today seeing your article under google.com, pub -.............................., DIRECT, f08c47fec0942fa0
I added google.com, pub -...................., RESELLER, f08c47fec0942fa0
Did I do it right? what else can happen
Thanks
vaggelis
The code is ok. But the problem is occurring from AdSense. It takes longer time than expectation to detect the ads.txt
Generally it will take 10 to 20 days to detect. So after enabling the ads script don't edit the script.
If you see that your AdSense is generating income then it is ok. Don't worry. Warning banner will disappear automatically.
http://www.bloggerspice.com/ads.txt
if it is working then everything is ok.
You've been helpful.
Do you have any idea what it can do?
thanks
on 4th June 2019 I have changed my Ads.txt for removing others ads network's ads.txt code. After that the warning message become visible in my AdSense account.
Today is 16th June 2019 and the warning message disappeared. So in my case it has taken almost 22 days.
Just check your https://www.bloggerspice.com/ads.txt script. It it is showing then warning message will disappear soon.
AdSense earnings varies on blog Niche and keywords. To increase income write long article and tailor with high CPC keywords.
You can check the blog nice based AdSense's probable income by visiting
https://www.google.com/adsense/start/ page.
Thank you.
https://uploads.disquscdn.com/images/c2894fe22a92a42d062373395ed8e098978b7e239396fbaf5ab8ccddeed59418.jpg
thanks admin
The issue is an issue that not enough people are speaking intelligently about.
Now i'm very happy I came across this in my search
for something relating to this.
since I was looking for thoughts on this issue last Sunday.
some more. I am taking your feeds also
we all know media is a enormous source of facts.
of unpredicted emotions.