For a wordpress site what are the best ways to secure it?

[DigitalAnt]

Currently using NinjaFirewall , 2 factor , changed backend login url & password protected those wp admin folders etc. But those seem to be basic solutions from blogs.

So wanna know from the experts here what is your way of securing it ? Any combo of plugins you use etc.Kindly shed some light on it & thank you for your time.

 

[dogstyle007]

I think using cloudflare on the site is also a good option, also make sure you enable strict SSL in the whole site.

 

[Smileyヅ]

CDN, SSL, and Sucuri Security are enough for me.

While installing site use different WP prefix, use different database name, use different admin username

 

[DigitalAnt]

I think using cloudflare on the site is also a good option, also make sure you enable strict SSL in the whole site.

CDN, SSL, and Sucuri Security are enough for me.

While installing site use different WP prefix, use different database name, use different admin username

Ya also using cloudflare & ssl. Used wordfence once but seem to put more load. So currently using Ninjafirewall. Thanks for your input.

 

[pressrelease]

Change table prefix of wp site db
Change default directory names
2fa is must

I can write more but if say word h a c k some mod will give me an infraction.

 

[stromind]

htaccess password protection for wp-admin and IP restriction to wp-admin using htaccess is also necessary if you are more concern about security

 

[legion85]

Wordfence and cloudflare are both a must use

 

[Deleted member 1038636]

NinjaFirewall won't help you! People think plugins will save their ass in all of time, and that isn't true. Plugins is a opened door to hackers using exploits, vulnerabilities, bugs that can do your website being hacked.

Remember one thing, the best security is on backend. What I mean with "backend"? I mean, the security and hardening you should do is on the server. If you are using VPS/Dedicated server, is that you should take measures to improve security on your website.

You can use ALL Plugins, that won't prevent your website being hacked. Is the reverse, it open a door to exploits, bugs and hackers use it in their favor.

Cloudflare can help you, but is limited. Sucuri Firewall, BitNinja is a good choice if you don't have knowledge / know-how.

CDN, SSL, and Sucuri Security are enough for me.

While installing site use different WP prefix, use different database name, use different admin username

God! Finally someone that understands about security. Wordpress Plugins especially "Security Plugins" is dangerous, and if is not used with moderation, can be a big problem.

I recommend hardening the server that's what will prevent your website being hacked. Hardening is the best you can do.

For example using ModSecurity Rules, IPTables, fail2ban or SSHGuard.

Naxsi WAF for Nginx web server (A huge improvement of Security) also with CDN.

 

[Jeepy]

I would not over complicate things.

1. Hide wp-content folder by adding this to htaccess

Options - Indexes

2. Hide wp-admin and use different login name, you can do it with this simple plugin - https://wordpress.org/plugins/wps-hide-login/
3. Add SSL
4. Use ~20+ character password for MYSQL, because as we know from the latest news 16 character passwords now can be hacked within 2 hours
5. Don't use anything default Don't use default wp-prefix, default login name etc.
6. Add 2FA. I'm using this as it's simple ,safe and without spam ads https://wordpress.org/plugins/two-factor/
7. I don't suggest adding these security plugins as they have quite a load on a website and sometimes they tend to log-off or block a normal user, especially from third world countries.

 

[kveldulv]

Use something other than wordpress.

 

[bertbaby]

Use something other than wordpress.

What's your poison?

 

[Deleted member 877043]

Some .htaccess magic, file and folder permissions, Google Captcha or TFA on login, Good firewall rules, SSH instead of FTP (try at least to use SFTP.), SSL, Know your customers. No shared hosting, or at least know who’s your neighbor.

 

[DigitalAnt]

NinjaFirewall won't help you! People think plugins will save their ass in all of time, and that isn't true. Plugins is a opened door to hackers using exploits, vulnerabilities, bugs that can do your website being hacked.

Remember one thing, the best security is on backend. What I mean with "backend"? I mean, the security and hardening you should do is on the server. If you are using VPS/Dedicated server, is that you should take measures to improve security on your website.

You can use ALL Plugins, that won't prevent your website being hacked. Is the reverse, it open a door to exploits, bugs and hackers use it in their favor.

Cloudflare can help you, but is limited. Sucuri Firewall, BitNinja is a good choice if you don't have knowledge / know-how.



God! Finally someone that understands about security. Wordpress Plugins especially "Security Plugins" is dangerous, and if is not used with moderation, can be a big problem.

I recommend hardening the server that's what will prevent your website being hacked. Hardening is the best you can do.

For example using ModSecurity Rules, IPTables, fail2ban or SSHGuard.

Naxsi WAF for Nginx web server (A huge improvement of Security) also with CDN.

Wow thats a lot of new stuff im hearing. The kind of answer i needed..Will research them and try them,

 

[kveldulv]

What's your poison?

Html5, static site generators. For landing pages I keep things as simple as humanly possible.
Grav, Drupal, Concrete5, are all good alternatives worth looking at for actual sites.

Wordpress is nice and all, it works, but the never ending plugin hell and security problems have turned me off it for years. My 2c

 

[bertbaby]

Html5, static site generators. For landing pages I keep things as simple as humanly possible.
Grav, Drupal, Concrete5, are all good alternatives worth looking at for actual sites.

Wordpress is nice and all, it works, but the never ending plugin hell and security problems have turned me off it for years. My 2c

I agree about the plugins and do my damn best to minimize. Biggest was of time are those SEO plugins IMHO.

 

[cperformancemarketer]

I will brief in detail about this..
To protect your site there are two levels
Application Level & Server Level
If a person somehow tries to gain access to wordpress application by content injection or SQL Injection then he can mess with application at application level not at server level. Which mean he cant delete the server data that is wordpress application but he can delete media,post and pages. To counter this level, i have used itheme security because of bruteforceprotection, ipblacklist, 2FA, session hijacking protection and there are many more good features. It can also change login url which can be good for security.
If you implement security at server level, that can be by
implementing SSL that can secure websites from attacks (Cloudflare is doing a great work in this)
Implementing mod security rules that can protect from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts

 

[DigitalAnt]

I will brief in detail about this..
To protect your site there are two levels
Application Level & Server Level
If a person somehow tries to gain access to wordpress application by content injection or SQL Injection then he can mess with application at application level not at server level. Which mean he cant delete the server data that is wordpress application but he can delete media,post and pages. To counter this level, i have used itheme security because of bruteforceprotection, ipblacklist, 2FA, session hijacking protection and there are many more good features. It can also change login url which can be good for security.
If you implement security at server level, that can be by
implementing SSL that can secure websites from attacks (Cloudflare is doing a great work in this)
Implementing mod security rules that can protect from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts

Yes thanks to above replies im securing htacess , directories etc on server level. Lot of them which i dont know about and learned recently. of course other methods like ssl , cdn , 2fa , firewall too. Right now looking for a way to prevent creating another admin account and limiting it to 1 only.

 

[seocrab]

Best WordPress security tip I've learned: keep site backups so you can restore your clean site in the event of any future problems.

 

[DigitalAnt]

Change table prefix of wp site db
Change default directory names
2fa is must

I can write more but if say word h a c k some mod will give me an infraction.

As long as its in good intention you can share your protection methods i think so.

 

[pressrelease]

As long as its in good intention you can share your protection methods i think so.

I already got warnings for saying word h A C k. Not going to discuss anything related to site or server security.