For a wordpress site what are the best ways to secure it?

DigitalAnt

DigitalAnt

Junior Member
Joined
Oct 14, 2017
Messages
161
Reaction score
29
Currently using NinjaFirewall , 2 factor , changed backend login url & password protected those wp admin folders etc. But those seem to be basic solutions from blogs.

So wanna know from the experts here what is your way of securing it ? Any combo of plugins you use etc.Kindly shed some light on it & thank you for your time.
 
Advertise on BHW
I think using cloudflare on the site is also a good option, also make sure you enable strict SSL in the whole site.
 
CDN, SSL, and Sucuri Security are enough for me.

While installing site use different WP prefix, use different database name, use different admin username
 
dogstyle007 said:
I think using cloudflare on the site is also a good option, also make sure you enable strict SSL in the whole site.
Click to expand...

Smileyヅ said:
CDN, SSL, and Sucuri Security are enough for me.

While installing site use different WP prefix, use different database name, use different admin username
Click to expand...

Ya also using cloudflare & ssl. Used wordfence once but seem to put more load. So currently using Ninjafirewall. Thanks for your input. :)
 
Change table prefix of wp site db
Change default directory names
2fa is must

I can write more but if say word h a c k some mod will give me an infraction.
 
htaccess password protection for wp-admin and IP restriction to wp-admin using htaccess is also necessary if you are more concern about security
 
NinjaFirewall won't help you! People think plugins will save their ass in all of time, and that isn't true. Plugins is a opened door to hackers using exploits, vulnerabilities, bugs that can do your website being hacked.

Remember one thing, the best security is on backend. What I mean with "backend"? I mean, the security and hardening you should do is on the server. If you are using VPS/Dedicated server, is that you should take measures to improve security on your website.

You can use ALL Plugins, that won't prevent your website being hacked. Is the reverse, it open a door to exploits, bugs and hackers use it in their favor.

Cloudflare can help you, but is limited. Sucuri Firewall, BitNinja is a good choice if you don't have knowledge / know-how.

Smileyヅ said:
CDN, SSL, and Sucuri Security are enough for me.

While installing site use different WP prefix, use different database name, use different admin username
Click to expand...

God! Finally someone that understands about security. Wordpress Plugins especially "Security Plugins" is dangerous, and if is not used with moderation, can be a big problem.

I recommend hardening the server that's what will prevent your website being hacked. Hardening is the best you can do.

For example using ModSecurity Rules, IPTables, fail2ban or SSHGuard.

Naxsi WAF for Nginx web server (A huge improvement of Security) also with CDN.
 
I would not over complicate things.

1. Hide wp-content folder by adding this to htaccess
Code: 
Options - Indexes
2. Hide wp-admin and use different login name, you can do it with this simple plugin - https://wordpress.org/plugins/wps-hide-login/
3. Add SSL
4. Use ~20+ character password for MYSQL, because as we know from the latest news 16 character passwords now can be hacked within 2 hours
5. Don't use anything default Don't use default wp-prefix, default login name etc.
6. Add 2FA. I'm using this as it's simple ,safe and without spam ads https://wordpress.org/plugins/two-factor/
7. I don't suggest adding these security plugins as they have quite a load on a website and sometimes they tend to log-off or block a normal user, especially from third world countries.
 
Last edited by a moderator:
Some .htaccess magic, file and folder permissions, Google Captcha or TFA on login, Good firewall rules, SSH instead of FTP (try at least to use SFTP.), SSL, Know your customers. No shared hosting, or at least know who’s your neighbor.
 
Getrektmate said:
NinjaFirewall won't help you! People think plugins will save their ass in all of time, and that isn't true. Plugins is a opened door to hackers using exploits, vulnerabilities, bugs that can do your website being hacked.

Remember one thing, the best security is on backend. What I mean with "backend"? I mean, the security and hardening you should do is on the server. If you are using VPS/Dedicated server, is that you should take measures to improve security on your website.

You can use ALL Plugins, that won't prevent your website being hacked. Is the reverse, it open a door to exploits, bugs and hackers use it in their favor.

Cloudflare can help you, but is limited. Sucuri Firewall, BitNinja is a good choice if you don't have knowledge / know-how.



God! Finally someone that understands about security. Wordpress Plugins especially "Security Plugins" is dangerous, and if is not used with moderation, can be a big problem.

I recommend hardening the server that's what will prevent your website being hacked. Hardening is the best you can do.

For example using ModSecurity Rules, IPTables, fail2ban or SSHGuard.

Naxsi WAF for Nginx web server (A huge improvement of Security) also with CDN.
Click to expand...
Wow thats a lot of new stuff im hearing. The kind of answer i needed..Will research them and try them,
 
bertbaby said:
What's your poison?
Click to expand...

Html5, static site generators. For landing pages I keep things as simple as humanly possible.
Grav, Drupal, Concrete5, are all good alternatives worth looking at for actual sites.

Wordpress is nice and all, it works, but the never ending plugin hell and security problems have turned me off it for years. My 2c
 
kveldulv said:
Html5, static site generators. For landing pages I keep things as simple as humanly possible.
Grav, Drupal, Concrete5, are all good alternatives worth looking at for actual sites.

Wordpress is nice and all, it works, but the never ending plugin hell and security problems have turned me off it for years. My 2c
Click to expand...
I agree about the plugins and do my damn best to minimize. Biggest was of time are those SEO plugins IMHO.
 
I will brief in detail about this..
To protect your site there are two levels
Application Level & Server Level
If a person somehow tries to gain access to wordpress application by content injection or SQL Injection then he can mess with application at application level not at server level. Which mean he cant delete the server data that is wordpress application but he can delete media,post and pages. To counter this level, i have used itheme security because of bruteforceprotection, ipblacklist, 2FA, session hijacking protection and there are many more good features. It can also change login url which can be good for security.
If you implement security at server level, that can be by
implementing SSL that can secure websites from attacks (Cloudflare is doing a great work in this)
Implementing mod security rules that can protect from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts
 
Salman Saleem said:
I will brief in detail about this..
To protect your site there are two levels
Application Level & Server Level
If a person somehow tries to gain access to wordpress application by content injection or SQL Injection then he can mess with application at application level not at server level. Which mean he cant delete the server data that is wordpress application but he can delete media,post and pages. To counter this level, i have used itheme security because of bruteforceprotection, ipblacklist, 2FA, session hijacking protection and there are many more good features. It can also change login url which can be good for security.
If you implement security at server level, that can be by
implementing SSL that can secure websites from attacks (Cloudflare is doing a great work in this)
Implementing mod security rules that can protect from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts
Click to expand...
Yes thanks to above replies im securing htacess , directories etc on server level. Lot of them which i dont know about and learned recently. of course other methods like ssl , cdn , 2fa , firewall too. Right now looking for a way to prevent creating another admin account and limiting it to 1 only.
 
pressrelease said:
Change table prefix of wp site db
Change default directory names
2fa is must

I can write more but if say word h a c k some mod will give me an infraction.
Click to expand...
As long as its in good intention you can share your protection methods i think so.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top