Securing Your WordPress Site Print

WordPress is the most popular content management system, so it gets targeted by attackers a lot. Here is how to lock yours down.

1. Keep Everything Updated

Keep WordPress core, themes, and plugins up to date. Turn on automatic updates for minor core releases.

2. Use Strong Login Credentials

• Do not use "admin" as your username.
• Use a strong, unique password (cPanel's password generator works for this).
• Change the default login URL from /wp-admin with a plugin like WPS Hide Login.

3. Install a Security Plugin

We suggest:

• Wordfence - firewall, malware scan, login security.
• All In One WP Security & Firewall - covers a lot of security settings.
• Limit Login Attempts Reloaded - blocks brute force attacks.

4. Regular Backups

Use a plugin like UpdraftPlus or BackWPup to schedule automatic backups to cloud storage (Google Drive, Dropbox, etc.).

5. Additional Tips

• Disable file editing from the WordPress admin dashboard by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.
• Delete unused themes and plugins.
• Use HTTPS (SSL) - free SSL certificates are included with your hosting.
• Change the database table prefix (wp_) if you are setting up a new site.