WordPress security

​

Essential WordPress security measures

There are several essential steps you should take to enhance the security of a WordPress site:

​

Use strong WordPress passwords

Use a strong password for all administrator accounts, and change passwords periodically. Strong passwords are not easily guessed. To break into an account with strong passwords, hackers use brute force attacks. Stopping brute force attacks is covered below.

​

Use a unique WordPress username

Do not use the default admin username for the administrator. Instead, create a user with a different username, assign the administrative role to it, and then delete the default admin administrator.

​

Update WordPress plugins and themes

WordPress is updated regularly to address known vulnerabilities. Running old versions of WordPress makes it easy for hackers to gain access to your site. Run updates regularly to make sure WordPress and all related plugins are up to date.

​

Delete unused WordPress plugins and themes

Even though unused plugins and themes are disabled, that code is still visible on the Internet and can be a target for hackers. Be sure to delete any unused themes or plugins in order to reduce the opportunity for hackers to gain access to your site.

​

Make regular backups

Make regular backups of your WordPress site. Backups will not prevent a site from being compromised, but they do help get a site back online quickly. You can use Softaculous to back up, restore, and update your WordPress site from one convenient interface.

​

Defending against WordPress brute force attacks

A brute force attack is a simplistic type of attack where a user or script tries to gain access to a site by repeatedly guessing different username and password combinations. Unfortunately, many people have username and password combinations that are easily guessed, so brute force attacks are often effective. If your WordPress site experiences a brute force attack, you may notice that the site responds slowly, or not at all. Additionally, you may be unable to log in. This is because the flood of login attempts during a brute force attack causes numerous PHP and MySQL calls. These calls increase server load and negatively affect website performance. There are several measures you can take to defend against brute force attacks on your site.

​

Method #1: Password-protect the WordPress login page

WordPress uses the wp-login.php file for logins. By adding password protection to this file, you add another layer of security to your site. Users must enter a username and password before they can even access the wp-login.php file to log in to WordPress. To set up password protection for the WordPress login page, follow these steps:

1. Use your web browser to go to http://www.htaccesstools.com/htpasswd-generator.
2. In the Username text box, type a username.
3. In the Password text box, type a password for the user.
4. Click Create .htpasswd file, and then copy the line of text. The line of text should contain the username you specified, followed by a colon (:), and then the encrypted password. For example:
   username:$apr1$IUQgDA6U$qbXb9wEnjirNCqxezpjoe5
   
5. Create a file named .wp-password in your account’s home directory. Paste the line of text from the previous step into the file. There are two ways you can create and edit this file:
   • Log in to your account using SSH, and use a text editor from the command line.
   • Log in to your account using cPanel, and use an editor in the File Manager.
   Make sure that the .wp-password filename begins with a period (.).
6. Save the .wp-password file and exit the text editor.
7. Create an .htaccess file in the directory where you installed WordPress:
   • If you installed WordPress in the domain’s document root, then this directory is /home/username/public_html, where username represents your account username.
   • If you installed WordPress in a subdirectory or subdomain, then this directory is /home/username/public_html/directory, where directory represents the WordPress location.
8. Copy and paste the following text into the .htaccess file:
   # Prevent Apache from serving .ht* files:
   <FilesMatch "^\.ht">
     Order allow,deny
     Deny from all
   </FilesMatch>
   ErrorDocument 401 "401 Unauthorized"
   ErrorDocument 403 "403 Forbidden"
   # Protect wp-login.php:
   <Files wp-login.php>
     AuthUserFile /home/USERNAME/.wp-password
     AuthName "Please log in"
     AuthType Basic
     require user WP-USERNAME
   </Files>
   
9. In the .htaccess file, make the following changes:
   • Replace USERNAME with your Stablepoint account (cPanel) username.
   • Replace WP-USERNAME with the username that you specified in step 2.
   If you want to display a login message different from “Please log in”, you can change the AuthName directive’s value to whatever text you want.
10. Save the .htaccess file and exit the text editor.
11. Use your web browser to go to the WordPress login page (for example, http://www.example.com/wp-admin, where example.com represents your domain name).
12. You should be prompted to type a username and password. Type the username and password combination that you specified in steps 2 and 3. The WordPress login page should appear, and you can now log in to WordPress as you normally do.

​

Method #2: Block IP addresses from accessing the WordPress login page

Another way to counter brute force attacks is by blocking IP addresses. With this configuration, you can allow one (or several) IP addresses to access the WordPress login page, and block everything else. To prevent IP addresses from accessing the login page, follow these steps:

1. Create an .htaccess file in the directory where you installed WordPress:
   • If you installed WordPress in the domain’s document root, then this directory is /home/username/public_html, where username represents your account username.
   • If you installed WordPress in a subdirectory or subdomain, then this directory is /home/username/public_html/directory, where directory represents the WordPress location.
   If you already followed the steps to set up password protection for the login page, use the same .htaccess file that you created in that procedure.
2. Copy and paste the following text into the .htaccess file:
   <Files wp-login.php>
     order deny,allow
     allow from xxx.xxx.xxx.xxx
     deny from all
   </Files>
   
3. In the .htaccess file, replace xxx.xxx.xxx.xxx with the IP address that you want to allow for WordPress logins. All other IP addresses will be blocked from accessing the wp-login.php page.
   • To grant access to multiple IP addresses, you can add multiple allow from lines.
   • To determine your current IP address, you can visit http://ipfinder.us.
4. Save the .htaccess file and exit the text editor.
5. Test your WordPress site to make sure that it still functions correctly, and that you can access the administration login page.

​

Method #3: Change the WordPress login URL

The default WordPress login page is wp-login.php, and a basic WordPress installation does not allow you to change this location. However, the WPS Hide Login allows you to change the WordPress login URL. Doing so can reduce the impact of brute force attacks, which are usually scripts that are programmed to hit the wp-login.php page over and over again with login attempts. When you change the WordPress login URL, anyone who tries to access the wp-login.php page or wp-admin directory receives a “404 Not Found” error message. To change the WordPress login URL using a plugin, follow these steps:

1. Log in to your WordPress site.
2. Click Plugins, and then click Add New Plugin.
3. In the Search Plugins text box, type wps hide login, and then click Search Plugins.
4. The WPS Hide Login plugin appears in the list of search results.
5. Under WPS Hide Login, click Install Now to start the installation.
6. After the plugin installation finishes, click Activate. The Plugins page appears.
7. Under WPS Hide Login, click Settings.
8. In the Login url text box, type a URL for the login page, or accept the default value of login.
9. Click Save Changes.
10. Test your WordPress site to make sure that it still functions correctly, and that you can access the login page using the new URL. Additionally, if you try to access wp-login.php or wp-admin, you should receive a “Page Not Found” error message.

​

Method #4: Enable Cloudflare for your site

Cloudflare is a content delivery network (CDN) that can block malicious requests before they reach your site. For example, Cloudflare-enabled sites were significantly protected during a large-scale WordPress brute force attack that occurred in April 2013. Cloudflare works by routing traffic to your website through its own network. As a result, Cloudflare is able to block certain types of malicious requests. Cloudflare also increases website performance by leveraging its worldwide server network to deliver content to users more efficiently. If you enable Cloudflare and also use the IP address blocking method described in this article, make sure you test site logins thoroughly. On some server configurations, the combination of Cloudflare and IP address blocking may prevent logins from working correctly.