Do you have themes you installed years ago but never really used hanging around on your website? Do you install a plugin only to decide you weren’t really going to use it? But then you never removed it? Now is the time to clean up your website. Get rid of files that aren’t being used and only keep current themes and plugins.

AND keep those you do have up to date. A good rule of thumb is to update at least monthly. Put it in your calendar if you forget things like this so it always stays up to date and current.

Just don’t forget step #10 before and after you update to be sure you have a copy at all times of your website in it’s most current form.

2. Install a Security Plugin and Optimize It

Our favorite is Wordfence but there are a few others out there like Sucuri or Loginizer that work well for others – we’ve used the free version of Loginizer but again prefer the added layers Wordfence offers clients. We just like the control and alerts Wordfence offers. Even with their free version, if you optimize the installation you will be far and away better off than having no security alerts on your website.

What we love about Wordfence is:

• It can help you setup 2 Factor authentication very easily
• Block IP’s that aren’t playing nice on your website
• Blocks visitors who use usernames such as admin, your website, etc. that are common for hackers to attempt (because a lot of users don’t think to make strong usernames – see our next point)
• Get notifications when users are locked out or using brute force to attempt to get on your site
• Get reminders about plugin and file updates when they are available
• Monitors your site for malware
• And so much more but those are our favorites.

No matter which one you choose – again, be sure to optimize it. You can’t just install and activate the plugin, you have to set it up to work properly for you.

3. Use Common Sense When Setting Up Your Username & Passwords

Still using admin or administrator for your login name??

STOP IT NOW!!

Using a strong password people can’t guess will go a LONG way in securing your website. We won’t make you raise your hand if you did this but we know from experience with clients this happens ALL THE TIME, so go fix that right now – seriously if you have a username like this stop reading and go setup a new one and delete the old one!!

And same thing goes for your password. If you are using the same simple password on all your logins or even using Password1 for your password because you were too lazy to come up with something original and then never fixed it – change that! Get creative with your passwords and use a variety of symbols, numbers, and letters both upper and lower case. Make it your goal to have a 100% strong password.

Have a hard time remembering passwords? Use Lastpass or something like it to save and protect yourself. You’ll never be left wondering what your password was again.

4. Hide Your Login Page

Can you guess the login page for friends website?

Most likely too many of you are using the standard yourwebsite.com/wp-admin login page – this is another area you need to go change today!

A great plugin to do this quickly and easily is – WPS Hide Login

Make the last bit anything you wish – but don’t forget what you changed it to so you can get back on your website! Bookmark it – set it up in LastPass, just don’t lose it! (Seriously, write it down, put it into a document, something – you will thank me later!)

Hackers will have a hard time finding a login page if you do this and will instead get a 404 error page when they attempt going to the standard WP login page. #BusinessOwnersWinning

5. Hide Your Dashboard From Non-Admins

Unfortunately this isn’t something that is automatic in WordPress – maybe in the future but as of right now, if someone had contributor status and logged into your website they would see the navigation of your dashboard just like you do. The problem with that is they then could figure out what plugins you use, certain aspects about your security and much more. While they can’t navigate to those areas 1) it looks unprofessional for them to see it and 2) you want to keep as much data about your website as you can private.

Use the plugin – Hide Admin Bar from Non-Admins – it does just what it implies (you have to set it up of course but it is easy to do).

6. Disable Directory Browsing

Add the following line at the end of the .htaccess file (In Your CPanel):

Options -Indexes

This blocks visitors from viewing your file directory. Trust me it’s a good thing! You want to put as many barriers as possible between your website files and hackers.

7. Run a Malware Scanner

One of the sad parts of malware is it can spread so quickly. And sometimes website owners getting on their website are spreading the infection unknowingly. Use malwarebytes or another Malware scanner to check your own computer and see if you have any issues with malware that could be part of the problem.

Using plugins like Wordfence and having it scan (that’s one of the settings that you need to be sure you do setup) your website for malware will alert you early on their is a problem before you get blacklisted.

8. Turn off File Editing from the Dashboard

Once you have dealt with malware it is your goal to never deal with it again! Often php files are where they attack so we want to be sure to turn off standard editing to as many places as possible!

From your CPanel – Add this code to the wp-config.php file:

define(‘DISALLOW_FILE_EDIT’, true);

Doing this will be sure that someone couldn’t get on your admin account and make changes from the file editor within the WordPress Dashboard.

9. Be Sure to Change your display name from your username

If you don’t set a Nickname or change the display name from the default (your username) when you do a blog post you will be sharing your username with the world! Don’t do that! Go in and make this easy change now!

Go to Users –> Pick your user account, then be sure there is a display name listed other than your username.

We recommend you take this even one step further and change your “Nice-Name” to something completely different from your username from within your “MYPHPADMIN”  area on your hosting platform.

10. Be Sure You Are Backing Up!

When you first start your site, make a backup.

Whenever you make major changes, Backup!

If your site isn’t new but doesn’t have malware – backup!

Backup Monthly.

Backup – Backup – Backup!!

Having clean backup files means you can restore instead of starting over if you do get malware.

A few bonus changes we’ve found helpful is changing file permissions in your Cpanel.

Make sure that your wp-config.php file and .htaccess files are not writable. Permissions should be 444.

And lastly – Disabling Xmlrpc.php Manually or with a plugin

If you don’t want to utilize a plugin and prefer to do it manually, then follow this approach. It will stop all incoming xmlrpc.php requests before it gets passed onto WordPress.

Open up your .htaccess file. You may have to turn on the ‘show hidden files’ within file manager or your FTP client to locate this file.

Inside your .htaccess file, paste the following code:

How Do I Know If My Website Has Been Attacked?

If you are using a reputable hosting company they will notify you when you have malware or your security scanner will.

If you have been hacked – you can clean it yourself or hire others to do it for you. We recommend working with a professional if you have never dealt with it before.

REFERENCE TO CLEAN SITE IF YOU ARE BRAVE ENOUGH TO DIY:

How to Remove Malware & Fix a Hacked WP Site

Having problems with WordPress security on your website? Contact us and let’s see if you’ve got as many safeguards in place as possible.