Data suggest that 30,000 new websites are hacked every day. And 90% of all websites hacked in 2019 were running on WordPress.
Now, at one glance, it is easy to assume that WordPress is a relatively unsafe CMS. And hackers target WordPress. But such is not the case.
WordPress powers more than one-third of the web.
The sheer number of WordPress websites as compared to other CMS options makes the data look skewed against WordPress.
Hackers do not target WordPress websites.
They target websites with weak security.
Source: wordfence.com
And finding loopholes and vulnerabilities in WordPress makes it easy to hack multiple websites. Given that most WordPress sites would have the same vulnerabilities.
While there is no way we can conclude if other website platforms are safe or not, taking apt steps to secure your website is always wise.
Before we begin, we’d just like to make it very clear that arguments like – “Who would be interested in my small business website?” and “My website has no data that would interest a hacker.” do not stand.
Hackers do not think of your website as a small business website with hardly any sensitive data.
What hackers see is the potential to infect your website with malware and make money out of it.
And when that happens, besides your reputation, money, client’s personal information, and data about your business, the time you waste cleaning your website after an attack is also at stake.
How to Protect your WordPress Website from Hacking in 2021?
To help you keep your WordPress website safe, we analyzed the reasons that leave your website exposed to hacking. And we have also mentioned the solutions that will help protect your website.
1. Go for Secure Web Hosting
One of the top reasons behind WordPress hacking is insecure web hosting. Small web hosting companies don’t have security systems in place to protect your website.
The simple solution is to do comprehensive research before finalizing a web hosting provider. Managed hosting providers and Virtual Private Server (VPS) hosting add to not just the security of your website but also its stability.
2. Use Strong Passwords
Passwords like site1234, your name, business name, etc. are easy to remember for sure. But they are also easy to decode for hackers.
Stronger passwords cut down the risk of your website getting hacked.
sItE1@3$, for example, is just site1234 while using the Shift-Tab for every alternate character. Easy to remember. But hard to guess.
You need to have unique and strong passwords for the following accounts related to your WordPress website –
- Email account used for WordPress and hosting.
- WordPress admin account
- FTP account
- Hosting account
- MySQL database used for WordPress
To Protect your WordPress Website from Hacking, you can add an extra security layer by enabling 2-factor authentication as well.
3. Secure Access to the WordPress Admin Area.
Most WordPress websites’ admin panels can be accessed using the default /wp-admin or /wp-login slug. Most site owners never change it. This makes it easier for hackers to land on your login page.
Here’s what you should be doing:
- Change the login page address from /wp-admin or /wp-log into something else. (Make sure you don’t forget it, though. Bookmark the new URL.)
- Limit the number of login attempts (max five). By default, it is set to infinite attempts.
- Change your username from ‘admin’ (set by default) to something complicated.
- Enable email notifications for all logins.
4. Update to the Latest Versions of WordPress or Plugins
When your current WordPress version is working perfectly, you may consider an update unnecessary. And full of hassles.
It is natural to assume that your website might face unwanted structural or design changes if you update WordPress or even a plugin. Updates are meant to bolster website security and fix bugs.
When your WordPress version isn’t the latest, your website is vulnerable to security breaches. Backup your website before the update, in case you’re still fearful.
After updating, delete the older versions from your server. Unused versions of WordPress and plugins can be exploited.
You can use plugins like Advanced Database Cleaner for cleaning the junk off your database.
- Don’t Download Themes and Plugins from Shady Sources
It is hard to say no when you are getting a premium theme or plugin for free, right? These nulled plugins and themes might save you a couple of bucks.
But they cost you the security of your website.
Look for deals and discounts online. Or use free alternatives if you don’t wish to pay for a plugin or theme.
Going for nulled versions downloaded from unauthorized websites should never be an option.
Download plugins and themes from either WordPress’s repository or official websites of the themes/plugins only.
5. Protect Important Files
The .htaccess file located in the root directory of your database contains some core instructions.
Controlling how your website’s permalinks are displayed is the primary job that it does.
But it can also be used to secure your website by restricting access to the site.
To prevent WordPress hacking, you can update the .htaccess file with specific instructions. These instructions will grant admin login access to only specific IP addresses.
To secure your .htaccess file –
- Log in to the FTP database
- Locate the .htaccess file in the root directory
- Download the file
- Use a text editor to open the file
- Add the following code to the file
Source: https://www.reliablesoft.net
Add your IP address or addresses in the orange space.
- Save the file and upload it and replace it in the root directory.
Another important folder that you should secure is wp-admin.
The files in this folder power the WordPress dashboard and check the login credentials when you log in.
To secure wp-admin, add the below-given code following the same steps as before.
Source: https://www.reliablesoft.net
Add CAPTCHA to Comment and Form Setting
Source: templatemonster.com
Many site owners don’t even realize that comment and form settings have to do something with site security. And that’s what makes them significantly more susceptible to attacks from hackers.
You should manually approve all comments and add CAPTCHA to both forms and comments.
Why?
Well, CAPTCHAs prevent hacking attacks using brute force.
A brute force attack is an automated trial and error method to guess a password or PIN. And adding CAPTCHAs before login makes sure that bots are neither able to degrade the QoS (Quality of Service) nor enter your website.
CAPTCHA recognizes brute force and bots and blocks access for hackers.
Some More Tips to Protect your WordPress Website from Hacking
Now you know the basics of WordPress security.
But to keep your website safe from getting hacked, you should also make sure that you follow some additional tips –
- Install Sucuri. Sucuri offers website security services. Both Google and WordPress recommend it.
- Use WordPress Security plugins like MalCare.
- Install SSL certificates and use https://. Also, secure websites with https:// URLs rank higher in SERPs. This would also boost your SEO efforts while enhancing security.
- Use a firewall and antivirus for your computer. When you are logging in to your website from your laptop or PC, you risk accidentally giving away your login details. Keystroke tracking malware can infiltrate your device. Antivirus and firewalls will prevent that from happening.
What Next?
You know how to protect your WordPress website from hacking, and trust us, it isn’t hard to use all the tips that we have mentioned.
At least not as hard as trying to recover or clean up a website that has been hacked.
It is easy to overlook security when you have several other things to focus on. From SEO to adding content to managing conversions and sales, a lot goes into making a website functional and useful.
But before all that, secure your website.
Remember, prevention is always better than cure.
You may also like:
I use wordpress fence security