There’s lots of misinformation out there about WordPress not being secure. It seems that if you see a content management system hacked it’s likely going to be WordPress.
As is common with news and sensationalizing it, there’s some truth here but a whole lot of misinformation. WordPress isn’t insecure at all. In fact, WordPress is extremely secure.
WordPress is the most vulnerable simply because it’s the most used and the most known. There are more developers creating plugins and themes for WordPress than any other platform.
Along with that and the huge user base, there’s also more hackers trying to do harm.
Also with more developers comes more opportunists looking for ways to make a quick buck with little effort. That also leads to more shotty work from poorly written plugins (mostly) and themes too.
Because WordPress is a very much living environment that means care must also be taken to stay up-to-date.
The Methods That Will Keep WordPress Extra Secure
If you take care to manage your WordPress installation properly there’s little to no risk of ever getting infected or hacked. With proper care your WordPress website can be just as secure as any other content management system or even an HTML website (almost).
These practices will help keep your website nice and secure.
1) Use A Crazy Secure Password
This one goes for every platform, website, device or anything. A common and guessable password is the most harmful thing you can possibly do.
Please don’t use Blink-182 as a password, you’re just asking for trouble if you do.
Use a secure password generator to create as secure of a password as possible. There are many apps out there to manage passwords so you don’t have to remember them.
You can even use the one built right into your Apple device or even Chrome browser. I only have to remember one password and my password for everything else is unique and extremely difficult to hack.
Yes, use a different password for every. single. account. online.
That goes for WordPress too, every one of your installations should have a unique username and password. I’ll cover the username shortly.
2) Change Your Password Often
For those websites that deserve and demand the highest level of security (like your website!) then you should change your password often.
My recommendation is to change your password every 90 days but you can find what works for you. It’s better to change it every 6 months than to never change it at all.
3) Don’t Use The Username Admin
Just as important as using a secure password is to not pair your password with the username admin. It’s the most tried username for WordPress website hacks. I typically see anywhere from 3 to 20 tries every week to login with the username admin before the other end gets blocked.
It used to be the the default WordPress admin username was admin but that’s changing more and more. Generally WordPress installation tools don’t use that username anymore.
Just to be safe, verify you’re not using it either because it’s an invitation to get hacked. If your username is admin and you’d like to change it, read this.
How To Change A WordPress Username
It’s true, WordPress doesn’t let you change your username if you already created your account. It’s easy to switch to a new administrator account, though.
Create a new user in the WordPress admin dashboard under Users > Add New . Fill out your information and make sure you select Administrator from the role dropdown menu. Also, you have to use a different email address for this new user but you can change it once you delete your old account.
Once your new account is created, log out of your current account, log into the new one and head back to Users > Add New and delete your old account.
You’ll now be asked where to attribute all the old content and you can select your new account (probably the only one that shows up on the drop down menu).
Now you can change the email address of your new account back to your regular email address.
That’s it!
This will better protect you against automated scripts that try to hack into your WordPress account using the default username and a list of commonly used passwords. But you wouldn’t be using a commonly used password now, would you?
4) Keep WordPress Up-To-Date
Only 33.2% of WordPress installations are using the most recent version according to WordPress.org stats. That means a staggering 66.8% of WordPress websites are using an older and potentially more outdated version. That also means there’s a lot of WordPress websites out there that are vulnerable which is 100% on the shoulders of the owners of those websites and not at all on WordPress.
WordPress can lead people to a secure WordPress installation but they can’t make website owners drink it. That statistic shocks me every time because aside from having a crazy secure password, updating WordPress is next in line of importance.
There are no excuses for not updating WordPress. There are plenty of excellent WordPress maintenance services (that one’s us!) that can do it for you if you don’t have the time.
If your installation is so custom that you can’t update then you probably should be looking at better solutions to your problem.
WordPress is a dynamic environment and needs to be updated soon after there’s an updated. That especially true if it’s a security update.
5) Use Only Well-Known & Maintained Plugins & Themes
This is an important one after keeping your plugins and theme up-to-date. If you’re using a more obscure theme or plugin then they’re not updated as often nor are vulnerabilities found as quickly.
A popular plugin is more likely to hav a lot of eyes on it correcting issues and checking for vulnerabilities than an obscure plugin that nobody cares about. Of course this isn’t going to guarantee anything but it’s just a good idea.
If a plugin hasn’t been updated for more than 6 months then it’s safe to say you need to find an alternative quick.
There are some malicious plugins out there too which is why I am a firm believer in using well-known plugins and themes. If they have a reputation to uphold in order to bring in new customers then they will care a lot more.
You don’t want to be using a theme that can harvest user information and perform malicious activity themselves even if they say they’re not going to. Those kinds of plugins and themes are out there too.
Don’t believe me, look at the recent debacle that was outlined on the Wordfence blog.
6) Check For Plugin & Theme Updates Often
This is similar but not the same as actually updating your WordPress installation. If you’re going to update often then you need to be aware if there are updates to run.
If you install WordPress, set up your website and then leave it for six months without checking in then you’re going to have issues. Your updates aren’t going to run on their own, you have to actively check for them and run them.
So, check for updates at least once a week.
7) Security Plugin
Install a security plugin to keep your WordPress installation safer. These plugins do a number of things to WordPress that will help secure it.
Not all of them do the best job and some interfere with plugins but generally, you’re safer with a security plugin than without even if your host takes care of some security measures.
The security plugin I use and prefer is Wordfence but iThemes Security is another popular option. The reason I prefer Wordfence is that it is easy to configure and hasn’t caused any interference with other parts of my website while iThemes Security has.
8) Delete Unused Plugins
Not only do unused plugins waste space on your server, but they can also still leave vulnerabilities on your server while disabled. If you’re not using it or it hasn’t been updated in a long time, delete it!
This also goes for themes you’re not using too.
9) Setup Google Search Console
It’s free to set up and in your search console, you’ll be able to see if your website has been flagged as hacked.
Check it out here and sign up for a free account.
Older Recommendation/Security Myths That Aren’t That Important
I just rewrote this entire article in April 2019 because things (and my knowledge) change a lot. There are some items I had on the original list that were debunked as true security measure.
There are also other that I knew were bogus suggestions and I decided to include them here also. I still see a lot of people who don’t know any better but I cannot blame them because at one time I didn’t know any better either.
The best I can do is make it known like the rest of the security gurus have.
Now for the list of some older security recommendations and myths that are no longer useful.
1) Change the wp-admin URL
This isn’t a good way to do security at all. It’s going to do more harm than good because some WordPress plugins are hard coded to use the wp-admin URL for admin login.
In the long ru this isn’t going to help you, just make your life more difficult.
2) Delete readme.html
In the root directory of your website (usually the public_ftp folder on FTP) there’s a readme.html file that shows what version of WordPress you’re using.
Many websites have this file and it was previously recommended to delve it. No need, there are many other methods hackers can use to figure out your version of WordPress.
This also shouldn’t matter because you’re using the most updated version of WordPress, right!?
This method is also outdated because it’s a losing battle. No matter how many times you delete the file it’ll show back up. It’s like playing whack-a-mole!
8. Choose An Obscure Table Prefix
A recent article from Wordfence (a recommended security plugin above) debunks the benefit of this security method.
I recommend reading the article and of course fully implementing a security plugin such as Wordfence.
When you’re initially setting up your WordPress website and have to choose the table prefix, just leave it alone. There’s no reason to change it and it won’t protect you anyway.
What Else?
That’s all I have! Those are the most important security measure you can take to keep WordPress secure. There are more, I know, and I will add them but for now, if you see any important ones missing, leave them in the comments.
WordPress.org has a whole page about hardening WordPress. That’s just a fancy way of saying keep it more secure and make it less vulnerable to hackers.
This post was originally posted in 2015, updated in 2016 and majorly overhauled with a new date in April 2019.