Enhanced Identity Authentication and Access Management
The first line of defense in security protection begins with access control. It is a crucial and fundamental step to ensure that only authorized personnel have access to your website’s backend.
Adopt a strong username and password policy.
The default username “admin” and its simple password are the primary targets of hackers. You must avoid using such default usernames. Additionally, you should require all users (especially administrators) to create complex passwords that include uppercase and lowercase letters, numbers, and special characters. You may consider installing a password policy management plugin to enforce this rule.
Implement a two-factor authentication mechanism.
Enabling two-factor authentication (2FA) for administrator accounts, or even for all user accounts, can significantly enhance security. Even if a password is accidentally leaked, attackers will not be able to bypass the second layer of verification (such as a mobile phone verification code or a dynamic token generated by an authentication app). Plugins like… Wordfence Security Or Two-Factor All of them offer reliable 2FA (Two-Factor Authentication) functionality.
Recommended Reading The Ultimate Guide to Optimizing WordPress: A Comprehensive Speed-Up Solution from Performance to Security。
Limit the number of administrator users and allocate roles reasonably.
Strict review of ownershipadministratorThe number of users for each role. Only grant the highest level of permissions to those who are absolutely necessary. For content editors, authors, etc., appropriate permissions should be assigned accordingly.editor、authorWait for roles with lower permissions to be assigned. Follow the “principle of least privilege” and grant users only the minimum level of access required to complete their tasks.
Strengthen the security of core systems and files.
Keeping the WordPress core, themes, and plugins up to date is the lowest-cost yet most effective security measure. In addition, it is essential to set the appropriate permissions for files and directories.
Maintain immediate updates for the system and its components.
Developers will continue to fix any security vulnerabilities that are discovered and include the necessary patches in subsequent updates. You need to make sure that the WordPress core, all installed themes (both activated and inactive ones), as well as all plugins, are always kept up to date. Enabling the automatic update feature in the backend (available in WordPress versions 5.5 and later) is a good practice to follow.
Configure the correct file and directory permissions.
Insecure file permissions can allow attackers to write or execute malicious files. The recommended file permission settings are as follows: set all directories to 755 and all files to 644. This applies to critical configuration files as well.wp-config.phpIt should be set to 600 or 640 to ensure that its contents, especially the database credentials, are not read by other users.
# 设置目录权限为755
find /path/to/your/wordpress/ -type d -exec chmod 755 {} ;
# 设置文件权限为644
find /path/to/your/wordpress/ -type f -exec chmod 644 {} ;
# 单独设置wp-config.php权限
chmod 600 /path/to/your/wordpress/wp-config.phpProtect sensitive configuration files.
wp-config.phpThe files are the heart of WordPress, containing information about the database connection and security keys. In addition to changing permissions, these files can also be moved to a directory one level above the non-Web root directory. WordPress will automatically detect their new location. Make sure to….htaccessThe file is properly protected to prevent the directory list from being displayed.
Recommended Reading Interpret the configuration mysteries and best practices of the WordPress core file, wp-config.php。
Deploying firewalls and security plugins
By using professional firewalls and security plugins, you can proactively block most malicious traffic and automated attacks, providing real-time protection for your website.
Install and configure a Web Application Firewall.
Web Application Firewalls (WAFs) can filter and block malicious requests, such as SQL injections and Cross-Site Scripting (XSS) attacks. Many security plugins incorporate WAF functionality as well.Sucuri Security、Wordfence SecurityandiThemes SecurityThese plugins can block known malicious IP addresses, scan for malware, and implement restrictions on login attempts.
Hide the backend login address.
The default/wp-adminand/wp-login.php</code]登录地址是公开的，容易遭受暴力破解攻击。通过安全插件或修改代码，可以将其更改为一个唯一的、难以猜测的地址。例如，使用iThemes SecurityThe “Rename Login Page” feature.
Enable login attempt limits and monitoring.
Limiting the number of login attempts from the same IP address within a certain period of time can effectively prevent brute-force attacks. Once the number of attempts exceeds a preset threshold, the system should temporarily or permanently lock that IP address. Security plugins often provide this functionality. Additionally, monitoring website traffic and file changes, and setting up email alerts for any suspicious activities is also important.
Implementing security for the database and the connection layer
The database is where the content of your website is stored. Ensuring its security and encrypting data transmissions are crucial for preventing data breaches.
Modify the default database prefix.
The default prefix for WordPress database tables iswp_This makes it easier for attackers to guess the table names when performing SQL injection attacks. This can occur during the installation of WordPress, or later on through the use of security plugins (or by manually making modifications).wp-config.php(The file), change it to a unique and difficult-to-guess prefix, for examplemyprefix321_。
Recommended Reading The Ultimate Guide to Optimizing WordPress: 20 Practical Tips for Improving Speed, Security, and SEO Rankings。
Enforce the use of SSL/TLS encryption for all connections.
Install an SSL certificate on your website and ensure that all administrative backends and user login pages use the HTTPS protocol for data transmission. This will prevent data from being eavesdropped on or tampered with during transmission. You can do this by…wp-config.phpAdd the following code to the file to force the backend to use SSL and enable HTTPS for the entire website:
define('FORCE_SSL_ADMIN', true);And make sure that both the WordPress URL and the site URL start with the same prefix.https://Beginning.
Establish a regular automated backup strategy.
“Better to be prepared for the worst, even if the chances are slim.” Even with all the protective measures in place, backups remain the ultimate lifeline. You need to regularly back up your entire website’s files and database. The backups should be stored in a remote location, such as a cloud storage service (like Dropbox or Google Drive), or transferred to another server via FTP/SFTP. You can use plugins to help with this process.UpdraftPlusOrBackupBuddyAutomated regular backups can be easily implemented.
summarize
Protecting a WordPress website is a multi-layered, ongoing process, rather than a one-time task. It starts with strengthening basic measures such as login authentication and permission management, continues with timely updates of all components and server security configurations, involves deploying proactive firewalls, and finally ensures the security of the database and the transmission layer. Each of these steps plays a crucial role in building a comprehensive security defense system. By combining these measures with a regular and reliable backup strategy, you can minimize security risks, maintain the integrity of website data, and ensure the availability of your services—allowing you to stay prepared even in the face of constantly evolving cyber threats.
FAQ Frequently Asked Questions
What is the most urgent security setting that should be implemented for ###?
If you can only do one thing, please enable two-factor authentication (2FA) for all administrator and editor accounts immediately, and make sure that all themes, plugins, and the WordPress core are updated to the latest versions. These two measures can immediately and significantly block most common sources of attacks.
Why is it necessary to keep a plugin updated even if it is not being used?
Plugins that are not activated or have even been deleted may still remain on your server. Attackers can exploit known vulnerabilities in these files by directly accessing their paths to carry out attacks. Therefore, it is crucial to completely remove any unnecessary plugin files via FTP or the host management panel.
How can I determine if my website has been hacked?
Some common signs include: significantly slower website loading times, the appearance of unfamiliar links or pop-up ads that were not added by you, search engines labeling your website as “unsecure” or “infected with malware”, sudden inability to log in to your administrative account, or the discovery of new users or files that you do not recognize. Once you notice any of these signs, you should immediately initiate a security check and cleanup process.
My website has very low traffic; will it become a target for hackers?
Yes. Many online attacks are carried out by automated bot programs that perform indiscriminate scans, looking for any websites with known vulnerabilities, rather than targeting specific, large-scale targets. Therefore, regardless of the size of a website, as long as it is publicly accessible on the internet, basic security measures must be in place. Small websites often become targets for attacks or “zombie computers” due to a lack of protection.
What's next, what's next?
Extended reading and practical knowledge
The following are related to the topic of this article and are suitable for further in-depth reading. Prioritize starting with the article that is closest to your current problem, and gradually expanding to surrounding topics usually works better.
- 10 Essential WordPress Security Settings to Protect Your Website from Hackers
- 10 Practical WordPress Plugins to Improve Website Performance and Security Significantly
- Comprehensive Guide to Improving WordPress Security
- In-depth understanding of WordPress security best practices: Comprehensive protection for your website
- Creating Professional WordPress Websites: A Comprehensive Practical Guide from Security Protection to Performance Optimization
English