WordPress security: 8 habits that protect your company's site

If you check the access log of almost any WordPress site, you'll find lines like these, repeated hundreds of times a day:

POST /wp-login.php       401
POST /xmlrpc.php         403
GET  /wp-content/plugins/old-plugin/readme.txt   200

That isn't someone interested in your company: it's bots crawling the internet, trying weak passwords and looking for plugins with known vulnerabilities. You can't stop them, but you can make sure they find nothing. These eight habits close the doors they try first.

1. Update everything, not just WordPress

Vulnerabilities usually live in plugins and themes, not in WordPress core. Check for updates at least once a week and enable automatic minor updates. Before a major update, make a backup.

2. Remove what you don't use

A deactivated plugin is still on the server and can still be exploited. If you don't use it, delete it. The same goes for themes you installed to try out and for accounts of people who no longer work with you.

3. Unique passwords and two-step verification

Use a password manager and enable two-step verification for every administrator account. It's the measure that stops the most attacks, because a leaked password is no longer enough to get in.

If you only do one thing today, make it this. Turning on two-step verification takes five minutes and blocks the vast majority of logins with stolen passwords.

4. Give everyone only the access they need

Not everyone needs to be an administrator. Someone who only publishes articles can have the editor or author role. If an account is compromised, the damage stays limited.

For whoever manages the site, one line in wp-config.php disables the dashboard's file editor, one of the first tools an attacker uses once they get in:

define( 'DISALLOW_FILE_EDIT', true );

5. Backups that actually work

Follow the 3-2-1 rule: three copies, in two different places, one of them off the server. And most importantly, test restoring them from time to time. A backup that was never tested is just a hope.

6. HTTPS across the whole site

An SSL certificate encrypts information between your visitors and your server, and browsers flag sites without one as «not secure». Free certificates now renew themselves; there's no reason not to have one.

7. Plugins and themes only from trusted sources

Avoid «premium» themes downloaded for free from unofficial sites: they often come with hidden malicious code. Always download from the official repository or the developer's site.

8. Keep an eye on your site

Uptime monitoring alerts you if the site goes down, and occasionally reviewing users and modified files helps you catch an intrusion before Google flags your site as dangerous.

If you've already been hacked

Change every password (WordPress, hosting, database and FTP), restore from a clean backup and update everything before going live again. If Google flagged the site, request a review in Search Console once it's fixed.

Do this this week

• Turn on two-step verification for every administrator.
• Delete plugins, themes and users you don't use.
• Make a backup and test restoring it.
• Add DISALLOW_FILE_EDIT to wp-config.php.

At eXpertweb we monitor our servers every minute. If your site is on our hosting, we can help you put these measures in place, and if you've already been hacked, clean it up and get it back online.