How to Protect Your WordPress Site
I am not a security expert, but I have considerable experience developing WordPress sites, and from the beginning I realized that security is one of the most important things to learn. WordPress is a robust and very comprehensive platform whose popularity has made it a target for attacks and security exploits. A website on this platform without the proper security measures will be easy prey for hacking and malware.
What do we need to protect our website from? Many threats: malware, hackers, and even people within our organization or our clients' organizations who may wish to disrupt the site's operation or steal information. New vulnerabilities are constantly being discovered in WordPress core as well as in plugins and themes. Keeping everything up to date is not enough; we must anticipate vulnerabilities and act as though we knew an attack on our website were imminent. User privileges and passwords are only as secure as the weakest link in the chain of security tools, systems, technologies, habits, and practices at our disposal.
Security is not a plugin you install or a list of best practices. Security is a way of thinking: anticipating risks and finding weaknesses. Every risk or weakness must be addressed with a solution, and we must look for possible risks or weaknesses in that solution.
We must also begin with the understanding that web developers generally have no control over server security. Our directory and installation may be perfectly secured, but there is always a chance that an attack will come through a server vulnerability. That is why I recommend purchasing web hosting from reputable, well-established providers, as it is reasonable to assume that they will have sufficient experience and security.
There are three aspects that we, as web developers, can protect: (1) the security of the files on the server, (2) communication with the server, and (3) access to WordPress. Below I will list some solutions for protecting these three aspects. These solutions go beyond the common best practices for a WordPress installation that every developer should follow. I am certain that a security expert could find problems with my solutions, but experience has shown me that implementing them is better than the alternative.
SSL
SSL (Secure Sockets Layer) is a security protocol that makes it possible to establish encrypted communication with the server. It is advisable to use it because all the information we send to or receive from the server through WordPress will be encrypted, including, for example, our own login password. A free SSL certificate can be obtained from Let's Encrypt, and we can simply use plugins or code to force all communication with the server to take place over HTTPS (HTTP over SSL). At this link there is a very thorough article about how to move a WordPress site from HTTP to HTTPS.
SFTP
Another form of communication with the server that we must protect is the FTP connection. We can transfer files in encrypted form using SFTP (SSH File Transfer Protocol), which is an extension of SSH (Secure Shell Protocol). The option to use SFTP instead of plain FTP must be available from the hosting provider, so this is something to check before purchasing the service. Note: the hosting provider I can recommend is DreamHost, since it offers SFTP and can obtain and install the SSL certificate mentioned above free of charge.
Firewalls and Monitoring
A firewall is a security system that controls a network's incoming and outgoing traffic. It can be thought of as a barrier between your website and the rest of the internet, denying access to connections that violate certain rules—for example, connections that exceed a set number of attempts per minute, originate from malicious IP addresses, repeatedly fail to log in to WordPress, use a nonexistent WordPress username, and more. I recommend two plugins that perform this function using different techniques and features, which means they can be used together. BulletProof Security performs some basic functions, such as limiting the number of attempts to log in to WordPress, among other things, but it also uses .htaccess files to restrict access to certain directories and risky files. Wordfence is another firewall that, in addition to controlling traffic, can periodically scan WordPress, plugin, and theme files, compare them with their respective official repositories, and detect changes that may represent a malware injection. It also sends alerts about potential vulnerabilities and risks. These two plugins work very well in combination, even though some of their rules are redundant—a redundancy that increases protection.
There is also a service that I consider the best, called Sucuri.net. This service acts as a firewall and periodically scans the website for malware, but, in the event of an infection, it also cleans the site within hours and sometimes within minutes. I have used this service when new clients contacted me with a hacked site, and it is the best way to remove all the malware and detect vulnerabilities quickly.
Protecting Access to WordPress
There are several techniques that can be followed to keep a site protected in this area. Many of the attacks WordPress sites receive are known as brute-force attacks, which use trial and error to try to guess the administrator account's login credentials. Firewalls can certainly help defend the website against these attacks, but the defense must begin with the usernames and passwords we choose. I recommend using long, unobvious usernames and long passwords containing uppercase and lowercase letters, numbers, and symbols. At this link there is a very thorough article on best practices for creating secure passwords.
Another way to protect access is to use “two-factor authentication” or “two-step verification,” a security technique used by many web platforms that consists of having an additional factor, independent of the username and password, that is required to enter a system. This is generally a code—although it may also be a device such as a USB drive—that must be used to gain access after the username and password have been entered. In most cases, the code can be received by text message on a mobile phone or by email when someone attempts to log in. For example, if I want to log in, I enter my username and password and receive a text message with the additional access code, so only someone who has my mobile phone will possess the piece needed to gain entry (this is how it works on Twitter, for example). Google has an application available for iOS and Android called Google Authenticator, which can hold access codes for multiple accounts. The codes in this application change every few seconds, so after entering the username and password, the code valid at that moment must also be entered. To accomplish the same thing in WordPress, I use a plugin called Google Authenticator that works with Google's own app.
A third way to protect access is to hide the login URL. It is difficult to enter a house without the key, but it is even more difficult if you do not know where the door is. I use a plugin called WPS Hide Login that makes it possible to change the login URL to a custom one. Suppose your website is “http://example.org/” and the URL for logging in is therefore “http://example.org/wp-admin/”. With this plugin, that URL can be disabled, and the login URL can be changed to a custom one such as “http://example.org/whatever-you-want/”.
Backups
It is madness to maintain a website without an automated periodic backup system. It is true that web-hosting services can generally restore backups upon request; however, some retain backups from only the last week or two. Moreover, I prefer not to rely on third parties and to keep my own backups, and when it comes to backups, redundancy is advisable. I use a plugin called UpdraftPlus that can make periodic backups and store them on remote servers, whether servers accessed via FTP or third-party services such as Dropbox, Google Drive, Amazon S3, and others. As many file and database backups as desired can be retained, and there are many configuration options.