Introduction
Building a successful website requires a lot of work and attention to detail, even when using WordPress. If you want to store user data, retain visitors and make a profit while you’re at it, you’ll need to put some serious time and effort into security.
Luckily, working with WordPress this job becomes relatively easy. Just remember that security takes time and attention no matter the tool you are using, and it is certainly not a one-step task. It is a continuous process which requires you to stay up to date regarding news and the newest security tools available.
If you are looking for basic protection of your website, implementation will require the following steps:
- Regular backups
- Updated WordPress, themes, and plugins
- A strong username and password
- Limit third-party access
In this article we will run through these steps with pre-existing WordPress plugins.
Site Backup
Keeping a website online requires many small tasks to be accomplished consistently by a wide variety of moving parts. As a result, there is always a chance that something could go wrong and destroy all (or part of) your hard work. No matter how many other security steps you take, making a backup is still an absolute must, regardless of the website size.
You can either make a manual backup or use a plugin for this task.
One of the highest-ranked WordPress backup plugins is UpdraftPlus, which comes with many features like backups to Google Drive, Amazon S3, FTP, Dropbox, and other storage options. It also offers quick restore, scheduling, site duplicator and the ability to split large sites into multiple archives when necessary.
There are also premium plugins that offer more features in your website is more robust. For example, BackupBuddy is a plugin that can be used to create full databases or file backups and can also facilitate moving a site to a different server. The price ranges between $80 and $150 per year with the option to upgrade to the lifetime Gold package at a one-time fee of $297. This is a great option for business sites in particular.
Update Everything
From WordPress to any plugin or theme, one of the most important steps for improving security is keeping everything up to date. Software is never bug-less, so keep an eye out for the frequent bug fixes that will pop up and need to be addressed. Improvements are constant, so keep on top of the softwares evolution.
WordPress releases and automatically installs security updates. However, sometimes when performing major updates it can be necessary to run a manual intervention. These are usually quite simple as well, so just make sure you catch them when they become available.
Use Strong Passwords
The default username for WordPress is admin. As I’m sure you’ve guessed, this is not a strong password. During an attack, this will almost always be the first username a hacker will attempt. You can use any other username, but a great solution is to use your email address.
For password generation, the easiest solution is to use the password generator already available in WordPress. It will generate a random string which should be secure enough in most cases. Make sure you keep this password somewhere safe.
Limit Access
This is a principle that holds true across many other fields in IT. Generally, limited access is the smartest way to handle many people accessing the same resource. The golden rule? No one should have more privileges than those required to do their job. Of course, this is also valid in managing websites or managing plugins access.
Be sure to carefully configure folder and file permissions by giving reading and writing permissions only to people and plugins strictly required by the normal usage of the site.
In order to add and manage users, you’ll want to pop into the WordPress Dashboard and go to the Users panel. Here you can change user roles and access, being sure to be the only Administrator (or at least limit the number of users with full access).
Conclusion
Taking care of the security of a website can be a boring task, but it’s strictly required in almost all cases. There are so many ways that an attack can occur, in fact they are likely happening on a daily basis! Hackers, botnets and other entities are consistently trying to access your sites, so the time spent updating your securities will always pay off. WordPress helps in the process by automating almost everything, but at the end of the day, it is always best to treat your role as the ‘admin’ as though you are your website’s security guard. Keep an eye out and keep on top of updates!
