Hello, this is Alex from Liquid Web with our video on Five Tips to Secure Your WordPress Site.
So we'll start with tip #1: Keep WordPress up-to-date.
This is our top recommended tip because the updates directly patch known problems with WordPress.
The longer you wait to update your WordPress version, the more vulnerabilities
there are that can be used to inject malicious code, upload phishing pages,
steal data, or just break your site. Turning on automatic updates would be recommended to help ensure your site gets updated regularly
in case you forget, or just don't have the time to get around to it.
I'd also recommend updating all plugins and themes which brings us to tip #2: Review your plugins and themes.
First, remove any plugins and themes you don't need.
I don't even recommend leaving them disabled as the files would still be sitting out there in folders on the server
which could potentially be used if there was an exploit on them. They can't be exploited if they aren't there!
Next, make sure the plugins and themes you do keep are all up-to-date. Again, automatic updates would be recommended
but even if a plug-in is up-to-date, if the development has been abandoned on a plug-in or theme you use
there could be exploits that may never be patched.
If you have older plugins and themes, you may want to search the internet to see if there are any known issues and possibly look for
replacements that do still get updates.
Tip 3 is to protect your logins. Don't reuse the same username and password across sites.
Make sure to use good, strong passwords and only give information to people you trust.
I'd also recommend going over your users list and removing any you don't need anymore.
Then, another way to protect the logins is to hide the WordPress login page itself.
Normally, you can just go to your domain.com/wp-admin or wplogin.php and get the login page.
But there are different plugins that can change the URL you have to go to.
This would hide the page from bots so it wouldn't even give them the chance to try to guess a password.
There are lots of plugins that can do this, but I'll show you one that I like to use: iTheme Security.
So to give you a demonstration here. In iTheme Security, search for "hide," and go to "hide back-end," "configure settings."
Check the box for "Enable the hide back-end features."
Here you can change the URL you'll actually go to.
I changed it to "youwillneverguessthis."
Then if I open up a new private tab and go to
"example.com/wp-login.php"
It gives me this "Oops. That page can't be found."
But then if I go to "example.com/youwillneverguessthis," it then forwards to the login page correctly.
Which brings us to tip #4: Install protection plugins.
One of the best parts about WordPress is all of the plugins available
so you can likely find some plugins that will suit your specific needs.
I'd recommend searching through the WordPress plugin pages, ask around to see what other people use,
and read some reviews to see the pros and cons of each one.
One of my favorite plugins is the iTheme security plugin I mentioned before.
This one plugin has lots of different features,
so if you aren't sure about what to do,
try this one out. Read through the options and see what would be a good fit for your site.
If your site helps provide you and your business with a lot of income, then you may want to consider buying a paid version just to offer more security.
Then finally tip #5: Make sure you have good backups.
This may not seem like something important to protect your site itself,
but it's more about saving time and energy put into making the site in case something does happen.
I would recommend having multiple backups saved in multiple locations if possible,
then test to make sure that the backups are good and that you have a plan to recover in case there was a problem,
like if your site was hacked, if somebody accidentally deletes something, if an update breaks the site, or even if a hard drive fails.
Setting up a disaster recovery plan for different events can help get the site back up and running to help avoid
downtime for your customers. If something happened and you didn't have any backups, then depending on what was lost,
it could mean lots of downtime and lost revenue.
So, that's all the tips we have for this video.
Hopefully, you gained something useful!
If you or a friend are in the market for a web host, feel free to talk to a Liquid Web tech by phone, or in a chat, 24 hours a day.
Thank you for watching!