- Did you know that almost half a billion websites
are run on WordPress?
That's estimated to be about 35% of the internet.
And since you're watching this video,
my guess is that you use WordPress as well.
Welcome to the club which is apparently a very big club.
While there's strength in numbers,
the way that WordPress allows users to customize
and add plugins also adds a lot of security issues.
So what are the most important things you can do
today to secure your WordPress website?
Well, there are plenty to choose from,
but I'm boiling it down to these settings
every WordPress install needs no matter how big or small.
(air whooshing)
Hey, thanks for joining me on another
All Things Secured Video.
My name's Josh and my goal here is to explain
where your website might be vulnerable.
I realized that most of us don't have the ability
to hire a full time web developer.
So we ended up piecing together a website
that looks good on the front end,
but often has plenty of vulnerabilities
we're sometimes not even aware of on the backend.
I'm gonna walk us through each of these changes
I'm gonna describe, most of which are completely free.
Alright, enough of the chit-chat let's get started.
Now, before we get too deep in the weeds,
let's start with the most hackable part of any website,
the login page.
In my opinion, there are four things you need to do
to lock up this part of your website.
Remove admin as a login option,
create a stronger login password,
limit login attempts, and most importantly,
move your login page to a custom URL.
Let's look at each of these individually.
First, in some cases a WordPress install
automatically creates a default user named admin.
And this makes an easy target for hackers
and just isn't a good best practice in general.
Unfortunately, getting rid of an admin user
isn't always intuitive and depends a lot
on the host you use.
If I were you, I would create another user
under a different name and email address
and then give that an Administrator role.
When you log in with that new admin user,
try to delete the old one and transfer
everything over to the new one
while you're at it, make sure you create a strong password
for any administrative user.
You can use the tool shown here
or mentioned in the description
to test whether your password is strong enough.
And the two file changes can be made
with the use of two recommended WordPress plugins
WPS Hide Login and WPS Limit Login.
The Hide Login plugin allows you to change the login URL
while the Limit Login does exactly what it sounds like.
It limits how many times a user can try to log in
with an incorrect password.
Both of these tools are meant to mitigate the risk
of brute force attacks that can cripple your website.
Links to these free plugins are in the description below
as is pretty much everything else.
Okay. Next we're gonna move into changes you can make
within the WordPress backend to make your site more secure.
Let's start with an easy one, unused plugins and themes.
Even if they're not active,
these files can still have security bugs
that can be exploited and could even hurt
your site's performance.
Remember, you can always re-install these plugins
and themes later.
So just go through for a few minutes
and delete the ones that are inactive.
Next, I recommend you go through all your current plugins
and check when they were last updated.
You can do that by clicking the view details
under the plugins page
which will show you when it was last updated.
Personally, I don't wanna keep a plugin
that isn't updated at least once every six months.
But for most people I'd say that
even if it's been more than a year,
you should start looking for a way to replace that plugin.
Finally, it's worth taking a moment
to double check the users you have on your site.
Sometimes we create user profiles for other authors,
team members, or for customer support.
And if you're like me, you don't always remember
to delete unused profile.
So go ahead and do that right now.
That is a security risk.
Finally, I wanna touch on a few preventative measures
you can take to lay a stronger foundation for your website
both now and in the future.
The first is simple,
keep your plugins and core WordPress installed
updated to the latest version.
The problem a lot of people run into here,
is that they've had a bad experience
with an update breaking their website.
I get it. It's happened to me too.
But there's a reason that these updates happen
and a lot of times it has to do with patching up
security bugs that they find.
Some hosting companies allow you to create a staging site
which is basically a clone of your current website,
where you can test the updates
and then if that works, push them to live.
Other hosts and agencies offer a plugin updating service
where they do all this for you for a fee.
Whatever you choose, try your best
to keep everything updated.
And while we're on the subject of website hosting,
it's worth pointing out that as you grow,
this is not an expense worth skimping on.
Paying $5 a month for hosting is fine
if you get 10 visitors a day.
But if you're getting any significant amount of traffic,
you should really consider upgrading
to what's known as managed WordPress hosting.
This kind of hosting has a number of benefits
that usually include daily backups,
firewall protection, managed updates with new PHP versions,
SSL certificates, forced HTTPS, et cetera, et cetera.
Instead of spending money on a security plugin like Securi,
which is really popular among affiliate marketers
if you've been doing your research online,
you really ought to take and invest that money
into better hosting.
I recommend something like WP engine,
Flywheel, SiteGround,
although there are plenty of other good ones out there.
If you've made it this far congratulations.
I hope you're walking away with some actionable changes
that you can make to secure your WordPress install.
If you have any questions, leave them in the comments.
I promise I'll do my best to respond.
If this video is helpful, give it a thumbs up
and subscribe for more security related content
on All Things Secured.