WordPress Security Best Practices
0 likes4,100 views
The document outlines best practices for WordPress security, highlighting common attacks such as cross-site scripting, brute-force attacks, SQL injections, and DDoS. It emphasizes the importance of using strong passwords, keeping software updated, implementing two-factor authentication, and utilizing security plugins like iThemes Security and Wordfence. The document also advises on the significance of regular backups and choosing trusted plugins to enhance overall site protection.
WordPress Security Best Practices
- 1. BEST PRACTICES FOR WORDPRESS SECURITYJason Yingling (@jason_yingling)
- 2. COMMON ATTACKS Cross Site Scripting (XSS) Attackers can inject malicious scripts into a page that can be used to steal data from users. Common Cause(s) Bad / outdated plugins Non-sanitized code Not validating input data
- 3. COMMON ATTACKS Brute-force Attacks Attackers run scripts to try to crack logins by trying known user and password combos. Common Cause(s) Weak passwords Unlimited login attempts Tip https://haveibeenpwned.com/
- 4. COMMON ATTACKS SQL Injections Attackers inject SQL into the site’s database, typically through plugin vulnerabilities, allowing them access to the database to do as they please. Common Cause(s) Bad / outdated plugins Non-sanitized code Not validating input data
- 5. COMMON ATTACKS DDOS Multiple systems are used to target a single site causing it to overload and go down Common Cause(s) Lack of firewalls
- 6. PROTECT YOUR LOGIN Don’t use admin username Use strong passwords Hide the login page Two Factor Authentication Limit Login Attempts Plugins iThemes Security WordFence Limit Login Attempts reloaded Pro Tip Use site specific emails: [email protected]
- 7. KEEP THINGS UP TO DATE Keep WordPress core updated Keep plugins and themes updated Use the latest version of PHP Pro-tip Used managed WordPress hosting
- 8. PICK GOOD PLUGINS Trusted sources Recent updates Active installs Check the support forums More Picking Good WordPress Plugins
- 9. TAKE FREQUENT BACKUPS Database and file system backups Test backups from time to time Store the backups off server
- 10. USE A FIREWALL Protect against known attacks Helps with DDoS mitigation Services Cloudflare Sucuri
- 11. USEFUL PLUGINS iThemes Security WordFence Limit Login Attempts Reloaded
- 12. SECURITY RESOURCES Kinsta WordPress Security Guide Wordfence - How to Prevent Cross Site Scripting Attacks wpbeginner - The Ultimate WordPress Security Guide WordPress Security: An Introduction to Hardening WordPress