WordPress Security – 19+ Steps to Lock Down Your Site - Lorblog
By Lorblog May 17, 2018 Wordpress Security No Comments
When it comes to WordPress security, there are a lot of things you can do to lock down your site to prevent hackers and vulnerabilities from affecting your business or blog. The last thing you want to happen is to wake up one morning to discover your site in shambles. So today we are going to be sharing a lot of tips, strategies, and techniques you can use to better your WordPress security and stay protected.
WordPress gets a bad rap sometimes for being prone to security vulnerabilities and inherently not being a safe platform to use for a business. However, this is almost always due to the fact that users keep following industry-proven security worst-practices. Using outdated WordPress software, poor system administration, credentials management, and lack of necessary Web and security knowledge among non-techie WordPress users keeps hackers on top of their cyber-crime game. Even industry leaders don’t always use best practices. Reuters was hacked back in 2012 because they were using an outdated version of WordPress.
Now this is not to say vulnerabilities don’t exist. According to a Q2 2016 study by Sucuri, a multi-platform security company, WordPress continues to lead the infected websites they worked on (at 74%). And the top three plugins affecting that platform are still Gravity Forms, TimThumb, and RevSlider. This is however down quite a bit from Q1 2016.
WordPress powers over 29.3% of all websites on the internet, and with hundreds of thousands of theme and plugin combinations out there, it is not surprising that vulnerabilities exist and are constantly being discovered. However, there is also a great community around the WordPress platform, to ensure these things get patched ASAP. The WordPress security team is made up of approximately 25 experts including lead developers and security researchers — about half are employees of Automattic and a number work in the web security field.
The aptly named backdoor vulnerability provides hackers with hidden passages bypassing security encryption to gain access to WordPress websites via abnormal methods – wp-Admin, SFTP, FTP, etc. Once exploited, backdoors enable hackers to wreak havoc on hosting servers with cross-site contamination attacks – compromising multiple sites hosted on the same server. In Q2 2016 Sucuri reported that backdoors continue to be one of the many post-hack actions attackers take, with 71% of the infected sites having some form of backdoor injection.
Moving parts of a Pharma Hack include backdoors in plugins and databases, which can be cleaned up following the instructions from this Sucuri blog. However, the exploits are often vicious variants of encrypted malicious injections hidden in databases and require a thorough clean-up process to fix the vulnerability. Nevertheless, you can easily prevent Pharma Hacks by using recommend WordPress hosting providers with up to date servers and regularly updating your WordPress installations, themes and plugins.
Malicious redirects create backdoors in WordPress installations using FTSP, SFTP, wp-admin and other protocols and injects redirection codes into the website. The redirects are often placed in your .htaccess file and other WP core files in encoded forms, directing the Web traffic to malicious sites. WordPress users can use free scanners that effectively detect malicious directs such as SiteCheck, Bots vs. Browsers and listening to user comments. We will go through some ways you can prevent these in our WordPress security steps further below.
Perhaps the most dangerous of them all, Denial of Service (DoS) vulnerability exploits errors and bugs in the code to overwhelm the memory of website operating systems. Hackers have compromised millions of websites and raked millions of dollars by exploiting outdated and buggy versions of WordPress software with DoS attacks. Although financially motivated cybercriminals are less likely to target small companies, they tend to compromise outdated vulnerable websites in creating botnet chains to attack large businesses.
Even the latest versions of WordPress software cannot comprehensively defend against high-profile DoS attacks, but will at least help you to avoid getting caught in the crossfire between financial institutions and sophisticated cybercriminals. And don’t forget about October 21st, 2016. This was the day the internet went down due to a DNS DDoS attack. Read more about why it is important to use a premium DNS provider and failover strategy to increase your WordPress security.
WordPress Security Guide 2018
According to internet live stats over 60,000 websites are hacked every day. That is why it is so important to take some time and go through the following recommendations below on how to better harden your WordPress security.
WordPress Security Index
When it comes to WordPress security, there is much more than just locking down your site, although we will give you the best recommendations on how to do that below. There is also web server-level security for which your WordPress host is responsible. We take security very seriously here at Kinsta and handle a lot of these issues for our clients. It is very important that you choose a host that you can trust for your business. Or if you are hosting WordPress on your own VPS, then you need to have the technical knowledge to do these things yourself.
Server hardening is the key to maintaining a thoroughly-secure WordPress environment. It takes multiple layers of hardware and software level security measures to ensure the IT infrastructure hosting WordPress sites is capable of defending against sophisticated threats, both physical and virtual. For this reason, servers hosting WordPress should be updated with the latest operating system and (security) software as well as thoroughly tested and scanned for vulnerabilities and malware. A recent example of this took place when we recently had to patch NGINX for OpenSSL security vulnerabilities that were discovered.
We use Google Cloud Platform here at Kinsta for all of our WordPress customers to ensure secure WordPress hosting. A big advantage of this is that it is built on a security model that has been built upon over the course of 15 years, and currently secures products and services like Gmail, Search, etc. Google currently employs more than 500 full-time security professionals. Kinsta also uses Linux containers (LXC), and LXD to orchestrate them, on top of Google Cloud Platform which enables us to completely isolate not just each account, but each separate WordPress site. This is a much more secure method than offered by other competitors.
PHP is the backbone of your WordPress site and so using the latest version on your server is very important. Each major release of PHP is typically fully supported for two years after its release. During that time, bugs and security issues are fixed and patch on a regular basis. As of right now, anyone running on a version of PHP below 5.6 no longer has security support and are exposed to unpatched security vulnerabilities.
And guess what? According to the official WordPress Stats page, as of writing this, over 35% of WordPress users are still using a version of PHP that is lower than 5.6. That is scary! Sometimes it does take businesses and developers time to test and ensure compatibility with their code, but they have no excuse to run on something without security support.
Don’t know which version of PHP you are currently on? Most hosts typically include this in a header request on your site. A quick way to check is to run your site through Pingdom. Click into the first request and look for a X-Powered-By parameter. Typically this will show the version of PHP your web server is currently using.
X-Powered-By HTTP header
Here at Kinsta we only support stable and supported versions of PHP, including 5.6, 7, 7.1, and 7.2. You can even switch between PHP versions with a click of a button from within the My Kinsta dashboard.
Switch PHP version
Surprisingly one of the best ways to harden your WordPress security is to simply use clever usernames and passwords. Sounds pretty easy right? Well, check out SplashData’s 2017 annual list of the most popular passwords stolen throughout the year (sorted in order of popularity).
It is also important to use different passwords for every website. The best way to store them is locally in an encrypted database on your computer. A good free tool for this is KeePass. If you don’t want to go down this route there are also online password managers such as LastPass or TeamPassword. Even though your data is hosted securely in the cloud, these are generally more safe since you aren’t using the same password across multiple sites.
You can also rename your current admin username manually in phpMyAdmin with the following command. Make sure to backup your database before editing tables:
4. Always Use Latest Version of WordPress and Plugins
Another very important way to harden your WordPress security is to always keep it up to date. This includes WordPress core and your plugins. These are updated for a reason, and a lot of times these include security enhancements and bug fixes. We recommend you to read our in-depth guide on this topic: A Deep Dive Into WordPress Automatic Updates.
Did you know that it has been reported that plugin vulnerabilities represent 55.9% of the known entry points for hackers? That is what WordFence found in a 2016 study where they interviewed over 1,000 WordPress site owners that had been victims of attacks. By updating your plugins you can better ensure that you aren’t one of these victims. It is also recommended that you only install trusted plugins. The “featured” and “popular” categories in the WordPress repository can be a good place to start.
There are a couple easy ways to update your WordPress installation. If you are a Kinsta customer we provided automatic backups with a one-click restore option. This way you can test new versions of WordPress and plugins without having to worry about it breaking anything. Or you could also first test in our staging environment. To update WordPress core you can click into “Updates” in your WordPress dashboard and click on the “Update Now” button.
You can also update WordPress manually by downloading the latest version and uploading it via FTP.
It is also important to note that developers don’t always keep their plugins up to date. The team over at WP Loop did a great little analysis of just how many WordPress plugins in the repository aren’t up to date with the current WordPress core. According to their research nearly 50% of the plugins in the repository have not been updated in over 2 years. This doesn’t mean the plugin won’t work with the current version of WordPress, but it is recommended that you choose plugins that are actively updated. Out of date plugins are more likely to contain security vulnerabilities.
Use your best judgment when it comes to plugins. Look at the “Last Updated” date and how many ratings a plugin has. As seen in the example below, this one is out of date and has bad reviews so we would most likely recommend staying away from it.
Sometimes the popular strategy of WordPress security by obscurity is appropriately effective for an average online business and WordPress site. If you make it harder for hackers to find certain backdoors then you are less likely to be attacked. Locking down your WordPress adminarea and login is a good way to beef up your security. Two great ways to do this is first by changing your default wp-admin login URL and also limiting login attempts.
Security by obscurity can be a very effective way to beef up your #WordPress security.CLICK TO TWEET
By default your WordPress site’s login URL is domain.com/wp-admin. One of the problems with this is that all of the bots, hackers, and scripts out there also know this. By changing the URL you can make yourself less of a target and better protect yourself against brute force attacks. This is not a fix all solution, it is simply one little trick that can definitely help protect you. To change your WordPress login URL we recommend using the free WPS Hide login plugin.
The plugin only has one option and is fast to configure. Once activated simply change your WordPress login URL under the “General” section in settings. Remember to pick something unique that won’t already be on a list that a bot or script might attempt to scan.
Hide WordPress login URL
While the above solution of changing your admin login URL will decrease a majority of the bad login attempts, putting a limit in place can also be very effective. The free Cerber Limit Login Attempts plugin is a great way to easily setup lockout durations, login attempts, and IP whitelists and blacklists.
And of course, we can’t forget two-factor authentication! No matter how secure your password is there is always a risk of someone discovering it. Two-factor authentication involves a 2 step process in which you need not only your password to login but a second method. It is generally a text (SMS), phone call, or time-based one-time password (TOTP). In most cases, this is 100% effective in preventing brute force attacks to your WordPress site. Why? Because it is almost impossible that the attacker will have both your password and your cellphone.
There are really two parts when it comes to two-factor authentication. There is first is your account and or dashboard that you have with your web hosting provider. If someone gets access to this they could change your passwords, delete your websites, change DNS records, and all sorts of horrible things. We here at Kinsta partnered up with Authy and have two-factor authentication available for your My Kinsta dashboard.
The second part of two-factor authentication pertains to your actual WordPress installation. Authy has an official WordPress plugin which you can download and use. Their free plan is limited to 100 authorizations per month, but their paid plans start at a very reasonable $0.09/auth with unlimited users and authorizations.
If you are looking for a completely free option than the Google Authenticator plugin is a great alternative. It also allows an unlimited amount of users. Once installed you can click into your user profile, mark it active and create a new secret key or scan the QR code.
You can then use one of the free Authenticator Apps on your phone:
Windows Phone Authenticator App
After enabling this it will now require your normal password to login plus the code from the Google Authenticator app on your phone. You will notice an additional field that now appears on your WordPress login page. Also, this plugin is fully compatible with the WPS Hide login plugin we mentioned earlier.
One of the most overlooked ways to harden your WordPress security is to install an SSL certificate and run your site over HTTPS. HTTPS (Hyper Text Transfer Protocol Secure) is a mechanism that allows your browser or web application to securely connect with a website. A big misconception is that if you aren’t accepting credit cards that you don’t need SSL. Well, let us explain a few reasons why HTTPS is important beyond just eCommerce. Many hosts, including Kinsta, now even offer free SSL certificates with Let’s Encrypt.
Of course, the biggest reason for HTTPS is the added security, and yes this does pertain strongly to eCommerce sites. However, how important is your login information? For those of you running multi-author WordPress websites, if you are running over HTTP, every time a person logs in, that information is being passed to the server in plain text. HTTPS is absolutely vital in maintaining a secure connection between a website and a browser. This way you can better prevent hackers and or a middle man from gaining access to your website. So even WordPress blogs, news sites, agencies, all can benefit from HTTPS as this ensures nothing ever passes in plain text.
The Chrome team announced that beginning in January 2017, they will mark HTTP sites that transmit passwords or credit cards as non-secure. This is especially important if your website get’s a majority of its traffic from Chrome. You can look in Google Analytics under the Audience section in Browser & OS so see the percentage of traffic your WordPress site gets from Google Chrome. Google is making it a lot more clear to visitors that your WordPress website might not be running on a secured connection.
Because of a new protocol called HTTP/2, a lot of times, those running properly optimized sites over HTTPS can even see speed improvements. HTTP/2 requires HTTPS because of browser support. The improvement in performance is due to a variety of reasons such as HTTP/2 being able to support better multiplexing, parallelism, HPACK compression with Huffman encoding, the ALPN extension, and server push. And with TLS 1.3 being launched as of March 21st, 2018, HTTPS connections are even faster.
By default your wp-config.php file resides in the root directory of your WordPress installation (your /public HTML folder). But you can move this to a non-www accessible directory. Aaron Adams wrote up a great explanation of why this is beneficial.
Note: this won’t work for Kinsta users, due to how our environment is setup.
WordPress security keys are a set of random variables that improve encryption of information stored in the user’s cookies. Since WordPress 2.7 there have been 4 different keys: AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY. When you install WordPress these are generated randomly for you. However, if you have gone through multiple migrations or purchased a site from someone else, it can be good to create fresh WordPress keys.
To disable this completely you can install the free Disable XML-RPC plugin. Or you can disable it with the premium perfmatters plugin, which also contains web performance improvements. If you are a customer here at Kinsta this is not needed because when an attack through XML-RPC is detected a little snippet of code is added into the NGINX config file to stop them in their tracks – producing a 403 error.
WPBeginner has a great little snippet of code you can use to remove this. Simply add the following to your WordPress theme’s functions.php file.
WordPress Security 101 – How to secure your WordPress site against hackers
Learn more about WordPress core software security in this free white paper
WordPress Security – 19+ Steps to Lock Down Your Site - Lorblog
By Lorblog May 17, 2018 Wordpress Security No Comments
When it comes to WordPress security, there are a lot of things you can do to lock down your site to prevent hackers and vulnerabilities from affecting your business or blog. The last thing you want to happen is to wake up one morning to discover your site in shambles. So today we are going to be sharing a lot of tips, strategies, and techniques you can use to better your WordPress security and stay protected.
WordPress gets a bad rap sometimes for being prone to security vulnerabilities and inherently not being a safe platform to use for a business. However, this is almost always due to the fact that users keep following industry-proven security worst-practices. Using outdated WordPress software, poor system administration, credentials management, and lack of necessary Web and security knowledge among non-techie WordPress users keeps hackers on top of their cyber-crime game. Even industry leaders don’t always use best practices. Reuters was hacked back in 2012 because they were using an outdated version of WordPress.
Now this is not to say vulnerabilities don’t exist. According to a Q2 2016 study by Sucuri, a multi-platform security company, WordPress continues to lead the infected websites they worked on (at 74%). And the top three plugins affecting that platform are still Gravity Forms, TimThumb, and RevSlider. This is however down quite a bit from Q1 2016.
WordPress powers over 29.3% of all websites on the internet, and with hundreds of thousands of theme and plugin combinations out there, it is not surprising that vulnerabilities exist and are constantly being discovered. However, there is also a great community around the WordPress platform, to ensure these things get patched ASAP. The WordPress security team is made up of approximately 25 experts including lead developers and security researchers — about half are employees of Automattic and a number work in the web security field.
The aptly named backdoor vulnerability provides hackers with hidden passages bypassing security encryption to gain access to WordPress websites via abnormal methods – wp-Admin, SFTP, FTP, etc. Once exploited, backdoors enable hackers to wreak havoc on hosting servers with cross-site contamination attacks – compromising multiple sites hosted on the same server. In Q2 2016 Sucuri reported that backdoors continue to be one of the many post-hack actions attackers take, with 71% of the infected sites having some form of backdoor injection.
Moving parts of a Pharma Hack include backdoors in plugins and databases, which can be cleaned up following the instructions from this Sucuri blog. However, the exploits are often vicious variants of encrypted malicious injections hidden in databases and require a thorough clean-up process to fix the vulnerability. Nevertheless, you can easily prevent Pharma Hacks by using recommend WordPress hosting providers with up to date servers and regularly updating your WordPress installations, themes and plugins.
Malicious redirects create backdoors in WordPress installations using FTSP, SFTP, wp-admin and other protocols and injects redirection codes into the website. The redirects are often placed in your .htaccess file and other WP core files in encoded forms, directing the Web traffic to malicious sites. WordPress users can use free scanners that effectively detect malicious directs such as SiteCheck, Bots vs. Browsers and listening to user comments. We will go through some ways you can prevent these in our WordPress security steps further below.
Perhaps the most dangerous of them all, Denial of Service (DoS) vulnerability exploits errors and bugs in the code to overwhelm the memory of website operating systems. Hackers have compromised millions of websites and raked millions of dollars by exploiting outdated and buggy versions of WordPress software with DoS attacks. Although financially motivated cybercriminals are less likely to target small companies, they tend to compromise outdated vulnerable websites in creating botnet chains to attack large businesses.
Even the latest versions of WordPress software cannot comprehensively defend against high-profile DoS attacks, but will at least help you to avoid getting caught in the crossfire between financial institutions and sophisticated cybercriminals. And don’t forget about October 21st, 2016. This was the day the internet went down due to a DNS DDoS attack. Read more about why it is important to use a premium DNS provider and failover strategy to increase your WordPress security.
WordPress Security Guide 2018
According to internet live stats over 60,000 websites are hacked every day. That is why it is so important to take some time and go through the following recommendations below on how to better harden your WordPress security.
WordPress Security Index
When it comes to WordPress security, there is much more than just locking down your site, although we will give you the best recommendations on how to do that below. There is also web server-level security for which your WordPress host is responsible. We take security very seriously here at Kinsta and handle a lot of these issues for our clients. It is very important that you choose a host that you can trust for your business. Or if you are hosting WordPress on your own VPS, then you need to have the technical knowledge to do these things yourself.
Server hardening is the key to maintaining a thoroughly-secure WordPress environment. It takes multiple layers of hardware and software level security measures to ensure the IT infrastructure hosting WordPress sites is capable of defending against sophisticated threats, both physical and virtual. For this reason, servers hosting WordPress should be updated with the latest operating system and (security) software as well as thoroughly tested and scanned for vulnerabilities and malware. A recent example of this took place when we recently had to patch NGINX for OpenSSL security vulnerabilities that were discovered.
We use Google Cloud Platform here at Kinsta for all of our WordPress customers to ensure secure WordPress hosting. A big advantage of this is that it is built on a security model that has been built upon over the course of 15 years, and currently secures products and services like Gmail, Search, etc. Google currently employs more than 500 full-time security professionals. Kinsta also uses Linux containers (LXC), and LXD to orchestrate them, on top of Google Cloud Platform which enables us to completely isolate not just each account, but each separate WordPress site. This is a much more secure method than offered by other competitors.
PHP is the backbone of your WordPress site and so using the latest version on your server is very important. Each major release of PHP is typically fully supported for two years after its release. During that time, bugs and security issues are fixed and patch on a regular basis. As of right now, anyone running on a version of PHP below 5.6 no longer has security support and are exposed to unpatched security vulnerabilities.
And guess what? According to the official WordPress Stats page, as of writing this, over 35% of WordPress users are still using a version of PHP that is lower than 5.6. That is scary! Sometimes it does take businesses and developers time to test and ensure compatibility with their code, but they have no excuse to run on something without security support.
Don’t know which version of PHP you are currently on? Most hosts typically include this in a header request on your site. A quick way to check is to run your site through Pingdom. Click into the first request and look for a X-Powered-By parameter. Typically this will show the version of PHP your web server is currently using.
X-Powered-By HTTP header
Here at Kinsta we only support stable and supported versions of PHP, including 5.6, 7, 7.1, and 7.2. You can even switch between PHP versions with a click of a button from within the My Kinsta dashboard.
Switch PHP version
Surprisingly one of the best ways to harden your WordPress security is to simply use clever usernames and passwords. Sounds pretty easy right? Well, check out SplashData’s 2017 annual list of the most popular passwords stolen throughout the year (sorted in order of popularity).
It is also important to use different passwords for every website. The best way to store them is locally in an encrypted database on your computer. A good free tool for this is KeePass. If you don’t want to go down this route there are also online password managers such as LastPass or TeamPassword. Even though your data is hosted securely in the cloud, these are generally more safe since you aren’t using the same password across multiple sites.
You can also rename your current admin username manually in phpMyAdmin with the following command. Make sure to backup your database before editing tables:
4. Always Use Latest Version of WordPress and Plugins
Another very important way to harden your WordPress security is to always keep it up to date. This includes WordPress core and your plugins. These are updated for a reason, and a lot of times these include security
 enhancements and bug fixes. We recommend you to read our in-depth guide on this topic: A Deep Dive Into WordPress Automatic Updates.
Did you know that it has been reported that plugin vulnerabilities represent 55.9% of the known entry points for hackers? That is what WordFence found in a 2016 study where they interviewed over 1,000 WordPress site owners that had been victims of attacks. By updating your plugins you can better ensure that you aren’t one of these victims. It is also recommended that you only install trusted plugins. The “featured” and “popular” categories in the WordPress repository can be a good place to start.
There are a couple easy ways to update your WordPress installation. If you are a Kinsta customer we provided automatic backups with a one-click restore option. This way you can test new versions of WordPress and plugins without having to worry about it breaking anything. Or you could also first test in our staging environment. To update WordPress core you can click into “Updates” in your WordPress dashboard and click on the “Update Now” button.
You can also update WordPress manually by downloading the latest version and uploading it via FTP.
It is also important to note that developers don’t always keep their plugins up to date. The team over at WP Loop did a great little analysis of just how many WordPress plugins in the repository aren’t up to date with the current WordPress core. According to their research nearly 50% of the plugins in the repository have not been updated in over 2 years. This doesn’t mean the plugin won’t work with the current version of WordPress, but it is recommended that you choose plugins that are actively updated. Out of date plugins are more likely to contain security vulnerabilities.
Use your best judgment when it comes to plugins. Look at the “Last Updated” date and how many ratings a plugin has. As seen in the example below, this one is out of date and has bad reviews so we would most likely recommend staying away from it.
Sometimes the popular strategy of WordPress security by obscurity is appropriately effective for an average online business and WordPress site. If you make it harder for hackers to find certain backdoors then you are less likely to be attacked. Locking down your WordPress adminarea and login is a good way to beef up your security. Two great ways to do this is first by changing your default wp-admin login URL and also limiting login attempts.
Security by obscurity can be a very effective way to beef up your #WordPress security.CLICK TO TWEET
By default your WordPress site’s login URL is domain.com/wp-admin. One of the problems with this is that all of the bots, hackers, and scripts out there also know this. By changing the URL you can make yourself less of a target and better protect yourself against brute force attacks. This is not a fix all solution, it is simply one little trick that can definitely help protect you. To change your WordPress login URL we recommend using the free WPS Hide login plugin.
The plugin only has one option and is fast to configure. Once activated simply change your WordPress login URL under the “General” section in settings. Remember to pick something unique that won’t already be on a list that a bot or script might attempt to scan.
Hide WordPress login URL
While the above solution of changing your admin login URL will decrease a majority of the bad login attempts, putting a limit in place can also be very effective. The free Cerber Limit Login Attempts plugin is a great way to easily setup lockout durations, login attempts, and IP whitelists and blacklists.
And of course, we can’t forget two-factor authentication! No matter how secure your password is there is always a risk of someone discovering it. Two-factor authentication involves a 2 step process in which you need not only your password to login but a second method. It is generally a text (SMS), phone call, or time-based one-time password (TOTP). In most cases, this is 100% effective in preventing brute force attacks to your WordPress site. Why? Because it is almost impossible that the attacker will have both your password and your cellphone.
There are really two parts when it comes to two-factor authentication. There is first is your account and or dashboard that you have with your web hosting provider. If someone gets access to this they could change your passwords, delete your websites, change DNS records, and all sorts of horrible things. We here at Kinsta partnered up with Authy and have two-factor authentication available for your My Kinsta dashboard.
The second part of two-factor authentication pertains to your actual WordPress installation. Authy has an official WordPress plugin which you can download and use. Their free plan is limited to 100 authorizations per month, but their paid plans start at a very reasonable $0.09/auth with unlimited users and authorizations.
If you are looking for a completely free option than the Google Authenticator plugin is a great alternative. It also allows an unlimited amount of users. Once installed you can click into your user profile, mark it active and create a new secret key or scan the QR code.
You can then use one of the free Authenticator Apps on your phone:
Windows Phone Authenticator App
After enabling this it will now require your normal password to login plus the code from the Google Authenticator app on your phone. You will notice an additional field that now appears on your WordPress login page. Also, this plugin is fully compatible with the WPS Hide login plugin we mentioned earlier.
One of the most overlooked ways to harden your WordPress security is to install an SSL certificate and run your site over HTTPS. HTTPS (Hyper Text Transfer Protocol Secure) is a mechanism that allows your browser or web application to securely connect with a website. A big misconception is that if you aren’t accepting credit cards that you don’t need SSL. Well, let us explain a few reasons why HTTPS is important beyond just eCommerce. Many hosts, including Kinsta, now even offer free SSL certificates with Let’s Encrypt.
Of course, the biggest reason for HTTPS is the added security, and yes this does pertain strongly to eCommerce sites. However, how important is your login information? For those of you running multi-author WordPress websites, if you are running over HTTP, every time a person logs in, that information is being passed to the server in plain text. HTTPS is absolutely vital in maintaining a secure connection between a website and a browser. This way you can better prevent hackers and or a middle man from gaining access to your website. So even WordPress blogs, news sites, agencies, all can benefit from HTTPS as this ensures nothing ever passes in plain text.
The Chrome team announced that beginning in January 2017, they will mark HTTP sites that transmit passwords or credit cards as non-secure. This is especially important if your website get’s a majority of its traffic from Chrome. You can look in Google Analytics under the Audience section in Browser & OS so see the percentage of traffic your WordPress site gets from Google Chrome. Google is making it a lot more clear to visitors that your WordPress website might not be running on a secured connection.
Because of a new protocol called HTTP/2, a lot of times, those running properly optimized sites over HTTPS can even see speed improvements. HTTP/2 requires HTTPS because of browser support. The improvement in performance is due to a variety of reasons such as HTTP/2 being able to support better multiplexing, parallelism, HPACK compression with Huffman encoding, the ALPN extension, and server push. And with TLS 1.3 being launched as of March 21st, 2018, HTTPS connections are even faster.
By default your wp-config.php file resides in the root directory of your WordPress installation (your /public HTML folder). But you can move this to a non-www accessible directory. Aaron Adams wrote up a great explanation of why this is beneficial.
Note: this won’t work for Kinsta users, due to how our environment is setup.
WordPress security keys are a set of random variables that improve encryption of information stored in the user’s cookies. Since WordPress 2.7 there have been 4 different keys: AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY. When you install WordPress these are generated randomly for you. However, if you have gone through multiple migrations or purchased a site from someone else, it can be good to create fresh WordPress keys.
To disable this completely you can install the free Disable XML-RPC plugin. Or you can disable it with the premium perfmatters plugin, which also contains web performance improvements. If you are a customer here at Kinsta this is not needed because when an attack through XML-RPC is detected a little snippet of code is added into the NGINX config file to stop them in their tracks – producing a 403 error.
WPBeginner has a great little snippet of code you can use to remove this. Simply add the following to your WordPress theme’s functions.php file.
WordPress Security 101 – How to secure your WordPress site against hackers
Learn more about WordPress core software security in this free white paper