5 Simple Steps to Achieve Better WordPress Security

2. Enforce Strong Passwords

Yes, most people love using their birthday as their password. You know who likes it most of all? Attackers. See, weak passwords are easy to guess. If you post on social media: 

“ZOMG, My Little Pony II is my FAVOURITE MOVIE! Going to see it tomorrow for my birthday!”

You’ve just given an attacker a critical piece of information. At this point, they are going to start trying passwords and usernames related to the movie and/or your birthdate. Anything you’ve posted on social media gives attackers a little more information to work with. This isn’t necessarily a WordPress security issue, it’s a failing of humans.

HINT: l33tsp34k “Leet Speak” or replacing letters with numbers doesn’t fool attackers either. They figured that one out before you did.

So what works? Strong passwords. Long, random strings of letters and symbols are great. The problem with this is that, since they are hard to remember, we tend to write them down. If you lose the book you wrote them down in, then an attacker has the keys to the kingdom. (The book being physical OR electronic). If you are in the habit of doing that, I’d strongly advise you to check this article on securing passwords with Have I Been Pwned.

WordPress now has the functionality to generate strong passwords, but it doesn’t require them. There are plugins however that will enforce this for you. If you go to wordpress.org/plugins and enter ‘strong passwords’, you’ll find several to choose from. Install one of these plugins.

If you have regular users as well as admin, authors, etc., you may want to only enforce strong passwords on your higher-level accounts to reduce the friction your users have in registering and logging into your site.

If you are wondering how to deal with strong passwords without writing them down, invest in a password manager. Most modern ones work on both desktop and mobile and will sync your data across all your devices.

In case you want to learn more about the importance of WordPress security and to discover more than 20 tips on how to keep your WordPress website safe, get SiteGround’s free ultimate guide to WordPress security:

3. Implement Two-factor Authentication

‘Two-factor Authentication’, or 2FA is not a new security concept. For decades, financial institutions have relied on “Fobs” (small devices you can attach to your keyring that have a display and give an ever-changing number) as an additional factor in logging in.

The overarching security concept is “Something you know, something you have, something you are.” In 2FA, we pick two of these. When you log into a website without 2FA, you only use the “something you know” – the login and password. Regardless of how strong you think those are, there is a chance that they can be compromised. 2FA adds a layer on top of that, the “something you have”.

These days, instead of having to issue each admin user a fob, we have smartphones and software that can take the place of fobs. If you have a modern smartphone (one made in the last 5 years) it can run an app that functions as the “something you have”.

The most commonly used – although by no means the only – app for 2FA is “Google Authenticator”. It’s the most common because it is free. Before you go down the road of 2FA, make sure that Google Authenticator is available for your phone.

If you already use a plugin like the SiteGround Security plugin, you’ve got everything you need to set up 2FA. You just need to enable this option from the plugin’s dashboard and all admin and editor users will be asked to configure their two-factor authentication on their next login.

Once the 2FA is implemented and after your user clicks the login button, they will be taken to a second login screen that will ask them for their “token”. If they have set up their app properly, they will open the app, find your website in it, and type in the number on the screen. This number changes every 30 seconds. The number is called a “Time-based One Time Password” (TOTP). Your phone and the plugin you use both know how to calculate it, but no one else does. When they type in the token and press the button, the plugin will calculate the appropriate TOTP and then verify that it matches what the user typed in. Based on that it will either allow or deny the login.

Keep in mind that some 2FA systems are not based on apps but on text messages sent to your phone with the tokens. Beware that these are not secure, so you need to avoid them.

4. Enforce HTTPS

This one you should already be doing. If you’ve been living under a rock though, a couple of years ago, Google came right out and said that if your site isn’t running HTTPS, they will rank your site lower than other sites running HTTPS. SEO aside though, HTTPS keeps all your traffic encrypted and away from prying eyes. If you are not running HTTPS, any user sitting in a coffee shop is broadcasting everything to anyone who cares to watch. (technically, “sniff the wifi”)

If you are not using SiteGround, then this involves working with your hosting provider to purchase and install a secure certificate. Then, you need to tell WordPress to change its URL to HTTPS.

If SiteGround is your hosting partner, all you need to do is use the SSL Manager to get a free “Let’s Encrypt” certificate. Once SiteGround’s control panel obtains and installs the certificate for you, all you need to do is click “Enforce HTTPS” and voila, your entire site is now encrypted.

5. Keep Your Plugins up to Date

I don’t mean just the main ones, I mean every plugin you have installed on your site, every time there is an update. Why is it important to keep your plugins updated?

The main reason is of course WordPress security. Good plugin authors address security WordPress issues when they are reported and release patches as soon as they can. If you have auto update turned on, you don’t even have to do anything, you’ll get the new code. If you don’t, then, as soon as you log in, and notice that there are updates, go to Plugins, click on the update buttons, watch them all update, and then try and remember why you logged in in the first place.

If you are a SiteGround client, you can take advantage of SiteGround WordPress AutoUpdate tool. It keeps your WordPress sites safe and up-to-date at all times. Among other things, it also takes care of your plugins. In this tool, you could enable the plugin auto updates option from settings. If you do enable that option, on each WordPress update performed, SiteGround will check if your plugins are up-to-date too and if not, will update them for you.

If you can measure down-time in dollars, then it’s worth your time to make sure you are always on the latest and greatest version of everything and that the important plugins on your site are constantly being maintained. Make sure that your WordPress security updates are among your top priorities.

Extra Steps to Make Your WordPress Site More Secure

For some extra tips on making your WordPress website even more secure, watch the full video below and then follow the recommended steps. Keep in mind that many of these you can do yourself in just a few clicks, if you are using the free SiteGround Security plugin.

Final Thoughts

The secret about site security is that it’s not one big thing you do, it’s about doing a lot of little things. These few easy steps will help you improve your WordPress website security. Each layer of security you add to your site makes it a little harder for attackers to get in. You don’t have to have an absolutely secure site to be safe, you just have to create more work for the attacker than what is actually worth breaking in. Attackers eventually get tired and move on to easier targets…those sites whose owners haven’t read this blog post.