VINTOM » The Creative Home of Vin Thomas

Simple Steps to Secure Your WordPress Site

Posted on Thursday, December 10th, 2009

I have had my Word­Press sites hacked in the past, and I have a good friend who was just hacked as well. Most Word­Press hacks are pretty harm­less, and more anno­ying than anything. But if you are trying to build your web­site and gain the trust of your visi­tors, it pro­bably doesn’t do you any favors by having a mal­ware war­ning pop up when people try to access your site. Here are a few tips to help you keep your Word­Press site safe and secure:

1. Delete the Admin Account

The default Word­Press user is named “admin”. Create a new account under a new name, assign the role of admi­nis­tra­tor to that user, then sign in under the new user and delete the “admin” account. Also, make sure to use a strong pass­word for all of your account.

2. Rename the Data­base Table Prefix

The default data­base table prefix is “wp_”. Don’t use that. This one is easiest to change when first ins­ta­lling your site. Many Word­Press ins­ta­llers give you the option to change this when ins­ta­lling your site. I use Sim­pleSc­ripts with my Bluehost Hos­ting account (affi­liate) to ins­tall Word­Press on many of the sites I do. This gives me the option to set the prefix as I am set­ting up the ins­tall. Very easy.

If you already have a blog up and run­ning and want to change the data­base table prefix, it’s a bit more work. But it can be done. Leave me a com­ment if you’d like a tuto­rial on how to do this.

3. Ins­tall the “Secure Word­Press” Plugin

This plugin is great! It is the first plugin that I ins­tall on all of my new sites. It pro­vi­des a slew of great secu­rity options. Don’t ques­tion it. Just do it.

4. Keep Plu­gins and Themes to a Minimum

Plu­gins can unin­ten­tio­nally (or inten­tio­nally) leave secu­rity holes in your site. If you don’t NEED the plugin, unins­tall it. If you’re not using the theme, unins­tall it. Don’t just deac­ti­vate them. UNINSTALL!

5. Keep Your Word­Press Up To Date

Unless you are run­ning a bunch of old school plu­gins on your site (which you shouldn’t) there is no good reason why you shouldn’t be run­ning the most current ver­sion of Word­Press. It is easy to upgrade now. It’s just 1-click and you’re done. Also, you should usually run the newest ver­sion of plu­gins as well. Some­ti­mes a plugin needs to be upda­ted because a secu­rity hole has been found in the old version.

Most of these steps (except maybe #2) could be done by any low-tech Average-Joe. Don’t let your­self get hacked. These small steps will help tigh­ten secu­rity around your blog.

Know of any other ways to pro­tect a Word­Press site? I’d love to hear about it in the comments.