Securing your Wordpress Website

Securing your WordPress website is crucial to protect it from threats and vulnerabilities. Here are some essential steps to enhance the security of your WordPress site:

1. Change Default Admin Username

Avoid using the default “admin” username. Create a new admin user with a unique username and delete the default admin account.

2. Disable Directory Listing

Prevent users from seeing a list of files in a directory by adding the following line to your .htaccess file:

Options -Indexes

3. Hide WordPress Version Number

Hide the WordPress version number to prevent attackers from targeting specific vulnerabilities. Add this line to your theme’s functions.php file:

remove_action('wp_head', 'wp_generator');

4. Limit User Privileges

Assign the least amount of privilege necessary for each user role. Avoid giving administrative access unless absolutely necessary.

5. Disable PHP Execution in Uploads Folder

Prevent users from uploading malicious PHP files by disabling PHP execution in the uploads directory. Create a file named .htaccess in the wp-content/uploads directory with the following content:

<FilesMatch "\.php$">
  Order Deny,Allow
  Deny from All
</FilesMatch>

6. Use Security Headers

Implement security headers to protect against various attacks. Add these headers to your .htaccess file or server configuration:

# Content Security Policy
Header set Content-Security-Policy "default-src 'self';"

# X-Content-Type-Options
Header set X-Content-Type-Options "nosniff"

# X-Frame-Options
Header set X-Frame-Options "SAMEORIGIN"

# X-XSS-Protection
Header set X-XSS-Protection "1; mode=block"

7. Change Database Table Prefix

Change the default table prefix (wp_) to something unique during WordPress installation to make it harder for attackers. If your site is live, use a plugin like Change DB Prefix to change it safely.

8. Disable XML-RPC Pingbacks

Prevent XML-RPC pingbacks, which can be exploited for DDoS attacks. Add the following code to your theme’s functions.php file:

add_filter('xmlrpc_methods', function($methods) {
  unset($methods['pingback.ping']);
  return $methods;
});

9. Secure wp-admin and wp-login.php

Restrict access to /wp-admin and /wp-login.php to specific IP addresses by adding the following code to your .htaccess file:

<Files wp-login.php>
  Order Deny,Allow
  Deny from All
  Allow from xx.xx.xx.xx
</Files>

<Files wp-admin>
  Order Deny,Allow
  Deny from All
  Allow from xx.xx.xx.xx
</Files>

Replace xx.xx.xx.xx with your IP address.

10. Monitor File Changes

Regularly monitor your files for unauthorized changes. Plugins like Wordfence or Sucuri can help track file modifications and alert you to suspicious activity.

11. Keep an Eye on User Registrations

Monitor new user registrations to ensure they are legitimate. Use plugins to block suspicious IP addresses or add CAPTCHAs to prevent automated sign-ups.

12. Use a Site Lockdown Plugin

During maintenance or updates, use a site lockdown plugin to restrict access to your site. Plugins like WP Maintenance Mode can help put your site in maintenance mode securely.