{"id":5254,"date":"2021-05-16T18:02:34","date_gmt":"2021-05-16T18:02:34","guid":{"rendered":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/"},"modified":"2022-05-31T20:53:10","modified_gmt":"2022-05-31T20:53:10","slug":"wordpress-security-hardening","status":"publish","type":"post","link":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/","title":{"rendered":"WordPress Security Hardening","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>If you have been looking for some of the best practices to secure your website, you might have come across the term called hardening. The simple term is yet confusing for a lot of people. We will here see what is WordPress Security Hardening and then we will also see how you can do WordPress Security Hardening in the easiest possible way.<\/p>\n<h2>What is WordPress Security Hardening?<\/h2>\n<p>It\u2019s as easy as the name says. If you take out the simplest meaning, it simply means that <strong>it\u2019s a process of hardening all the security things<\/strong>.<\/p>\n<p>Well, that\u2019s what is meant by security hardening. Here, we do a couple of steps to remove and eliminate all the potential vulnerabilities that might be on your website. There are <strong>various steps you can take<\/strong>. Some might be as easy as setting a strong password and some might be a bit hard to follow.<\/p>\n<p>We will see the most common ways you can fix this issue.<\/p>\n<p>Therefore, let\u2019s start without worrying about it more.<\/p>\n<h2>Sucuri Can Help<\/h2>\n<p><a href=\"https:\/\/www.wpservices.com\/wp-content\/uploads\/2021\/02\/sucuri-review-1.jpg\"><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone wp-image-21026 size-full\" src=\"https:\/\/www.wpservices.com\/wp-content\/uploads\/2021\/02\/sucuri-review-1.jpg\" alt=\"WordPress Security Hardening\" width=\"960\" height=\"440\" \/><\/a><\/p>\n<p>The first thing that we will talk about will be about <strong>installing a plugin that will secure your website<\/strong>. There are many plugins there that you can get. However, if you talk about WordPress Security Hardening, the best plugin that you can go with will be <em>Sucuri<\/em>. Sucuri is the best plugin when it comes to WordPress Security Hardening.<\/p>\n<p>Here, you can easily harden the WordPress website. There are various hardening options where you can <strong>harden the theme files and plugin files as well<\/strong>. It will do half of the work for you.<\/p>\n<p>Sucuri will allow you to do a whole lot of things and not just the hardening. Therefore, you can install the plugin <strong>to increase the overall security of your website<\/strong>.<\/p>\n<p>When you install the plugin, it will allow you to <strong>scan the website for vulnerabilities<\/strong>. It\u2019s not directly the hardening part but it\u2019s always great to know that all current themes, plugins, and core files are secure and vulnerability-free. Therefore, you can run a scan.<\/p>\n<p>Further, there are many more things available here that you can use. You can easily <strong>see all the failed logins<\/strong> and know whenever someone tries to log in to your website.<\/p>\n<p>Now, this was mostly all about the plugin. Now, we will see more about the hardening part. So, let\u2019s see how you can harden your website with Sucuri.<\/p>\n<h2>Hardening Website using Sucuri<\/h2>\n<p>Coming back to the hardening part, here are some of the easiest steps you can follow to secure your website.<\/p>\n<p>Just <a href=\"\/2021\/04\/26\/how-to-set-up-sucuri-for-wordpress\/\">install the Sucuri plugin<\/a> at first. You can do it by going to <strong>add the plugin<\/strong> and then look for Sucuri. You can install it from there. Once you install it, you will have to head over to the settings option in the plugin.<\/p>\n<p>Inside it, you will find all the related things. Sucuri allows you to do various hardening within the plugin.<\/p>\n<p>Here are some of the things that are supported by Sucuri that will help with WordPress Security Hardening.<\/p>\n<ul>\n<li>You can <strong>remove the WordPress version from the website<\/strong>. This will stop the attackers from knowing the current vulnerabilities present in the version.<\/li>\n<li>You can <strong>block PHP file execution<\/strong> that occurs at various instances such as wp-content\/uploads, wp-content, and the same thing occurs at wp-includes. These are some of the biggest things where you need to keep an eye on. These can put your website in danger.<\/li>\n<li>It will <strong>prevent information leaks<\/strong>. Therefore, there will be no files such as readme. HTML and similar files where the hacker can read the information and do the steps\/<\/li>\n<li>You will also get the <strong>plugin and theme editor security<\/strong>. This will allow you to disable the editing of themes and plugins.<\/li>\n<\/ul>\n<p>You can reverse the hardening where you blocked PHP files. If you want, you can also enable the theme and plugin editor. Other changes might not be directly reversible. Therefore, you need to keep this in mind and then take the steps.<\/p>\n<p>It will benefit you. Therefore, we highly recommend you use one of the plugins to ensure security. You can use this plugin or you can go with other plugins.<\/p>\n<h2>Login Page Security<\/h2>\n<p><iframe src=\"https:\/\/giphy.com\/embed\/26n7b76oYbyml60zC\" width=\"480\" height=\"270\" frameborder=\"0\"><\/iframe><\/p>\n<p>This is one of the best part and the most effective part. If you can do this right, you are free from most of the errors and vulnerabilities that occur on your website. Therefore, we highly recommend you to do this<\/p>\n<p>A login page consists of many things that you can solve. We will see all of them here.<\/p>\n<p>The first thing is the username and the password. You <strong>need to set strong passwords<\/strong>. The next thing to keep in mind is that <strong>don\u2019t use the \u201cadmin\u201d username or your website\u2019s name<\/strong> as username. Be creative and use another username that doesn\u2019t match any of them.<\/p>\n<p>The next thing you can do is <strong>limit the login attempts<\/strong>. You can do this by a plugin called <em>Loginizer<\/em> or <em>Limit Login Attempts<\/em>. These are the plugins that will <strong>prevent the user from entering the same password again<\/strong>. If someone <strong>tries the same password more than X times, their IP will be blocked for a while<\/strong>.<\/p>\n<p>You can <strong>set the number of attempts, <\/strong>the number of attempts can be any number you want. Further, you can also <strong>set the IP address blocking limit<\/strong>. If you don\u2019t want the person to <strong>get blocked for 24 hours<\/strong>, you can decrease the time. In the same way, if you want them to be blocked for more time, you can do that too.<\/p>\n<p>Further, <strong>you can set 2FA<\/strong>. Various plugins work with Google authenticator and add two-factor authentication. This is an interesting and yet useful feature that you can use. Therefore, you can also add the 2FA if you want. This is fr the extra layer of security for your WordPress.<\/p>\n<h2>.htaccess file Security<\/h2>\n<p><iframe src=\"https:\/\/giphy.com\/embed\/LMtxJ3trXmNaMBKNat\" width=\"480\" height=\"270\" frameborder=\"0\"><\/iframe><br \/>\nThere are many ways you can <a href=\"\/2021\/05\/11\/wordpress-security-via-htaccess-file\/\">secure your website using .htaccess<\/a>. You can <strong>block the IP address of certain people<\/strong> and you can even <strong>stop the PHP file execution<\/strong> with the help of access. Therefore, we will see how you can edit the .htaccess file to harden your WordPress website\u2019s security. Please note that <strong>these things are considered to the advanced security practices<\/strong> for WordPress security hardening. Therefore, you don\u2019t need to do this necessarily. This is only for the people who want their website to be more secure and ensure that everything is how they want.<\/p>\n<p>In that case, you can follow all the steps and do as directed. Now, let\u2019s see what are the things you will have to do here if you want to secure your website. Therefore, it\u2019s not for everybody but you can follow it if you want to secure your website.<\/p>\n<p>At first, you will need to <strong>open your cPanel<\/strong> because that\u2019s where you will <em>find the file manager<\/em>. Open the file manager and <strong>open your website\u2019s directory<\/strong>. Now, you will see all the files and folders there. You will have to <strong>look for .htaccess<\/strong>. In most cases, you won\u2019t find it directly there. Therefore, what you can do here is <strong>head over to the settings<\/strong> shown in the top menu bar and then click on the show system files. Now, you will have to add the following code in the .htaccess file. Right-click on it and then select the code edit option. You can then add the code.<\/p>\n<p><code>&lt;Files *.php&gt;<br \/>\ndeny from all<br \/>\n&lt;\/Files&gt;<\/code><\/p>\n<p>This will remove the PHP files from executing.<\/p>\n<h2>Hosting and Domain<\/h2>\n<p>Many things might need your attention <strong>when it comes to the hosting and domain of your files<\/strong>. Many things will help you secure your website. In most cases, you will have to pay for this. Therefore, you can always make sure that you have some amount of money in your pocket before you can do this. We will mention the free resources if you can use them.<\/p>\n<p>We will begin with the <em>SSL<\/em>. <strong>SSL certificate is important for your domain name<\/strong>. If you don\u2019t have the SSL certificate, your website will look like <code>http:\/\/example.com<\/code> and you will not be able to secure the website. In the same way, if you add the SSL, it will look like <code>https:\/\/example.com<\/code>. As some of you might have guessed, <strong>the added S is for security<\/strong>. This will make sure that your website is secure. Usually, you will have to pay for SSL but you can also <strong>get it for free if you use let\u2019sEncrypt<\/strong>.<\/p>\n<p>While we are on the domain name, you also need to <strong>ensure that privacy protection is enabled<\/strong>. This will hide the information and help you with security as well.<\/p>\n<p>The next point is selecting proper hosting. You also have to <strong>make sure that you are using the right and standard hosting<\/strong>. This will give you secure servers to bet on. Therefore, your website will be secure and you can start using this.<\/p>\n<p>You can always go with <strong>hosting that is known for security and speed<\/strong>. Further, if you have a huge website, you can always go with the managed hosting. This will allow you to secure your WordPress website and\u00a0Security Hardening<\/p>\n<h2>Wp Config<\/h2>\n<p>You can always <strong>secure your wp-config file<\/strong> if you want to have better security. Here, you can <strong>add some lines to your wp-config file<\/strong>.<\/p>\n<p>We already saw a glance at this file when we talking about Sucuri. Therefore, you already might be knowing about this file. This is where you can <strong>add the configuration for your website<\/strong>. You will see the database username, passwords, etc here.<\/p>\n<p>You can also secure that. By editing this file, you can always do all the things that we have stated in the Sucuri plugin.<\/p>\n<p>If you already <strong>have done all the things in the Sucuri plugin, you don\u2019t need to repeat this<\/strong>.<\/p>\n<p>Here are the lines that you can add to the wp-config file.<\/p>\n<p><code>define(\u2018DISALLOW_FILE_MODS\u2019,true);<br \/>\ndefine(\u2018FORCE_SSL_ADMIN\u2019, true);<\/code><\/p>\n<p>The first line will disable plugin and theme editing. The second one will force SSL in the admin panel too.<\/p>\n<p>If you want to update or edit any theme or plugin, you will have to remove the first line. Therefore, you should do it only if you know what you are doing.<\/p>\n<h2>Extra Precautions &#8211; WordPress Security Hardening<\/h2>\n<p>Now comes the extra things that you need to do.<\/p>\n<p>Here are some of the most important things that will help you in securing your website in the future.<\/p>\n<p>Make sure that <strong>you are taking regular backups<\/strong>. You will need this. Therefore, you can always make sure that you have a regular <a href=\"\/2019\/05\/30\/how-to-backup-wordpress-site\/\">backup<\/a>. The interval will depend on how long it takes for you to update your website. For example, if you are running an eCommerce store, you can <strong>update your site daily<\/strong>. In the same way, if you running a blog, <strong>you can go with the weekly updates<\/strong>. Therefore, it depends on the website and when you da updating it.<\/p>\n<p>Further, you also need to have a <strong>security plugin that will monitor your website<\/strong>. In this way, you can keep your website secure and attackers out of your reach. You can use any plugin you want. There are many premia as well as free plugins that are great and will give you the best results. Therefore, you can start using them and start your journey.<\/p>\n<h2>Final Words about WordPress Security Hardening<\/h2>\n<p>To summarize, this is how you can easily <a href=\"https:\/\/www.youtube.com\/watch?v=bt3ezVsufPE\" target=\"_blank\" rel=\"noopener\">harden the security of your website<\/a>. You don\u2019t need to follow all the methods given here. Some of them are complex and it\u2019s only recommended for big websites. However, you can install the plugin and follow the procedure there. It will help you with WordPress security hardening. You can also hire a team of security experts if you are running huge websites with a lot of followers. In this way, you will keep your website secure.<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>If you have been looking for some of the best practices to secure your website, you might have come across the term called hardening. The simple term is yet confusing for a lot of people. We will here see what is WordPress Security Hardening and then we will also see how you can do WordPress &hellip;<\/p>\n<p class=\"read-more\"> <a class=\"\" href=\"https:\/\/www.wpservices.com\/wordpress-security-hardening\/\"> <span class=\"screen-reader-text\">WordPress Security Hardening<\/span> Read More &raquo;<\/a><\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":5255,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,39],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>WordPress Security Hardening - WPServices<\/title>\n<meta name=\"description\" content=\"If you have been looking for some of the best practices to secure your website, you might have come across the term called hardening. The simple term is\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wpservices.com\/wordpress-security-hardening\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WordPress Security Hardening - WPServices\" \/>\n<meta property=\"og:description\" content=\"If you have been looking for some of the best practices to secure your website, you might have come across the term called hardening. The simple term is\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wpservices.com\/wordpress-security-hardening\/\" \/>\n<meta property=\"og:site_name\" content=\"WPServices\" \/>\n<meta property=\"article:published_time\" content=\"2021-05-16T18:02:34+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-05-31T20:53:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wpservices.com\/wp-content\/uploads\/2022\/01\/wordpress-security-hardening.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"800\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Alexey Seryapin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alexey Seryapin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WordPress Security Hardening - WPServices","description":"If you have been looking for some of the best practices to secure your website, you might have come across the term called hardening. The simple term is","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/","og_locale":"en_US","og_type":"article","og_title":"WordPress Security Hardening - WPServices","og_description":"If you have been looking for some of the best practices to secure your website, you might have come across the term called hardening. The simple term is","og_url":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/","og_site_name":"WPServices","article_published_time":"2021-05-16T18:02:34+00:00","article_modified_time":"2022-05-31T20:53:10+00:00","og_image":[{"width":1600,"height":800,"url":"https:\/\/www.wpservices.com\/wp-content\/uploads\/2022\/01\/wordpress-security-hardening.png","type":"image\/png"}],"author":"Alexey Seryapin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Alexey Seryapin","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/#article","isPartOf":{"@id":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/"},"author":{"name":"Alexey Seryapin","@id":"https:\/\/www.wpservices.com\/#\/schema\/person\/3a1b0d7da62289c6b5fa33f8f559d5e7"},"headline":"WordPress Security Hardening","datePublished":"2021-05-16T18:02:34+00:00","dateModified":"2022-05-31T20:53:10+00:00","mainEntityOfPage":{"@id":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/"},"wordCount":1982,"commentCount":0,"publisher":{"@id":"https:\/\/www.wpservices.com\/#organization"},"articleSection":["For Webmasters","Web Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.wpservices.com\/wordpress-security-hardening\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/","url":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/","name":"WordPress Security Hardening - WPServices","isPartOf":{"@id":"https:\/\/www.wpservices.com\/#website"},"datePublished":"2021-05-16T18:02:34+00:00","dateModified":"2022-05-31T20:53:10+00:00","description":"If you have been looking for some of the best practices to secure your website, you might have come across the term called hardening. The simple term is","breadcrumb":{"@id":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wpservices.com\/wordpress-security-hardening\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wpservices.com\/wordpress-security-hardening\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.wpservices.com\/"},{"@type":"ListItem","position":2,"name":"WordPress Security Hardening"}]},{"@type":"WebSite","@id":"https:\/\/www.wpservices.com\/#website","url":"https:\/\/www.wpservices.com\/","name":"WPServices","description":"","publisher":{"@id":"https:\/\/www.wpservices.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wpservices.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.wpservices.com\/#organization","name":"WPServices","url":"https:\/\/www.wpservices.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.wpservices.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.wpservices.com\/wp-content\/uploads\/2021\/09\/wps-fav.png","contentUrl":"https:\/\/www.wpservices.com\/wp-content\/uploads\/2021\/09\/wps-fav.png","width":512,"height":512,"caption":"WPServices"},"image":{"@id":"https:\/\/www.wpservices.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.wpservices.com\/#\/schema\/person\/3a1b0d7da62289c6b5fa33f8f559d5e7","name":"Alexey Seryapin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.wpservices.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e106b91acb0d8ed36a1962e92de3f7f5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e106b91acb0d8ed36a1962e92de3f7f5?s=96&d=mm&r=g","caption":"Alexey Seryapin"},"description":"Meet Alexey, a seasoned WordPress professional with over 12 years of experience in the field. With a wealth of knowledge and expertise under his belt, Alexey has honed his skills to become a master of WordPress design, development, optimization, and troubleshooting. Throughout his career, Alexey has worked on a diverse range of projects, from personal blogs to complex e-commerce platforms and corporate websites. His deep understanding of the WordPress ecosystem allows him to create efficient, secure, and user-friendly websites tailored to the unique needs of his clients.","sameAs":["https:\/\/www.wpservices.com"],"url":"https:\/\/www.wpservices.com\/author\/aleksejs\/"}]}},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/www.wpservices.com\/wp-json\/wp\/v2\/posts\/5254"}],"collection":[{"href":"https:\/\/www.wpservices.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wpservices.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wpservices.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wpservices.com\/wp-json\/wp\/v2\/comments?post=5254"}],"version-history":[{"count":0,"href":"https:\/\/www.wpservices.com\/wp-json\/wp\/v2\/posts\/5254\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wpservices.com\/wp-json\/wp\/v2\/media\/5255"}],"wp:attachment":[{"href":"https:\/\/www.wpservices.com\/wp-json\/wp\/v2\/media?parent=5254"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wpservices.com\/wp-json\/wp\/v2\/categories?post=5254"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wpservices.com\/wp-json\/wp\/v2\/tags?post=5254"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}