WordPress Site Security
WordPress is one of the most popular CMSs. The ability to build nice and functional web-site within hours is why users choose WordPress over other options.
On the other hand WordPress is also known for its lack of security. Basic WordPress site configuration is very vulnerable to outside threats. There are multiple ways to hack WordPress website if its security was not configured properly.
Let's go through several steps you need to take in order to protect your WordPress website.
Keep WordPress core up to date
Minor and security releases of WordPress install automatically. Enable automatic updates for major releases too, or apply them promptly: they contain security fixes and bug fixes, and an outdated core is one of the most common ways into a WordPress site.
Keep plugins up to date
Plugins allow to extend your WordPress functionality, but it is important to keep them up to date. Plugin manufacturers release updates to develop their product adding more features and fixing bugs. Check for plugin updates in the admin panel or on the developer’s site. Make sure to check the plugin for vulnerabilities at
WPScan Vulnerability Database before installing or updating it.
New user registration configuration
Disable user registration from WordPress Admin login screen to prevent mass registration and DB overflow. If someone needs to get access to WordPress admin part, it’s better to have an administrator to create a new user.
User nick and login configuration
WordPress default configuration matches user nicknames with user login name. This makes easy to find out admin user login name and then hack them. Set a public display name that differs from the login name (Users → Profile → Display name publicly as); no database edits are needed.
