WordPress security is a huge topic, and if you are serious about your website, you have to pay attention 1
to some security good practices. 2
Even though security in WordPress is taken very seriously, as with any other system, there are potential 3
security issues that may arise if some basic measures are not taken. 4
Let's get started. 5
I'm accessing the administration section of WordPress: the name of the website /wp- admin. 6
And I'm logging in using the username and password created at the installation. 7
Always run the latest version of WordPress and keep the plugins and themes up to date. By default, WordPress 8
automatically installs minor updates. For major releases 9
you need to manually initiate the update. 10
This is the WordPress administration dashboard. 11
Click on updates on the left side to see if there are any updates available. 12
Many attacks are of type brute force. In this attack, the hacker tries to repeatedly guess the user's 13
passwords, so it's important to use only strong passwords. 14
I'd also recommend you to limit login attempts using a plugin or an application firewall that can be 15
installed, at a two step verification to the WordPress login page, 16
if possible. The application firewall will discuss shortly has all of these features. 17
Another tip is to install a security plugin or a web application firewall. 18
There are many such plugins, both free and commercial. 19
A popular one is WordFence, which includes a firewall and a malware scanner and is built from the 20
ground up to protect WordPress. 21
I cannot tell you if this is the best, but you can give it a try. 22
So go to plugins add new 23
And search for wordfence 24
This is wordfence security and I'm installing it. 25
And I'm activating it. After installing wordfence, which is done automatically, you have to enable 26
and then configure it. 27
By the way, there's a free community version and the premium on. 28
Go to wordfence dashboard and you'll see there all of the options. 29
I'm entering an email address and then I'll accept the word face terms and privacy policy. 30
Perfect. 31
This is its Dashboard. 32
I'd advise you to enable two factor authentication on this page. 33
We won't dive deeper into wordfence settings, but you can take a look around because there are lots 34
of useful security features available. 35
Another security measure is to protect the WP admin directory, which is the heart of any WordPress 36
installation. 37
This directory. Normally, hackers can request the wp-admin directory and login page without any restriction. 38
This allows them to run exploits or DoS attacks. 39
You can add additional password protection or even limit the source IP addresses on the server side, 40
which will effectively block those requests. 41
I’ll attach some resources to this lecture on how to do that. 42
And my final advice is to make backups regularly. No matter how secure your WordPress website is, 43
there is always the possibility that someone is good enough to exploit it. 44
If you have a backup, you can restore your WordPress website to a working state any time you want. 45
You can make the backup manually using shell commands or using a plugin. 46
So just search for backup. 47
There are many such plugins available, so you have where to choose from. 48
Security is a continuous process, and although there isn't a 100% security guarantee by taking 49
some measures and following some good practices, you can avoid most of the possible hacks.