{ "id": 37009, "slug": "2019-03-31_wordpress-10-tips-to-secure-your-website", "url": "https://agents.willem.com/en/posts/2019-03-31_wordpress-10-tips-to-secure-your-website/", "source_url": "https://willem.com/en/2019-03-31_wordpress-10-tips-to-secure-your-website/", "language": "en", "date": "2019-03-31", "published": "2019-03-31T00:00:00+01:00", "created": "2025-06-26T22:10:14.476000+02:00", "updated": "2026-04-03T14:34:54.693000+02:00", "title": "WordPress: 10 tips to secure your website", "subtitle": "Keep hackers out of the world's most popular content management system", "summary": "A lot of people use WordPress to manage their website, therefore it's no surprise people ask me to have a look at their site's security. As ethical hacker, I encounter WordPress in different shapes, sizes and states. Some of them are really badly protected against hacks. Prevent your site from being hacked using these 10 practical tips.", "topics": [ "cloud", "cyber-security", "hacking", "howto", "networking", "server", "web", "webdesign" ], "author": { "name": "Willem L. Middelkoop", "url": "https://willem.com" }, "translation": { "language": "nl", "url": "https://agents.willem.com/nl/posts/2019-03-31_wordpress-10-tips-om-je-website-te-beveiligen/", "source_url": "https://willem.com/nl/2019-03-31_wordpress-10-tips-om-je-website-te-beveiligen/" }, "image": "https://willem.com/global/images/51dd00a2ba31.webp", "image_width": 2560, "images": [ { "url": "https://willem.com/global/images/79572e4a515e.webp", "description": "Update WordPress from the wp-admin dashboard", "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-1.jpg" }, { "url": "https://willem.com/global/images/db2e086fcde8.webp", "description": "Check the reputation of a WordPress plugin by looking at the number of downloads and its rating", "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-2.jpg" }, { "url": "https://willem.com/global/images/7ed5f0ee69b4.webp", "description": "Sniff WordPress password using WireShark packet capturing (via blog.wpscans.com)", "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-3.png" }, { "url": "https://willem.com/global/images/7e3624540722.webp", "description": "Password dictionary attacks use lists of known (leaked) passwords, you can find them on shady parts of the internet", "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-4.png" }, { "url": "https://willem.com/global/images/94b8eedd02ca.webp", "description": "Do you trust the free wifi you're using? (Image via buffered.com)", "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-5.jpg" }, { "url": "https://willem.com/global/images/b4bed4a35679.webp", "description": "Leaking personal user information from the WordPress REST API", "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-6.jpg" }, { "url": "https://willem.com/global/images/e8fa9fcb7c0e.webp", "description": "Limit access by IP basis to XML-RPC using a .htaccess file", "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-7.png" }, { "url": "https://willem.com/global/images/a21ba24bbd4e.webp", "description": "It's pretty hard hacking into my WP-Admin page because you cannot find it (hint: it's not at /wp-admin)", "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-8.jpg" }, { "url": "https://willem.com/global/images/b8c695c798fe.webp", "description": "Somewhere in a datacenter there is a machine like this hosting your website", "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-9.jpg" }, { "url": "https://willem.com/global/images/ba045569ad2d.webp", "description": "Use WP Security Audit Log to keep an eye on what's happening with your WordPress website (wpsecurityauditlog.com)", "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-10.png" } ], "text": "1) Update WordPress (and plugins + themes)\nThe majority of WordPress hacks is the result from a lackluster update policy. Hackers use automated bots to find outdated software versions containing known security problems. Once they have found your website to be vulnerable, hacking it is often a piece of cake.\nThese days updating WordPress can be done automatically, so you won't have to do it yourself. Check out the instructions_on_how_to_update_WordPress (https://codex.wordpress.org/Updating_WordPress).\n2) Plugins and Themes\nThe bad security reputation WordPress has earned is mostly due to the platform's extensible parts, specifically plugins and themes. These are the primary attack vectors exploited by cyber criminals to hack and abuse your WordPress website. Their security vulnerabilities are usually the result of mistakes and oversights during development.\nBe very reluctant and cautious to install plugins on your WordPress website. You should check who's the developer of the plugin or theme, determine if they have a good reputation when it comes to writing safe code. Plugins and themes with lots of downloads are often actively being maintained, a good indicator for security. Update all plugins and themes and keep an eye on the security track record using a website like wpvulndb.com (https://www.wpvulndb.com/plugins/).\n3) Use encryption (TLS/SSL)\nWordPress websites without TLS/SSL encryption pose a security risk because whenever you login to administer the website, your password is sent in clear text. This means that anybody that is listening to your network traffic can easily get your password. With a valid password hackers can simply login, you don't want to make it that_easy (https://blog.wpscans.com/sniff-wordpress-login-credentials-wireshark-http-connection/) for them, right?\nUse TLS/SSL to encrypt all communication between the webserver and your browser. That means nobody can decipher what you type into the password field by looking at the network traffic. TLS/SSL certificates that you need to enable HTTPS encryption are very cheap these days, ask your hosting provider to get one on your site.\n4) Use strong passwords\nNo matter if you follow all the other tips to secure your website, weak passwords are another common source for WordPress security breaches. Because most WordPress installations have an \"admin\" user, hackers can use password_dictionaries (https://duckduckgo.com/?q=password+dictionairy) to automatically guess your password.\nThink of a strong password as of something that nobody has used before. This usually means longer, with more different characters, not comprising known words or phrases. You can use a password generator to get something really hard to guess (and easy to forget...). Prevent using the same password on multiple sites and consider enabling_two_step_authentication_for_maximum_access_control (https://codex.wordpress.org/Two_Step_Authentication).\n5) Use a trusted computer and network\nJust like you should not flaunt your cash and gadgets in shady streets, you should be careful where (and when) you login to your website. A computer with spyware, malware or a virus can record key strokes (and your password) and send it to criminals. Or even in a non-digital way: an adversary can literally look over your shoulder (in the bus, train or coffee shop) while you enter your password.\nBe careful where and when you work on your website. Don't work on a shared or public computer when you don't need to. If you work using a public WiFi hotspot you must use encryption to prevent anyone from sneaking along. You can do this using TLS/SSL or by using a VPN (like buffered.com). Make sure your computer, tablet or smartphone is updated.\n6) Disable WordPress REST API\nThe WordPress_REST_API (https://developer.wordpress.org/rest-api/) provides access to all data that is available on your website in machine readable JSON format. Posts, pages, categories, tags, comments, media, users, settings and more can be easily accessed. For instance, try adding this part to your website address: /wp-json/wp/v2/users to get a list of all the valid usernames of your website, do you want to share that with hackers?\nDisable the REST-API to prevent content scraping (plagiarism) and to prevent leaking user data. User data is personal and should no be shared publicly if you value privacy and security - think GDPR (https://en.m.wikipedia.org/wiki/General_Data_Protection_Regulation). You can disable the REST API using a plugins like Disable_REST_API (https://wordpress.org/plugins/disable-wp-rest-api/) or REST_API_Toolbox (https://wordpress.org/plugins/rest-api-toolbox/). Check out the detailed_blog_post_by_Jeff_Star_for_more_about_securing_the_WP_REST_API (https://digwp.com/2018/08/secure-wp-rest-api/).\n7) Disable XML-RPC access\nThe XML-RPC is a feature of WordPress that enables remote control of your website using XML (RPC stands for \"remote procedure call\"). This mechanism allows you to manage your website without logging into WP-Admin, for instance using external services or apps. Unfortunately, the XML-RPC feature is a security weakness since it basically is a backdoor that hackers can try to break using brute_force (https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html) or special_commands (https://medium.com/@the.bilal.rizwan/wordpress-xmlrpc-php-common-vulnerabilites-how-to-exploit-them-d8d3c8600b32).\nPrevent xml-rpc.php problems by disabling this WordPress feature entirely. You can do this using the Disable_XML-RPC_plugin (https://wordpress.org/plugins/disable-xml-rpc/) or by manually configuring the webserver using_a_htaccess_file (https://graspingtech.com/disable-xml-rpc-wordpress/).\n8) Hide or protect the login page (wp-admin)\nEverybody knows that to login to WordPress, you simply add '/wp-admin' to your website address. Any hacker can easily get started with brute forcing your website because of this. It's much harder to break a lock if you cannot find it.\nConsider hiding or replacing the wp-admin page. Experts call this \"security_through_obscurity\" (https://en.m.wikipedia.org/wiki/Security_through_obscurity), relying on secrecy for security. You can use a plugin for this, or configure the webserver to limit access to wp-admin by IP address filtering. Check out this blog_post_for_ways_to_hide_and_protect_the_wp-admin_page (https://www.3nions.com/hide-wp-admin-page-wordpress-login/). Be warned though, relying on secrecy alone is not enough - you should implement the other tips, too.\n9) Reliable hosting\nEven if you implement all these security tips to secure your WordPress website, it might not be enough if your hosting is insecure. Hosting is the service that allows your website to be made available on the internet. This is done using special computers called servers. Just like the website itself, the web server publishing it must be secure, too. Think of a hosting as a ship, if it sinks it will take all passengers (websites) with it...\nInvest in reliable hosting by selecting a hosting company with a good reputation. Pick one that fits your company well, consider hosting using a dedicated (managed) VPS. Be aware that cheap hosting options are often cheap because the server is shared with (many) other (possibly insecure) websites. Read along to understand_the_security_concerns_in_shared_hosting (https://willem.com/en/2019-02-28_understanding-the-security-concerns-in-shared-hosting/).\n10) Backup and checkup\nAlthough your website may be up and running smoothly now, things may change for the worse in the future. Security is never an absolute thing, it's always possible you'll run into bad weather. Prepare yourself for trouble and don't let security problems go unnoticed.\nCheck your own website regularly - or hire somebody (https://digidef.nl) to do this for you. With a plugin like WP_Security_Audit_Log (https://wordpress.org/plugins/wp-security-audit-log/) you can spot attacks and suspicious behaviour early on. Make backups of your website, so you're ready to recover from cyber disaster. Accidents happens to the best of us, make a backup of your website to prevent loosing your work completely. Check this blog_post_to_learn_about_different_ways_to_backup_your_WordPress_website (https://websitesetup.org/wordpress-backup/).\nConclusion\nThe security of your website is just like the security of your office or house. When you leave it, you close the windows and lock the doors, right? Don't neglect the security of your website, it's just as important as its design and content.\nIf you implement these security tips, your website will be much harder to hack by cyber criminals. Do it yourself (https://codex.wordpress.org/Hardening_WordPress) or ask somebody (https://willem.com) to help you.", "word_count": 1205, "markdown_url": "https://agents.willem.com/en/posts/2019-03-31_wordpress-10-tips-to-secure-your-website/post.md" }