{
 "id": 37009,
 "slug": "2019-03-31_wordpress-10-konsehu-pa-sigura-bo-website",
 "url": "https://agents.willem.com/pap/posts/2019-03-31_wordpress-10-konsehu-pa-sigura-bo-website/",
 "source_url": "https://willem.com/pap/2019-03-31_wordpress-10-konsehu-pa-sigura-bo-website/",
 "language": "pap",
 "date": "2019-03-31",
 "published": "2019-03-31T00:00:00+01:00",
 "created": "2025-06-26T22:10:14.476000+02:00",
 "updated": "2026-10-20T09:16:38.939000+02:00",
 "title": "WordPress: 10 konsèhu pa sigurá bo website",
 "subtitle": "Tene hacker afó di e sistema di manehamentu di kontenido mas popular di mundu",
 "summary": "Hopi hende ta usa WordPress pa manehá nan website, pesei no ta sorprendente ku hende ta puntra mi pa wak e siguridat di nan website. Manera hacker étiko, mi ta topa WordPress den diferente forma, grandura i estado. Algun di nan ta masha mal protehá kontra hack. Evitá ku bo website wòrdu hacká ku e 10 konsèhu práktiko aki.",
 "topics": [
  "cloud",
  "cyber-security",
  "hacking",
  "howto",
  "networking",
  "server",
  "web",
  "webdesign"
 ],
 "author": {
  "name": "Willem L. Middelkoop",
  "url": "https://willem.com"
 },
 "provenance": {
  "kind": "model",
  "method": "Claude Sonnet, two passes (translation, then proofreading) against a glossary; Curaçao/Bonaire (FPI) spelling, no dictionary available",
  "date": "2026-10-20",
  "reviewed_by_native_reader": false,
  "language": "pap",
  "source_language": "en"
 },
 "translations": [
  {
   "language": "en",
   "title": "WordPress: 10 tips to secure your website",
   "url": "https://agents.willem.com/en/posts/2019-03-31_wordpress-10-tips-to-secure-your-website/",
   "source_url": "https://willem.com/en/2019-03-31_wordpress-10-tips-to-secure-your-website/"
  },
  {
   "language": "nl",
   "title": "WordPress: 10 tips om je website te beveiligen",
   "url": "https://agents.willem.com/nl/posts/2019-03-31_wordpress-10-tips-om-je-website-te-beveiligen/",
   "source_url": "https://willem.com/nl/2019-03-31_wordpress-10-tips-om-je-website-te-beveiligen/"
  },
  {
   "language": "de",
   "title": "WordPress: 10 Tipps zur Sicherung Ihrer Website",
   "url": "https://agents.willem.com/de/posts/2019-03-31_wordpress-10-tipps-zur-sicherung-ihrer-website/",
   "source_url": "https://willem.com/de/2019-03-31_wordpress-10-tipps-zur-sicherung-ihrer-website/"
  },
  {
   "language": "es",
   "title": "WordPress: 10 consejos para asegurar tu sitio web",
   "url": "https://agents.willem.com/es/posts/2019-03-31_wordpress-10-consejos-para-asegurar-tu-sitio-web/",
   "source_url": "https://willem.com/es/2019-03-31_wordpress-10-consejos-para-asegurar-tu-sitio-web/"
  },
  {
   "language": "fr",
   "title": "WordPress : 10 conseils pour sécuriser ton site web",
   "url": "https://agents.willem.com/fr/posts/2019-03-31_wordpress-10-conseils-pour-securiser-ton-site-web/",
   "source_url": "https://willem.com/fr/2019-03-31_wordpress-10-conseils-pour-securiser-ton-site-web/"
  },
  {
   "language": "it",
   "title": "WordPress: 10 consigli per proteggere il tuo sito",
   "url": "https://agents.willem.com/it/posts/2019-03-31_wordpress-10-consigli-per-proteggere-il-tuo-sito/",
   "source_url": "https://willem.com/it/2019-03-31_wordpress-10-consigli-per-proteggere-il-tuo-sito/"
  },
  {
   "language": "pt",
   "title": "WordPress: 10 dicas para proteger o teu site",
   "url": "https://agents.willem.com/pt/posts/2019-03-31_wordpress-10-dicas-para-proteger-o-teu-site/",
   "source_url": "https://willem.com/pt/2019-03-31_wordpress-10-dicas-para-proteger-o-teu-site/"
  },
  {
   "language": "fy",
   "title": "WordPress: 10 tips om dyn website te befeiligjen",
   "url": "https://agents.willem.com/fy/posts/2019-03-31_wordpress-10-tips-om-dyn-website-te-befeiligjen/",
   "source_url": "https://willem.com/fy/2019-03-31_wordpress-10-tips-om-dyn-website-te-befeiligjen/"
  }
 ],
 "image": "https://willem.com/global/images/51dd00a2ba31.webp",
 "image_width": 2560,
 "images": [
  {
   "url": "https://willem.com/global/images/79572e4a515e.webp",
   "description": "Aktualisá WordPress for di e dashboard di wp-admin",
   "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-1.jpg"
  },
  {
   "url": "https://willem.com/global/images/db2e086fcde8.webp",
   "description": "Kontrolá e reputashon di un plugin di WordPress pa wak e kantidat di download i su rating",
   "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-2.jpg"
  },
  {
   "url": "https://willem.com/global/images/7ed5f0ee69b4.webp",
   "description": "Snifá password di WordPress ku WireShark packet capturing (via blog.wpscans.com)",
   "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-3.png"
  },
  {
   "url": "https://willem.com/global/images/7e3624540722.webp",
   "description": "Atake di diksonario di password ta usa lista di password konosí (filtrá), bo por haña nan riba parti sospechoso di internet",
   "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-4.png"
  },
  {
   "url": "https://willem.com/global/images/94b8eedd02ca.webp",
   "description": "Bo ta konfiá e WiFi grátis ku bo ta usa? (Foto via buffered.com)",
   "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-5.jpg"
  },
  {
   "url": "https://willem.com/global/images/b4bed4a35679.webp",
   "description": "Filtrá informashon personal di usuario for di e WordPress REST API",
   "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-6.jpg"
  },
  {
   "url": "https://willem.com/global/images/e8fa9fcb7c0e.webp",
   "description": "Limitá akseso pa base di IP na XML-RPC ku un file .htaccess",
   "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-7.png"
  },
  {
   "url": "https://willem.com/global/images/a21ba24bbd4e.webp",
   "description": "Ta masha difísil pa hack mi página WP-Admin pasobra bo no por haña dje (pista: e no ta na /wp-admin)",
   "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-8.jpg"
  },
  {
   "url": "https://willem.com/global/images/b8c695c798fe.webp",
   "description": "Algun lugá den un datacenter tin un mákina manera esaki ku ta hospedá bo website",
   "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-9.jpg"
  },
  {
   "url": "https://willem.com/global/images/ba045569ad2d.webp",
   "description": "Usa WP Security Audit Log pa tene un wak riba loke ta pasa ku bo website WordPress (wpsecurityauditlog.com)",
   "manager_file": "148-bf2d6faf6057f115dc72e82d984e71359f16b48d8c42b4b41c2ee918cf46b556_ContentAsPost_37009_images-10.png"
  }
 ],
 "text": "1) Aktualisá WordPress (i plugin + tema)\nE mayoria di hack di WordPress ta resultado di un polítika di aktualisashon flou. Hacker ta usa bot outomátiko pa haña vershon di software bieu ku ta kontené problema di siguridat konosí. Ora nan a haña ku bo website ta vulnerabel, hack dje ta hopi bes un kos masha fásil.\nAwendia por aktualisá WordPress outomátiko, pesei bo no mester hasi esaki bo mes. Wak e instrukshon_pa_aktualisá_WordPress (https://codex.wordpress.org/Updating_WordPress).\n2) Plugin i tema\nE mala reputashon di siguridat ku WordPress a haña ta mayoria pa motibu di e partinan ekstensibel di e plataforma, spesial plugin i tema. Esakinan ta e vektor di atake prinsipal ku kriminal sibernétiko ta eksplotá pa hack i abusá bo website WordPress. Nan vulnerabilidat di siguridat normal ta resultado di fout i deskuido durante desaroyo.\nTene masha kuidado ora bo ta instalá plugin riba bo website WordPress. Bo mester wak ken ta e desaroyador di e plugin òf tema, i determiná si nan tin bon reputashon ora ta trata di skirbi kódigo sigur. Plugin i tema ku hopi download ta hopi bes aktivo mantené, un bon indikador pa siguridat. Aktualisá tur plugin i tema i tene un wak riba e historial di siguridat ku un website manera wpvulndb.com (https://www.wpvulndb.com/plugins/).\n3) Usa enkripshon (TLS/SSL)\nWebsite WordPress sin enkripshon TLS/SSL ta un risko di siguridat, pasobra kada bes ku bo login pa administrá e website, bo password ta wòrdu mandá den tekstu kla. Esaki ta nifiká ku kualkier hende ku ta skucha bo tráfiko di network por haña bo password ku fasilidat. Ku un password válido hacker por login sin problema, bo no ke hasi esaki tan fásil (https://blog.wpscans.com/sniff-wordpress-login-credentials-wireshark-http-connection/) pa nan, bèrdat?\nUsa TLS/SSL pa enkriptá tur komunikashon entre e webserver i bo browser. Esei ta nifiká ku niun hende por desifrá loke bo skirbi den e kampo di password ora nan ta wak e tráfiko di network. E sertifikado TLS/SSL ku bo mester pa aktivá enkripshon HTTPS ta masha barata awendia, pidi bo proveidó di hosting pa pone un riba bo website.\n4) Usa password fuerte\nNo importá si bo sigui tur e otro konsèhu pa sigurá bo website, password flou ta un otro orígen komun di violashon di siguridat di WordPress. Pasobra mayoria instalashon di WordPress tin un usuario \"admin\", hacker por usa diksonarionan_di_password (https://duckduckgo.com/?q=password+dictionairy) pa adivina bo password outomátiko.\nPensa riba un password fuerte komo algu ku niun hende a usa promé. Esaki normal ta nifiká mas largu, ku mas karakter diferente, sin palabra òf frase konosí. Bo por usa un generadó di password pa haña algu masha difísil pa adiviná (i fásil pa lubidá...). Evitá usa e mesun password riba vários website i konsiderá aktivá outentikashon_di_dos_pasu_pa_kontròl_máksimo_di_akseso (https://codex.wordpress.org/Two_Step_Authentication).\n5) Usa un kompiuter i network di konfiansa\nIgual ku bo no mester mustra bo sèn i gadget den kayanan sospechoso, bo mester ta kuidadoso unda (i ora) bo ta login na bo website. Un kompiuter ku spyware, malware òf un virus por registrá e teklanan ku bo primi (i bo password) i manda nan na kriminal. Òf te ku di forma no digital: un adversario por literal wak riba bo skouder (den bus, trein òf kòfishòp) miéntras bo ta skirbi bo password.\nSòru unda i ora bo ta traha riba bo website. No traha riba un kompiuter kompartí òf públiko ora bo no mester. Si bo ta traha ku un hotspot di WiFi públiko, bo mester usa enkripshon pa evitá ku hende spioná bo. Bo por hasi esaki ku TLS/SSL òf ku un VPN (manera buffered.com). Asegurá ku bo kompiuter, tablèt òf smartphone ta aktualisá.\n6) Desaktivá WordPress REST API\nE WordPress_REST_API (https://developer.wordpress.org/rest-api/) ta duna akseso na tur dato disponibel riba bo website den formato JSON lesibel pa mákina. Artíkulo, página, kategoria, tag, komentario, media, usuario, konfigurashon i mas por wòrdu haña ku fasilidat. Por ehèmpel, purba agregá e parti aki na bo adrès di website: /wp-json/wp/v2/users pa haña un lista di tur e nòmber di usuario válido di bo website, bo ke kompartí esei ku hacker?\nDesaktivá e REST-API pa evitá content scraping (plagio) i pa evitá filtrashon di dato di usuario. Dato di usuario ta personal i no mester wòrdu kompartí públiko si bo ta balorá privasidat i siguridat - pensa riba GDPR (https://en.m.wikipedia.org/wiki/General_Data_Protection_Regulation). Bo por desaktivá e REST API ku plugin manera Disable_REST_API (https://wordpress.org/plugins/disable-wp-rest-api/) òf REST_API_Toolbox (https://wordpress.org/plugins/rest-api-toolbox/). Wak e artíkulo_detayá_di_blog_di_Jeff_Star_pa_mas_tokante_sigurá_e_WP_REST_API (https://digwp.com/2018/08/secure-wp-rest-api/).\n7) Desaktivá akseso na XML-RPC\nE XML-RPC ta un funshon di WordPress ku ta pèrmití kontròl remoto di bo website ku XML (RPC ta pa \"remote procedure call\"). E mekanismo aki ta pèrmití bo pa manehá bo website sin login na WP-Admin, por ehèmpel ku servisio eksterno òf app. Lastimá, e funshon XML-RPC ta un debilidat di siguridat, pasobra na esensia e ta un porta di patras ku hacker por purba kibra ku brute_force (https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html) òf komando_spesial (https://medium.com/@the.bilal.rizwan/wordpress-xmlrpc-php-common-vulnerabilites-how-to-exploit-them-d8d3c8600b32).\nEvitá problema ku xml-rpc.php pa desaktivá e funshon aki di WordPress kompletu. Bo por hasi esaki ku e plugin Disable_XML-RPC (https://wordpress.org/plugins/disable-xml-rpc/) òf ku konfigurá e webserver ku mano ku un_file_htaccess (https://graspingtech.com/disable-xml-rpc-wordpress/).\n8) Skonde òf protehá e página di login (wp-admin)\nTur hende sa ku pa login na WordPress, bo so agregá '/wp-admin' na bo adrès di website. Kualkier hacker por kuminsá ku fasilidat ku brute forcing di bo website pa motibu di esaki. Ta hopi mas difísil pa kibra un slòt si bo no por haña dje.\nKonsiderá pa skonde òf kambia e página wp-admin. Spesialista ta yama esaki \"siguridat_pa_medio_di_oskuridat\" (https://en.m.wikipedia.org/wiki/Security_through_obscurity), konfiá riba sekreto pa siguridat. Bo por usa un plugin pa esaki, òf konfigurá e webserver pa limitá akseso na wp-admin ku filtrashon di adrès IP. Wak e artíkulo_di_blog_tokante_manera_pa_skonde_i_protehá_e_página_wp-admin (https://www.3nions.com/hide-wp-admin-page-wordpress-login/). Tene na mente ku konfiá riba sekreto so no ta sufisiente - bo mester implementá e otro konsèhunan tambe.\n9) Hosting konfiabel\nMes si bo implementá tur e konsèhu di siguridat aki pa sigurá bo website WordPress, e por no ta sufisiente si bo hosting no ta sigur. Hosting ta e servisio ku ta pèrmití ku bo website ta disponibel riba internet. Esaki ta wòrdu hasi ku kompiuter spesial yamá server. Igual ku e website mes, e web server ku ta publiká dje mester ta sigur tambe. Pensa riba un hosting manera un barku, si e hundi e ta hala tur pasajero (website) ku dje...\nInvertí den hosting konfiabel ku skohe un kompania di hosting ku bon reputashon. Skohe un ku ta bon pa bo kompania, konsiderá hosting ku un VPS dediká (manehá). Sa ku opshon di hosting barata ta barata hopi bes pasobra e server ta kompartí ku (hopi) otro website (posibel insigur). Lesa pa komprondé e_preokupashonnan_di_siguridat_den_shared_hosting (https://willem.com/en/2019-02-28_understanding-the-security-concerns-in-shared-hosting/).\n10) Backup i kontròl\nAunke bo website kisas ta funshoná bon awor, kosnan por kambia pa peor den futuro. Siguridat nunka ta algu absoluto, tin semper chèns ku bo ta topa tempu malu. Prepará bo mes pa problema i no laga problema di siguridat pasa desapersibí.\nKontrolá bo mes website regular - òf kontratá un hende (https://digidef.nl) pa hasi esaki pa bo. Ku un plugin manera WP_Security_Audit_Log (https://wordpress.org/plugins/wp-security-audit-log/) bo por detektá atake i komportashon sospechoso tempran. Hasi backup di bo website, pa bo ta kla pa rekuperá di un desastre sibernétiko. Aksidente ta pasa ku e mihó di nos, hasi un backup di bo website pa evitá pèrdè bo trabou kompletu. Wak esaki blog_post_pa_siña_tokante_diferente_manera_pa_hasi_backup_di_bo_website_WordPress (https://websitesetup.org/wordpress-backup/).\nKonklushon\nE siguridat di bo website ta igual ku e siguridat di bo kantor òf kas. Ora bo ta bai for di dje, bo ta sera e bentananan i slòt e portanan, bèrdat? No stroba e siguridat di bo website, e ta tan importante ku su desèño i kontenido.\nSi bo implementá e konsèhu di siguridat aki, bo website lo ta hopi mas difísil pa hack pa kriminal sibernétiko. Hasi esaki bo mes (https://codex.wordpress.org/Hardening_WordPress) òf pidi un hende (https://willem.com) yuda bo.",
 "word_count": 1287,
 "markdown_url": "https://agents.willem.com/pap/posts/2019-03-31_wordpress-10-konsehu-pa-sigura-bo-website/post.md"
}