WordPress Security without Plugins: 5 Best Tips

In this post, you will find information that will help you protect your WordPress sites without using a security plugin.

Before giving you the recommendations, I would like to tell you that I don’t have any security on any of my WordPress sites.

These are practical recommendations to make your WordPress sites more secure.

Strong Username and Password

The first step is using a password manager, so you can use long and complex passwords.

I use Bitwarden and LastPass to save all my passwords.

Password Managers have options to create complex passwords, so you can create a complex username and password for your WordPress site.

Create the username using this tool and then create your password.

That would make your username and password super hard for hackers to crack using brute force attacks.

Plugins and Themes

There are several things that you can do to make your site doesn’t get hacked via your theme and plugins

1. Keep the plugins that you really need in your WordPress installation.
2. Get rid of plugins that you don’t really need.
3. Make sure that the plugins you use are regularly updated.
4. Update all plugins as soon as there is an update or wait a few days only if you are completely sure that these don’t have an active vulnerability.
5. Keep your version of WordPress updated.
6. Download plugins and themes directly from the developers and WordPress.org
7. Avoid the practice of installing a plugin for every tiny thing you want to add or remove from WordPress.

Try to follow WordPress Security blogs and subscribe to their mailing list to get news about the active themes and plugins with vulnerabilities.

Backups

Make sure that you use a hosting provider or Cloud Hosting panel that backs up your site regularly.

Cloudways does this for me. You can retain those backups for four weeks.

The frequency of the backups could be set to a minimum of one hour.

Besides this, I recommend using All in One WP Migration to make backups that you can save in a dropbox or drive account

You need to be ready to restore your site in case something bad happens.

Cleaning a site can be expensive and restoring can save you time and a lot of money.

Don’t save backups in your WordPress installation. Those could be downloaded and used to access your database and hack your WordPress site.

Protect your Database, FTP and SSH

There are many hosting providers and cloud hosting panels that will do something to prevent your WordPress sites get hacked.

The Cloudways panel has the option to protect your Database, SFTP, and SSH.

If I don’t add your IP address, you won’t be able to access my database, check my WordPress Installation or access my server and run remote commands.

Protect PHP Files with CloudFlare

The last thing that you can do to ensure that your site is super safe is to create Cloudflare Firewall Rules.

You can create up to five rules to help you deal with most types of threats.

I am a bit more proactive with WordPress security but this will be enough to make sure that nobody can check for PHP files on your WordPress site.

Whitelist your IP address to make sure you don’t get blocked by the rules you create.

These Features aren’t Needed

These are some features that user keeps recommending and that you don’t need when you follow some of these recommendations.

• You don’t need to activate two-factor authentication when no bot or person has access to your site’s login page.

• You don’t need to have other forms of login protection when no bot or person has access to your site’s login page.

• You can limit bots submitting spam via comments or forms submission by implementing Cloudflare Turnstile

• You don’t need a Firewall when you have all you need to build a custom one.

Conclusion

If you follow the previous recommendations:

• You have a strong password, updated plugins, themes, and software,
• You have off-site backups, your connection to the database, WordPress installation, and the ability to execute remote commands is limited to your IP address.
• You have reliable hosting.
• Your PHP files have been protected including the login page and xmlrpc.php

I recommend using security plugins when users don’t know sh*t about how basic WordPress security works or if users are too busy to learn about how to keep most threats at bay.