In this post, you will find information that will help you protect your WordPress sites without using a security plugin.
Before giving you the recommendations, I would like to tell you that I don’t have any security on any of my WordPress sites.
These are practical recommendations to make your WordPress sites more secure.
Table of Contents
Strong Username and Password
The first step is using a password manager, so you can use long and complex passwords.
I use Bitwarden to save all my passwords but feel free to use the one you like the most.
Password Managers have options to create complex passwords, so you can create a complex username and password for your WordPress site.
Create the username using this tool and then do the same thing for your password.
That would make your username and password super hard for hackers to crack using brute force attacks.
Plugins and Themes
There are several things that you can do to make your site doesn’t get hacked via your theme and plugins
- Keep the plugins that you really need in your WordPress installation.
- Get rid of plugins that you don’t really need.
- Make sure that the plugins you use are regularly updated.
- Update all plugins as soon as there is an update or wait a few days only if you are completely sure that these don’t have an active vulnerability.
- Keep your version of WordPress updated.
- Download plugins and themes directly from the developers and WordPress.org
- Avoid the practice of installing a plugin for every tiny thing you want to add or remove from WordPress.
Try to follow WordPress Security blogs and subscribe to their mailing list to get news about the themes and plugins with active vulnerabilities.
Backups
Make sure that you use a hosting provider or Cloud Hosting panel that backs up your site regularly.
Cloudways does this for me. You can retain those backups for four weeks.
The frequency of the backups could be set to a minimum of one hour.
Besides this, I recommend using All in One WP Migration to make backups that you can save in a Dropbox or Google Drive account
You need to be ready to restore your site in case something bad happens to one of your sites.
Cleaning a site can be expensive and restoring can save you lots of time and money.
Don’t save backups in your WordPress installation. Those could be downloaded and used to access your database and hack your WordPress site.
Protect your Database, FTP and SSH
There are many hosting providers and cloud hosting panels that will do something to prevent your WordPress sites get hacked.
The Cloudways panel has the option to protect your Database, SFTP, and SSH.
If I don’t add your IP address, you won’t be able to access my database, check my WordPress Installation or access my server and run remote commands.
Protect PHP Files with CloudFlare
The last thing that you can do to ensure that your site is super safe is to create Cloudflare Firewall Rules.
You can create up to five rules to help you deal with most types of threats.
I am a bit more proactive with WordPress security but this will be enough to make sure that nobody can check for PHP files on your WordPress site.
Whitelist your IP address and your server IP address to make sure you don’t get blocked by the rules you create.
These Features aren’t Needed
These are some features that user keeps recommending and that you don’t need when you follow some of the previous recommendations.
- You don’t need to activate two-factor authentication when no bot or person has access to your site’s login page.
- You don’t need to have other forms of login protection when no bot or person has access to your site’s login page.
- You can limit bots submitting spam via comments or forms submission by implementing Cloudflare Turnstile
- You don’t need a Firewall when you have all you need to build a custom one.
Conclusion
I recommend using security plugins when users don’t know sh*t about how basic WordPress security works or if users are too busy to learn about how to keep most threats at bay.
