WordPress Security Tips

As a WEB DESIGNER, I do quite a bit of of web and blog design using WordPress. There are numerous benefits that WordPress offers. It is a very good Content Management System (CMS) and superb blog software. Our clients can easily be trained to maintain all web site content using WordPress with in-house staff. Plus, WordPress contains a plugin system that allows us to quickly install a wide range of features in minutes without extensive coding. Social Media tools and Search Engine Optimization (SEO) features can quickly be updated and installed through well-supported plugins.

There is a downside however. Like any widely used and popular online technology, WordPress has attracted the attention of the hacker community. Therefore, WordPress security is under constant attack by malicious coders. Here is some common sense advice on maximizing the security of your WordPress installation:

First, the web host you choose for your WordPress web site or blog really matters. That cannot be over-emphasized. Much of the exploitation of WordPress installations by hackers can be thwarted by sound security practices implemented by your web host at the server level. A good web host will have an ongoing program of server security. However, all web hosting companies are not equal, and some do a very poor job of securing their web servers to prevent most common hacker exploits.

This is a lesson I learned the hard way. I once hosted a very popular WordPress blog at a large, well known web hosting company (EMAIL ME if you want to know the name) who is, evidently, much better at marketing than security. My WordPress blog was being compromised by a common hacking exploit that attacks the MySql database WordPress uses to store data. In fact, many other WordPress blogs hosted by this company were also being attacked by the same exploit. After much research and testing, I discovered that this hacking exploit was not something I could fix. My web host had to secure their servers to eliminate the problem. However, they would not do so. They were more concerned with getting me to buy upgrades rather than fixing the glaring security issue.

I finally resolved the problem by moving the blog to a new web hosting company. It was a real headache because I had more than 3,000 pages and thousands of photos to transfer. However, the new web host had sound security practices that eliminated the security problem.

Moving to the new web host meant that I could not use one of my installed WordPress plugins unless I disabled an important security feature set up by default on my new account. Doing so was my option. However, it would have eliminated an important security feature that protects my WordPress installation from a common hacker exploit. I decided that the security of my web site was more important, and choose to remove the plugin instead. The blog has not had any security issues since the move. 

This brings me to an important WordPress security tip. Be very cautious about using any WordPress plugin that requires changing server settings (typically .htaccess) that disables any security feature. It may not be worth the risk.

Of course, it is also smart to keep your WordPress installation and plugins up to date. As WordPress issues security updates, it is wise to install them promptly. Doing that, along with having a web host that takes security seriously will protect you from most hacking attempts.

Finally, here are two security tips that you should use when installing WordPress. First, never use the default username "admin" when installing WordPress software. Choose a unique username along with your password for added security. Secondly, while installing WordPress you need to change the default  “wp_” prefix that is added to your database installation to a unique name. WordPress will give you the option to do so as part of the installation routine. Most common WordPress hacker attacks will look for that default prefix to determine if you have an exploitable WordPress database. 

These basic steps will protect you from the majority of common hacker attempts to exploit your WordPress installation. 

EMAIL ME if you want to know the name of the large and popular web host that had dismal WordPress security. I will send you the name. However, I am delighted to recommend the web host I moved to that maintains good server security, ICDSOFT.COM. They are modestly priced, offer topnotch support, and have a proactive program for WordPress web site security. If you value the security of your WordPress site, check out ICDSOFT.COM.