WordPress is one of the most commonly used CMS (content management systems) available. According to a survey conducted by W3Techs, 43.0% of websites are powered by WordPress.

This is why security is so vital — because WordPress is one of the most commonly targeted CMS for hacks, and according to a study by Sucuri, out of 8000 infected websites, 74% were built on WordPress.

While most Managed WordPress hosts boast security, if you aren’t taking any steps on the website level, you are leaving your sites vulnerable to attack!

Below are 5 helpful tips to increase the security of your WordPress sites making it harder for hackers to take advantage.

1 – Use Strong Passwords and Store them in an Encrypted Password Manager instead of your Browser

One of the most common methods hackers use to get into your WordPress site, is to spam your login page with a Brute Force attack.

A brute force attack is when a hacker uses an automated means plus a list of commonly used username and password combinations on your login page enough times to finally “guess” your WordPress login.

You might think this is unlikely — but these programmed bots can run for days, even weeks until they finally get it right, and you’d be none-the-wiser, until it’s too late.

Using a strong password is a great way to prevent the effectiveness of Brute Force attacks. You can generate a strong, secure password using a secure password generator, or a safe online Password manager like 1Password.

Even a strong password isn’t effective if it’s not kept safe. Storing your passwords inside of a password manager like 1Password instead of your browser adds another layer of security.

2. Use a standardized Practice known as: the Principle of Least Privilege

Don’t give out your main administrator logins to any users or third party developers that aren’t 100% reputable or credible or that you do not trust 100%.

If you must provide logins to others, give them the least amount of access needed to accomplish the task they’ve been entrusted to do — then remove their access.

The CyberSecurity and Infrastructure Security agency outlines the Principle of Least Privilege here. 

3. Educate Your Organization and Users about the Dangers of Phishing

When it comes to security, your only strong as your weakest user. According to DataPro, Phishing emails are responsible for about 91 percent of cyber attacks against large corporations. Even if you are a smaller organization you are still at risk if you aren’t taking proactive measures against phishing.

What is a phishing attack? Phishing is a method where cybercriminals attempt to steal your passwords or other sensitive data by sending you or users in your organization or company fraudulent emails or messages that are made to look “official” in nature.

These types of emails can be made to look like emails from your own organization, tricking users into submitting their logins through unsecure forms or through other means — sending this information directly to cybercriminals.

The BEST way to defend against Phishing is to EDUCATE users within your organization about the dangers of phishing and to develop internal and standardized security practices, such as not sharing your logins, or never submitting sensitive information through any online forms. 

Another good practice is to instruct your users to challenge anyone who claims to be a member of your organization who is asking for sensitive data and to simply refuse the request.

Instructing your users NOT to open suspicious looking emails and instead to delete them immediately is also another effective way to to prevent successful phishing attacks.

4. Follow WordPress Best Security Practices

I’ve developed a WordPress Best Security Practices: a Guide to Hardening and Securing WordPress. This guide includes general steps you can take to increase the security of your WordPress site and Harden your WordPress site against Hackers.

Some of the key Points from within this guide are:

  • Keep WordPress Core Up-to-Date
  • Keep Themes & Plugins Up-to-Date
  • Auditing Plugins and Themes
  • Remove Unused Plugins & Themes

We recommend reviewing this guide and following the steps to increase your WordPress sites security.

5. Choose a Host that Puts the Security of Your WordPress Sites First

There are many web hosting companies and managed WordPress hosting companies out there to choose from.

You may be surprised to learn that 53% of users rate quality as the most important factor when making purchases compared to price (38 percent) according to a new report by First Insight.

With that in mind, choosing a quality WordPress hosting provider who puts security first is one of the most critical choices you can make for your company.

Most Managed WordPress hosting providers have added security benefits over shared hosting providers.

But even managed WordPress hosting providers have key differences in how they approach security.

Since most Managed WordPress hosting providers follow infrastructure standards to ensure their servers are secure, arguably the most important feature to shop for, and the most important question to ask, is this:

“What steps do you take to ensure the security of my WordPress site on the website level?”