It’s important to understand that there is no “set it and forget it” solution for security. With the freedom to use a wide variety of custom code in the form of themes and plugins, also comes a great responsibility. Security is a partnership WP Engine shares with our customers. With that in mind, there are a number of best practices we recommend for all WordPress websites.
Stay Up to Date
A simple oversight in updating your plugins can be a big deal. Plugin vulnerabilities represent 55.9% of the known entry points for attacks. Keeping your plugins and themes up to date is easily the most important step to maintaining a fast and secure WordPress website.
Keeping WordPress core up to date is also crucial to your site’s security. At WP Engine we handle core upgrades for you by default.
Read more about WP Engine’s WordPress automatic core update process here.
If keeping plugins up to date is too time-consuming or oftens causes your site to break, we offer the Smart Plugin Manager. This service keeps your plugins up to date, creates backup checkpoints and runs visual checks to ensure no updates are pushed that will break you site.
Check out Smart Plugin Manager here.
Choose Plugin/Themes Carefully
It is important to have a discerning eye when it comes to choosing the theme and plugins your site will use. Each addition to your site contributes more code, which translates to more potential security flaws as well as extra pieces to maintain and update.
For similar reasons, you should also be certain to always fully delete any plugins or themes you are not actively using.
A good first step is to ensure you download your plugins and themes through the WordPress.org repository, since these are subject to their stringent approval process.
Look for plugins and themes that:
- Are actively maintained
- Have been recently updated
- Have a wide and happy user base
- Provide user help in the Support section
Not only are you more likely to have success with these plugins and themes overall, but these are also the most likely to respond quickly should a vulnerability be discovered.
Enforce Two-Factor Authentication
Your login page is the gateway to the administrative controls of your website. A simple way to double-down on security for your login page is to use two-factor authentication, or 2FA.
This method requires users to verify their identity with a second method beyond a simple username and password. For example, two-factor authentication might require you to enter an additional rotating code from an app on your phone.
An attacker might be able to brute force your username and password, but they still would be unable to access your site’s administration area if they didn’t guess the right code at the exact interval.
WP Engine offers Two-Factor Authentication for the User Portal, and there are several plugins to help with this on your WordPress site as well.
Adhere to the “Least Privilege” Principle
The “Least Privilege” principle means users should only be given the access level they need to perform their core role and nothing more.
If you are an Administrator on a WordPress site, the responsibility of determining the access level of other users falls to you. Be extremely strict with users who publish content, and especially with other Administrators. Ask yourself: does this user truly need this level of access in order to perform their core role?
Learn more about WordPress user roles here.
If you are a developer on a website, your responsibility is to ensure your code is adhering to WordPress Coding Standards and using core WordPress APIs where possible.
Proactive Security through Monitoring
Both uptime monitoring and file integrity monitoring are proactive strategies to keep your site secure and available.
Uptime monitoring services like Pingdom and UptimeRobot will notify you if your your site is not behaving as expected.
Increasing awareness allows your team to respond as quickly as possible if the unthinkable happens.
Tools like Google Search Console help by monitoring your site’s reputation and health, to notify you if your site ends up on any blacklists.