How to Secure Your WordPress Site (25 Hardening Tips)

WordPress is an excellent, secure platform out of the box, but there’s certainly more you can (and should!) do to keep your site safe from malicious intent. Many of these security enhancements are easy to implement and can be performed manually in mere minutes. Others simply require installing a particular plugin.

In this article, I’ll guide you through 25 different strategies for upping the defenses on your WordPress fortress. But first, let’s go a little more into the weeds on why website security should matter to you.

Why WordPress Security is So Important

If you’re looking to create a secure site, choosing WordPress as your platform is an excellent way to start. It’s not only a flexible, powerful platform for building websites — it’s also remarkably secure out of the box.

That’s because WordPress developers care about security and are dedicated to “hardening” the core platform as much as possible. Plus, they frequently release security-focused updates and patches, which will be automatically downloaded and installed on your site. This means your site will be well-equipped to deal with any new threats that pop up.

Of course, no platform can be 100% secure. Hackers are hard at work trying to find their way into even the most well-protected sites (if only they’d use their powers for good, amirite?) And since WordPress powers more than 30% of the web, it’s popular enough to be a constant target.

It should go without saying, but if baddies do manage to break into your site, they can cause a lot of damage.

For example, they can steal or otherwise compromise sensitive information, install malware, make changes to your site to suit their needs, or even bring it down entirely. This is harmful to both you and your users, and if you’re running a business,  it can mean lost customers and revenue.

It’s vitally important to take additional steps to secure your WordPress website. You’ll want to put just as much time and effort into this endeavor as you spent designing your site in the first place (if not more). Fortunately for you, dear reader, there are lots of simple, quick ways to improve your site’s security, as well as some more complex techniques you may want to employ.

25 WordPress Security Tips

Hopefully, I’ve convinced you about the importance of maintaining a secure WordPress website. If not, I’m going to have to re-enroll in Persuasive Writing 101. Please don’t make me do that.

Throughout the rest of this article, I’ll introduce 25 handy strategies for making your site safer and reducing the chances of it being compromised. Plus, I’ll point you in the right direction to get started with each technique.

You don’t have to implement every suggestion on this list — although you certainly can — but the more steps you take to secure your site, the lower your chances of encountering a disaster down the road.

Use a Quality Host

You can think of your web host as your website’s street on the Internet — it’s the place where your site “lives.”

Like a good school district matters to your kid’s future (so they say; I turned out fine), the quality of your website’s home base counts in a lot of big ways.

A solid hosting provider can impact how well your site performs, how reliable it is, how large it can grow, and even how highly it ranks in search engines. The best hosts offer many useful features, excellent support, and a service tailored to your chosen platform.

As you’ve probably already guessed, your web host can also have a significant impact on your site’s security. There are several security benefits to choosing a solid hosting service.

How Web Hosting Can Improve WordPress Security

• A quality host will constantly update its service, software, and tools to respond to the latest threats and eliminate potential security breaches.
• Web hosts often offer various targeted security features, such as SSL/TLS certificates and DDoS protection. You should also get access to a Web Application Firewall (WAF), which will help monitor and block serious threats to your site.
• Your web host will most likely provide a way to back up your site (in some cases, even carrying it out for you), so if you’re hacked, you can easily revert to a stable, previous version.
• If your host offers reliable, 24/7 support, you’ll always have someone to help you out if you do run into a security-related issue.

 

This list should give you a good starting point to work from when looking for a host for your new site, or even if you’re thinking about changing hosts. You’ll want to find one that offers all of the features and functionality you’ll need, plus has a reputation for reliability and excellent performance.

DreamPress is a managed WordPress hosting service that’s fast, reliable, scalable, and, of course, secure. DreamPress includes a pre-installed SSL/TSL certificate and provides a dedicated WAF designed with rules built to protect WordPress sites and block hacking attempts. You’ll also get automated backups, 24/7 support from WordPress experts, and Jetpack Premium — a plugin that can add many additional security features to your site — at no additional cost.

With DreamPress, you’ll be able to rest easy knowing that your site is protected. Our hosting service even takes care of many of the following security-enhancing steps for you — although we still encourage you to read on to learn what extra measures you can take.

Private Domain Registration

To register a domain, you’re asked to provide your name, address, and phone number. This information is used to track ownership of domain names and is available online with a quick search on the WHOIS directory.

While keeping track of this information is vital to the health of the internet, it’s reasonable not to want your personal information online. This is where Private Registration enters the story. When you register a domain with DreamHost (or another secure hosting platform, I guess), you have the option to substitute your personal information with the relevant data from the hosting platform– So, looking up your domain on WHOIS would show DreamHost’s address and contact information. You can even enable this security feature after your domain has already been registered!

Switch Your Site to HTTPS

Let’s talk more about an SSL/TLS certificate. This enables you to switch your site to HyperText Transfer Protocol Secure (HTTPS) — a more secure version of HTTP. These are important security concepts to understand but simple to grasp, even if you’ve never heard of them before.

HTTP is the protocol that transfers data between your website and any browser trying to access it. When a visitor clicks on your home page, all of your content, media, and website code are sent through this protocol to the visitor’s location.

While this is necessary, of course, it does introduce some potential security issues. Baddies can try to intercept the data while it is in transit and use it for their own nefarious purposes.

HTTPS solves this problem! It does the same thing as HTTP but also encrypts your site’s data while it’s traveling from one point to another, so it can’t be easily accessed.

Initially, HTTPS was used mainly for sites handling sensitive customer information, such as credit card details. However, it’s becoming increasingly common for all sites, and big names such as WordPress and Google have been pushing for its widespread implementation.

How to Switch to HTTPS

To switch your site over to HTTPS, you’ll first need an SSL/TLS certificate. This communicates to browsers that your site is legitimate and its data is properly encrypted.

You can also get one for free from certain sites, such as Let’s Encrypt.

 

A quality host will typically provide an SSL/TLS certificate as part of your hosting package. In fact, at DreamHost, we offer Let’s Encrypt certificates for free with all of our hosting plans!

Once you have an SSL/TLS certificate installed on your site, you’ll simply need to implement HTTPS. Your host may take care of this for you, although it’s also fairly easy to do yourself. If you’ve chosen to go with DreamPress, the stretch limo of hosting, your site will be created using HTTPS from the start. Roll out!

Change the Admin Username

When you first create your website, all shiny and new, you’re given a User Profile. At any time, you can go back and change your Nickname or fill in your Full Name, but to change your username is an entirely different story. To change your username you will need to create a whole new user and grant that account the administrator role. The drawback? You need to use a different email address than the one used by your current account.

After creation, you can alter your username by creating a new user, giving it the administrator role and attributing all your content to it, and then deleting your original account. When your previous username has been deleted, you can change the email address of your new account if you desire.

Create a Secure Password

Folks, it’s really important to select your login credentials carefully. Like really, really important!

Why? This makes it harder for a sketchy weirdo to break into your site. You probably have plenty of experience choosing strong usernames and passwords for other accounts across the web — doing the same for your WordPress website is a big deal.

When you create your site, you’ll be given the opportunity to create a login username and password. The username will default to admin, although you can change it if you’d like (and probably should). But since there are various ways for people to find out what your WordPress username is, you can stick with the default option if you want to.

Your password, however, is crucially important, and you’ll want to choose a strong one. There’s recently been a U-turn of sorts on how to choose a strong password, with a recommendation of a simple four-word phrase trumping the classic mixture of random letters, numbers, and symbols. It’s a method that has been popular in some circles for a while.

If all the talk of choosing a password makes your head spin, we recommend sticking with WordPress’ own password generator as it automatically generates an (almost) ironclad password directly within the WordPress back end. Just be sure to record your credentials somewhere safe, like an encrypted password manager, so you don’t forget them.

For your password, you can simply go to Users > All Users from your WordPress admin dashboard, click on your username and enter a new password on the Edit User screen.

Enable a Web Application Firewall

​​

 

You’re probably familiar with the concept of a firewall — a program that helps to block all sorts of unwanted attacks. Most likely, you have some kind of firewall on your computer. A Web Application Firewall (WAF) is simply a firewall designed specifically for websites. It can protect servers, specific websites, or entire groups of sites.

A WAF on your WordPress site will function as a barrier between your website and the rest of the web. A firewall monitors incoming activity, detects attacks, malware, and other unwanted events, and blocks anything it considers a risk. #winning

If you’ve opted for our DreamPress package, you can relax; you won’t need an additional firewall. DreamPress includes a built-in WAF that will monitor your site for threats and block malicious users and programs from gaining access. No action required on your part.

DreamHost also offers DreamShield, our in-house malware scanning service. When you enable DreamShield on your hosting account, we’ll scan your site weekly for malicious code. If we find anything suspicious, you’ll be notified immediately via email.

Implement Two-Factor Authentication 

Before we move on, there’s one more technique to address: two-factor authentication (which also goes by two-step authentication and a variety of other, similar names). The term refers to the two-step process you’ll need to follow when logging into your site. This takes a little more time on your end but goes a long way towards keeping hackers out.

Two-factor authentication involves using a smartphone or other device to verify your login. First, you’ll visit your WordPress site and enter your username and password as usual. A unique code will then be sent to your mobile device, which you’ll need to provide to complete logging in. This enables you to prove your identity by showing you have access to something solely yours — such as a particular phone or tablet.

As with many WordPress features, two-factor authentication is easy to add with a dedicated plugin. Two Factor Authentication is a solid choice — it’s created by reliable developers, compatible with Google Authenticator, and will enable you to add this functionality to your site without fuss.

Another choice is the Two-Factor plugin, which is well known for its reliability and was built mainly by core WordPress developers. As with any plugin in this category, the learning curve is a little steep, but it will get the job done and is very secure. If you’re willing to spend a little money, you can also check out Jetpack’s Clef-like premium solution.

Whatever route you choose, make sure to plan ahead with your team if relevant, since you’ll need to gather their phone numbers and other information to get started. With that, your login page is now secured and ready to go.

Be Mindful When Adding New Plugins and Themes

The ready availability of themes and plugins is one of the best things about using WordPress. With these handy tools, you can make your site look just right and add nearly any feature or functionality you can think of.

Not all plugins and themes are created equally, though.

Developers who aren’t careful or don’t have the right level of experience can create plugins that are unreliable or insecure — or, just downright sucky. They might use poor coding practices that leave holes hackers can easily exploit or unknowingly interfere with crucial functionality.

This all means you need to be very careful about the themes and plugins you choose to add to your site. Each one should be vetted to ensure it’s a solid option that won’t hurt your site or cause problems. There are many elements to keep in mind, but the following advice will help you select quality tools:

• Read reviews. Check user ratings and reviews to learn whether other people have had a good experience with the plugin or theme in question.
• Developer support. Take a look at how recently the plugin or theme has been updated. If it’s been longer than six months, chances are it isn’t as secure as it could be.
• Easy does it. Install new plugins and themes one at a time, so if anything goes wrong, you’ll know what the cause was. Also, be sure to back up your site before adding anything to it.
• Vetted sources. Get your plugins and themes from trustworthy sources, such as the WordPress.org Theme and Plugin Directories, ThemeForest and CodeCanyon, and reliable developer websites.

Update Often 

Your work isn’t done once you’ve installed the plugins and themes you want for your site.

You’ll also need to keep them up to date to ensure they work well together and are secured against the latest threats. Fortunately, this is quite easy — you’ll simply need to go to your WordPress dashboard, look for the red notifications telling you there are themes and/or plugins with available updates, and click on update now next to each one.

You can also update your plugins in a batch by selecting all of them and then hitting the update button, either here or in the WordPress panel. This is a quicker option, but keep in mind, updating all of them at once could make it more difficult to diagnose any problems that arise as a result of the updates. If you’re making sure to only choose reliable plugins and themes, however, this shouldn’t be a problem.

Before we move on, it’s worth mentioning that you should also keep WordPress itself up to date. Smaller patches and security updates will be added automatically, but you may need to implement major updates on your own (again, this is very simple to do). This probably goes without saying at this point, but DreamHost handles these updates for you, so you won’t need to worry.

Remember: leaving WordPress or any of your themes and plugins out of date is a risk you don’t want to take.

Configure File Permissions 

Let’s talk technical for a moment.

A lot of the information, data, and content on your WordPress site is stored in a series of folders and files. These are organized into a hierarchical structure, and each one is given a permissions level. The permissions on a WordPress file or folder determine who can view and edit it and may be set to allow access to anyone, only to you, or almost anything in between.

File permissions are represented by a three-digit number in WordPress, and each digit has a meaning. The first digit stands for an individual user (the site’s owner), the second digit for the group (for example, members of your site), and the third for everyone in the world. The number itself means that the user, group, or world:

• 0: Has no access to the file.
• 1: Can only execute the file.
• 2: Can edit the file.
• 3: Can edit and execute the file.
• 4: Can read the file.
• 5: Can read and execute the file.
• 6: Can read and edit the file.
• 7: Can read, edit, and execute the file.

So if a file is given a permissions level of 640, for example, it means the primary user can read and edit the file, the group can read the file but not edit it, and everyone else cannot access it. This may seem overly complicated, but it’s important to ensure that each person only has the level of access to your site’s files and folders you want them to have.

WordPress recommends setting folders to a permissions level of 755 and files to 644. You’re pretty safe sticking to these guidelines, although you can set up any combination you’d like. Just remember that it’s best not to give anyone more access than they absolutely need, especially to core files.

You’ll also want to keep in mind that the ideal permissions settings will depend somewhat on your hosting service, so you may want to find out what your host recommends.

Note: You should be very careful when making changes to your permissions levels — choosing the wrong values (like the dreaded 777) can make your site inaccessible.

Keep WordPress Users to a Minimum

If you’re running your WordPress site solo, you don’t need to worry about this step. Just don’t give anyone else an account on your site, and you’ll be the only person who can make changes.

However, many humans like other people and do eventually add more than one user to their website. You may want to let other authors contribute content, or you might need people to help edit that content and manage your site. It’s even likely you’ll find yourself with an entire team of users who’ll regularly access your WordPress site and make their own changes.

This can be beneficial in many ways and is sometimes even necessary. However, it’s also a potential security risk.

The more people you let into your site, the higher the chance that someone will make a fat-finger mistake or that a user will cause problems just to be a putz. For this reason, it’s smart to keep the user count on your site as low as possible while not hampering its ability to grow. In particular, try to limit the number of administrators and other user roles with high privileges.

Here are a few more suggestions:

• Limit each user to only what permissions are necessary for them to do their job.
• Encourage users to use strong passwords (remember No. 3?).
• Try to stick with one administrator, if possible, and a small group of editors.
• Give users who have left the site or no longer need access the boot.
• Consider downloading a plugin, such as Members, which provides a user interface for WordPress’ role and capabilities system.

Log Out Idle Users  

It’s happened to all of us– we’re browsing on the computer when something distracts us IRL (in real life). The dog barks, the doorbell rings, and after we stand up and take care of whatever got our attention, there’s something else to do. And again, and again, and then it’s been 3 hours since you were at your computer, and your cat has typed “fdhhhhhhhhhhhhhhhhhhh” in your chat.

Of course, mittens typing her feelings on discord is actually the least malicious thing that could happen. Leaving a computer unlocked means that someone could take over their session and make changes to their account or your website.

While user awareness is always a great solution, sometimes you just have to say “There’s a plugin for that!” In this case, the Inactive Logout plugin.

Once you install and activate the plugin, visit Settings >> Inactive Logout page. Here you can configure when the timeout activates, and add a message to be displayed during inactivity.

Whether you choose to grab the plugin or not, remember that practice makes perfect, and remind anyone with access to your site that they should log out or lock their computer when they walk away.

Limit Login Attempts 

Forgetting your password is a universal experience. It can take 2 or 3 attempts before we angrily try to reset our password and get “error: password must not have been used previously.”

But I digress. WordPress allows an unlimited amount of guesses, which means that brute force attacks, or attacks where a hacker tries any number of passwords, are one of the most common ways hackers gain access to private accounts. With no limit on login attempts, a hacker could try every password in the book with no consequences.

To set a limit to the amount of login attempts a user can make, first check your Web Access Firewall (WAF) mentioned in #6. If your firewall is already set up, there will already be a limit in place.

But, never forget, there’s a plugin for that! In fact, there are several.

Both Login Lockdown and Cerber Limit Login Attempts record the IP Address and Time Stamp of each failed login attempt, and allows you to set how many failed attempts are allowed in a certain span of time, as well as how long that IP address should be locked out for. Both are free, however Login Lockdown is simpler to navigate, limiting your options to only what a beginner might need. If you require a more robust system, Cerber Limit Login Attempts is the way to go, allowing not only IP white/blacklisting, but also notifying admins if a certain number of lockouts is reached.

 

Track Your Admin Area Activity 

If you’ve got multiple users, it can be a good idea to keep tabs on what they’re all doing on the site. Tracking activity in your WordPress admin area will help you spot when other users are doing things they shouldn’t and can indicate whether unauthorized users have gained access.

When a weird change has been made or something suspicious is installed, you’ll want to be able to find out who was behind the activity. Plugins got you covered.

Most larger security plugins don’t provide this functionality out of the box, so you’ll want to find a dedicated solution. If you’d like to take a hands-off approach, Simple History lives up to its name by creating a streamlined, easy-to-understand log of important changes and events on your site.

For more involved tracking features, you can also check out WP Security Audit Log, which keeps an eye on just about everything that happens on your site and offers many useful, premium add-ons.

Once you have a suitable plugin installed, it’s a smart idea to check the log periodically for anything out of the ordinary. If something happens on your site that you weren’t expecting or bugs suddenly pop up, look through the most recent activity.

Utilize CAPTCHA

Junkmail! Spam! Whatever you call it, it shows up in our comments or our inboxes sooner or later. Usually spam is harmless commercials trying to get your attention– The danger comes from junk mail that is hiding phishing links or malicious software. So what’s the best way to get those cheesy advertisements out of your comment section, and make sure that any form results you collect are legitimate? It sure would be nice if we had some sort of Completely Automated Public Turing test to tell Computers and Humans Apart (aka: our friend, CAPTCHA).

CAPTCHA works by asking the user to do something that software cannot do. You may be asked to check a box, click all the images with a boat in them (oh, we love those don’t we?), or typing in some wobbly letters. When the user does the task correctly, the system says “oh, this isn’t a spambot!” and lets them pass.

There are a few different plugins that allow you to add a CAPTCHA to certain pages in your website, the most widely talked about would be reCaptcha by BestWebSoft. With several versions of CAPTCHA available through the plugin, frequent updates, and the plugin available in 12 languages, it’s truly the whole package.

Another option is CAPTCHA 4WP By WP White Security. CAPTCHA 4WP allows you to add CAPTCHA not just to WordPress forms, but also to eCommerce pages and other third party plugins.

As the BestWebSoft reCAPTCHA page says “easy for people and hard for bots.”

Backup Your Site Regularly 

I’d be lying if I said there was a magic solution for protecting your website from all threats. Even if you implement every suggestion on this list, there’s still a chance you may experience a security breach on your site.

Hackers are good at what they do. You’ve just got to beat them at their game.

A comprehensive security plan means preparing for what you’ll do if the worst happens, even while you’re trying to ensure it never does.

Backing up your site on a regular basis is the simplest and best way to safeguard it in the event of a disaster. If you have a recent backup handy, you can restore your site to the way it was before it was hacked or otherwise harmed. This will help you fix the issue and move on as quickly as possible.

 

Of course, you’ll want to be smart about the way you create and use your backups. The following tips are a good start:

Keep more than one backup. A good rule of thumb is to have at least three recent backups on hand at all times since it’s possible your most recent backup could have issues you haven’t yet noticed.

Save your backups in multiple external locations, such as cloud storage and physical hard drives.

Set up and stick to a consistent backup schedule. The frequency and timing are up to you, although there are plenty of solid recommendations you can follow.

In addition to your regular backup schedule, it’s always smart to create an extra backup of your site before making any changes to it. So (nudge, nudge) before implementing any of these security-boosting techniques, make sure you have a recent backup ready to go.

Password Protect Your Login Page 

The login page is the most likely way for hackers to try to access your website, and if you’re hosting content that perhaps not everyone needs to see, password protection is still the best way to go.

As a simple solution, for blog posts or an About Me section, you can add password protection by going into pages >> all posts option within your WordPress account. Once you hit “edit” you’ll see the option to change the visibility to “Password Protected”. Just publish, and badabing-badaboom, that page is locked up tight!

There are other methods to lock different areas of your website. A few options can be a bit technical, but are still worth learning. For example, you can create an htaccess file, and add a password prompt to your login page! A login for your login! What will they think of next?

Hide Your Login Page

Adding password protection to your login page is great, but what if hackers couldn’t even find your login page? As we’ve stated before, defaults can be our greatest weakness, and changing your wp-admin and wp-login pages are too easy not to do!

There are several plugins that offer this service and will even redirect the default login page to another page of your choosing. It’s possible to find plugins that offer this as part of a large package (Defender also includes a malware scanner and firewall) but if you’re looking for something simple, there’s something for you as well (WPS Hide Login hides your login and that’s it. There are other extensions available, but this keeps things simple). Just don’t forget, you may need to bookmark your login page since it won’t be the default anymore.

Update PHP 

 

Just like America runs on Donuts (don’t quote us there), WordPress runs on PHP. Updating WordPress isn’t enough to keep your site safe and secure– you need to be sure that you’re using one of the latest versions of PHP as well.

Normally each PHP version is supported for at least 2 years after its release date, so any vulnerabilities are addressed by the engineers who designed the code. When that code goes out of date (or reaches its EOL or “end of life”), it’s time to upgrade, or risk being exposed to security concerns, performance slowdown, and bugs galore!

In November, 2022, PHP 8.2 will be released. To see which version of PHP you’re currently running, login to your WordPress site, and select Tools >> Site Health. Navigate to Info and then Server, and there’s your current PHP version.

Secure Your Database 

Leaving anything at the default settings is a boon for hackers, and by default WordPress uses wp_ as the prefix for All of your related tables. Good news! If you’re using the One-Click Installer there is already a prefix of random letters and numbers. As long as it ends with an underscore, the system is happy. Better News! Even if your WordPress is already installed, it may be eligible for the One-Click Installer as long as the website is fully hosted, and meets a few other guidelines.

This is a big step for security, and breaking something can be as easy as a missing underscore. Luckily, there is a default version of the wp-config.php file available at WordPress Core available, so you can rebuild whether you tried to change the database prefix manually, or with a service like phpMyAdmin.

Add Security Questions 

While not the most common solution, security questions give that extra oomph to your security. Depending on the plugin you choose, you may need to choose from already existing security questions, or be able to create your own. This feature often comes bundled with another feature, for example two-factor authentication. Don’t underestimate the abundance of methods available to protect your login page from nefarious actors!

Hide WordPress Version 

We talked about keeping your website up to date, but what if that’s not an option? We know how reluctant people have been with updating Microsoft Windows…

Well, Security through Obscurity– if they can’t find it, they can’t hack it! Hide which version of WordPress you’re using, or hide that you’re using WordPress altogether. You can hide your WordPress information by altering the header code. While you can go into your theme settings and edit the display information there, those snippets of code will only return during the next theme update.

But, of course, there’s a plugin for that. WPCode is a free plugin that allows you to enter a variety of code snippets, including one for removing the version number, no matter how many times that pesky theme tries to write it back in.

Prevent Hotlinking 

Hotlinking is the act of stealing bandwidth by using files hosted on one site, and linking them to another. For example, let’s say someone draws a pretty clever comic, and perhaps some other website wants to feature that content without permission. They would hotlink those comics– instead of hosting them from their own servers, they would just link to them. This costs the original website more bandwidth, and therefore more money.

To prevent hotlinking, you can choose to reject certain domains, allow only certain domains, or remove the ability to hotlink all together all by making a few changes to your htaccess file. You can even include a snippet in your .htaccess file that routes all hotlinking attempts to a page or image of your choice– perhaps one that specifically says “Stop Hotlinking, 2022!”

DDoS Protection ( Disable XML RPC )  

A Distributed Denial of Service attack (or DDoS), is when a hacker uses multiple systems to send a huge volume of data and overwhelm their target. This can slow down and crash their target – imagine a huge traffic jam for your website where no legitimate traffic could get in.

We know that patience on the internet is hard to come by, with the average user waiting only 3 seconds for a page to load before clicking away, so the sooner you can identify and resolve an attack on your website, the better.

While preventing a DDoS attack may seem daunting, one of the first steps you can take is to remove (or at least disabe) any old or unutilized plugins. Plugins are incredibly useful, but by increasing functionality, they also have access to your website that can be exploited. For once, downloading more plugins is not the answer!

You also may be wondering what this XML-RPC is. Well, specifically, it allows WordPress access through the app on your mobile device. If you’re not using your smartphone to make changes to your WordPress website, then you likely don’t need this feature enabled. Turning it off involves adding a quick snippet of code to your htaccess file, and you’ll be all the safer for it.

Malware Scanning 

Unfortunately, there is software out there that is more covert than your average pop-up virus. Malware (short for malicious software) hides in what appears to be decent applications so that the user doesn’t know their computer or website has been infected.

Malware scanning is an important defense– It works by deep scanning the computer and using anti-malware software to identify and isolate suspicious files until you decide if they need to be removed. If a threat is detected, a good malware scanner will delete any trace of it from your computer ASAP. Luckily, several firewall plugins come with malware scanning built in– so make sure to check your current security plugins to see what they offer.

If you have DreamHost as your hosting platform, you can activate DreamShield to handle malware scanning for you on a weekly basis.

WordPress Security: Locking It Up 

If your website is hacked, you’ll spend hours (perhaps even days) trying to repair the damage. You may permanently lose data or see your personal information compromised — or worse, your clients’ data.

That’s why you’ve got to put a whole lot of time and energy into making sure that this situation never occurs. Otherwise, you’re likely to lose valuable business and precious time.

These 25 WordPress security tips should help. Some are simple tweaks. Others affect your entire site, such as switching to HTTPS or adding an SSL certificate. Of course, you’ll also want to make sure your site runs on a secured WordPress host.

Our DreamPress hosting (with free WordPress migration) is specifically designed for the WordPress environment. Plus, if you ever do encounter a security issue, we’ve got you covered with automatic daily backups, a weekly malware scan, and our support team of WordPress experts!