1. Use two-factor authentication for WordPress security
Introducing a two-factor authentication (2FA) module on the login page is another good security measure. In this case, the user provides login details for two different components. The website owner decides what those two are. It can be a regular password followed by a secret question, a secret code, a set of characters, or more popular, the Google Authenticator app, which sends a secret code to your phone. This way, only the person with your phone (you) can log in to your site.
I prefer using a secret code while deploying 2FA on any of my websites. The Google Authenticator plugin helps me with that in just a few clicks.
2. Use your email to log in
By default, you have to input your username to log into WordPress. Using an email ID instead of a username is a more secure approach. The reasons are quite obvious. Usernames are easy to predict, while email IDs are not. Also, any WordPress user account is created with a unique email address, making it a valid identifier for logging in.
Several WordPress security plugins allow you to set up login pages so that all users must use their email addresses to log in.
4. Rename your login URL to secure your WordPress website
Changing the login URL is an easy thing to do. By default, the WordPress login page can be accessed easily via
wp-admin added to the site’s main URL.
When hackers know the direct URL of your login page, they can try to brute force their way in. They attempt to log in with their GWDb (Guess Work Database, i.e. a database of guessed usernames and passwords; e.g. username:
admin and password:
p@ssword … with millions of such combinations).
At this point, we have already restricted the user login attempts and swapped usernames for email IDs. Now we can replace the login URL and get rid of 99% of direct brute force attacks.
This little trick restricts an unauthorized entity from accessing the login page. Only someone with the exact URL can do it. Again, the iThemes Security plugin can help you change your login URLs. Like so:
wp-login.phpto something unique; e.g.
/wp-admin/to something unique; e.g.
/wp-login.php?action=registerto something unique; e.g.
5. Protect the wp-admin directory
The wp-admin directory is the heart of any WordPress website. Therefore, if this part of your site gets breached, then the entire site can get damaged.
One possible way to prevent this is to password-protect the wp-admin directory. With such a WordPress security measure, the website owner may access the dashboard by submitting two passwords. One protects the login page, and the other secures the WordPress admin area.
Setting this up usually involves adjusting your hosting setup via cPanel. Still, this isn’t too difficult to do if you follow the right steps.
During your WordPress installation, you should never choose “admin” as the username for your main administrator account. Such an easy-to-guess username is approachable for hackers. All they need to figure out is the password, then your entire site gets into the wrong hands.
I can’t tell you how many times I have scrolled through my website logs, and found login attempts with username “admin”.
The iThemes Security plugin can stop such attempts by immediately banning any IP address that attempts to log in with that username.
6. Change the WordPress database table prefix
If you have ever installed WordPress then you are familiar with the
wp- table prefix that is used by the WordPress database. I recommend you change it to something unique.
Using the default prefix makes your site database prone to SQL injection attacks. Such attacks can be prevented by changing
wp- to some other term. For instance, you can make it
If you have already installed your WordPress website with the default prefix, then you can use a few plugins to change it. Plugins like WP-DBManager or iThemes Security can help you do the job with just a click of a button. (Make sure you back up your site before doing anything to the database).
7. Protect the wp-config.php file
The wp-config.php file holds crucial information about your WordPress installation, and it’s the most important file in your site’s root directory. Protecting it means securing the core of your WordPress blog.
This tactic makes things difficult for hackers to breach the security of your site, since the wp-config.php file becomes inaccessible to them.
As a bonus, the protection process is really easy. Just take your wp-config.php file and move it to a higher level than your root directory.
Now, the question is, if you store it elsewhere, how does the server access it? In the current WordPress architecture, the configuration file settings are set to the highest on the priority list. So, even if it is stored one folder above the root directory, WordPress can still see it.