My Multisites

WordPress Security

The largest security vulnerability in WordPress websites are the plugins. Mostly those plugins attacking with SQL injections or using your site to inject scripts that take info.

  1. Keep everything up to date with the latest security fixes.
  2. Use two-factor authentication for any log ins to your accounts.
  3. Make sure you protect your file permissions.
  4. Use a database table prefix other than “wp_” to make it less guessable.
  5. Limit log in attempts that can be made.
  6. Take away your WordPress version from the source code.
  7. Use security plugins to help manage and disable things.
  8. Make better passwords that you can memorize but are not easily guessable.
  9. Limit user permissions.
  10. Create regular backups of your site.
  11. Make sure your site uses HTTPS and has a current SSL certificate.
  12. Don’t use a default admin username.
  13. Disable file editing through WordPress admin dashboard.
  14. Add a plugin to automatically log out users that have open idle pages of the dashboard.
  15. Run scans on your WordPress for potential malware.
  16. Add security questions to your login.
  • Wordfence
    • Malware scanning, brute force protection, and two-factor authentication.
  • All-in-One Security
    • IP blacklisting, spam security, and file change detection.
  • CleanTalk Security
    • Audit logs, bot protection, and comprehensive spam removal.
  • Cloudflare
    • CAPTHA features, email routing service, and domain tampering protection.
  • Securi
    • Website clean up, real-time notifications of threats, and regular backups.

Wordfence by default is usually there and I may as well utilize it.

Scan for where the vulnerabilities originated and clean up those files and such. Go through the database and users removing anything suspicious and making sure to use website backups.

SSL stands for Secure Sockets Layer and a certificate authenticates that your website follows security protocols that encrypts data between the browser and website.