The essentials for keeping your WordPress site secure

The platform of choice for over 43% of websites on the internet, WordPress is used by over 500 million people around the globe. Originally created to publish blogs, it now supports creating more traditional websites, mailing lists, media galleries, membership sites and forums, and online stores. It can be used “out of the box” for both those that are less tech savvy and those that have more development experience. We’re well versed in using WordPress as a foundation for our custom builds and have some essential tips for making sure your website stays secure.

TLDR: To maintain a healthy WordPress website, there are certain steps you need to take on a regular basis to keep it that way.

“Website owners should be cautious of security with WordPress, not least because it’s one of the most popular content platforms on the internet.“ – Ben Everard, Director & Technical Lead at The Idea Bureau

Because of WordPress’ popularity, it’s a magnet for bad actors, such as hackers and spammers, to input compromised code, plugins that may contain malware and spam content. No need to worry, though. We thought we’d share some of our knowledge gained over our years of experience in building for WordPress to assist you in bolstering your website’s security.

Checklist for keeping your WordPress site secure

We’ve created a checklist that you can use as a starting point for instigating some important security measures when using WordPress as your website builder. If you follow these steps, you can be reassured that your site is a lot less likely to become a target of people with malicious intentions.

Update your WordPress instance and plugins regularly

Using an outdated WordPress instance or plugins is a sure way to introduce vulnerabilities to your website, not to mention that it means you’re missing out on highly valuable security improvements for them. Installing the updates WordPress itself releases on a frequent basis will help resolve potential security issues. You can also enable the auto-update feature on plugins you’re confident hold less risk.

To maintain your website’s security, you should only install the plugins you know are from a trustworthy source. If you’re not sure about a plugin’s validity, check with your trusted digital partner – their input and guidance can provide assurance for your peace of mind. Downloading that festive ‘snow’ effect plugin for Christmas might seem like a fun idea at the time; however, if it doesn’t come from a reputable source, you don’t know what kind of malware or other flaws it could contain. You can also test more significant updates on a ‘staging’ version of your website first, if that’s available to you.

“1,779 vulnerabilities were disclosed in WP-related plugin themes, and the core WP platform in 2022.“ – SolidWP.com

Practice good user management procedures

It’s a good idea to put some good user management procedures in place – these should include:

Another key piece of advice is to not allow every user to have the ‘Admin’ level of clearance, as this gives too many people too much power. A user’s access level needs be determined by their role on the website, for example: if they’re only updating content, they shouldn’t have admin rights that will allow them to make major changes to it.

Ensure all forms on your site have a spam check enabled

You may have seen when completing forms on other websites that they have a spam check enabled on them – often, this is the popular Google reCaptcha. As contact forms are such a key feature of modern websites, it’s important that they have a feature like this turned on so you’re not inundated with spam messages (thus, opening yourself up to opportunistic bad actors). We prefer not to use Google’s one for privacy reasons; however, a couple we like are hCaptcha and Cloudflare Turnstile.

Confirm the validity of your third party services

It can be really useful to embed content into your website from third parties, including services such as social media embeds. The most fundamental thing when you do so is to ensure you trust the service and its’ source. If one of the services is compromised, your website could then potentially be used to display illicit media, such as rogue gambling adverts or malicious content; if this occurs, your site can be flagged as compromised, as well, which will affect your search engine results. It can also cause any Google Ads (or other paid ads) to be rejected.

Run a malware check regularly

It’s imperative that you regularly run malware checks to maintain your website code. You can do this by enlisting services such as SUCURi, which provide a site check that highlights issues on your website – these can include malware, viruses, website errors, out-of-date software and malicious code, as well as whether or not your site has been blacklisted anywhere.

Keep your website SSL certificate valid

These days, it’s a requirement for your website to have a secure ‘SSL’ certificate (the HTTPS part of a URL). Not having one will mean that anyone who visits your site will be shown a warning that it’s insecure.

It’s worth clicking through your website and checking the padlock symbol always appears in your browser bar – you can click this icon to find out more information about the certificate’s expiry date; however, don’t be alarmed if it looks like it may soon expire, as some auto-renew quite frequently, even as often as every 90 days.

What we do for our clients as part of our Bureau⁺ service

Within our Bureau⁺ service, we enable our clients to focus on what they do best, while we take ownership of their website security, maintaining its reliability. We configure and manage this using our preferred WordPress security system, Solid Security Pro.

Solid Security Pro provides enhanced login security through the use of 2FA, requiring users to choose strong passwords, and introducing passkeys (a password-less method of logging in). It undertakes daily vulnerability scans, reporting on any issues found, which will prompt updates to affected plugins. The security system also prevents any brute force attacks that may take place – it does this through detecting malicious traffic to your site and allowing any WordPress admins to remain hidden, which will reduce threats.

We use a monitoring tool called OhDear.app, as well as a centralised dashboard that highlights any required updates and alerts us to known vulnerabilities across the websites we maintain for our clients. Via both automated and manual checks, we’re able to use our extensive WordPress knowledge to spot and resolve issues. This allows us to react quickly to make sure the sites are protected from any newly discovered security concerns. On top of this, we regularly review our own code to ensure it’s always reliable and secure.

“Customer trust, business stability and brand reputation are lost when your site is breached.“ – SolidWP.com

Conclusion

This article works well with some of our other recent blog posts that discuss ways to make your internal processes more effective. It’s worth implementing the steps above to form a process for your WordPress admins to undertake on a regular basis, as it’ll help to create a healthy security practise and prevent any potential breaches in the future.

Another aspect of our Bureau⁺ service is our audit option – as part of this feature, we use our expertise to build an understanding of how secure and efficient your website is. This allows us to provide guidance and strategies to help improve efficiencies, reliability, and reduce any risks present in the code. If you’re interested in finding out more about our Bureau⁺ service and how we can help implement further security practices for you, get in touch with us.