For WordPress website security, the best offense is a good defense. As a hosting provider and web site builder, there are no guarantees that a site cannot be hacked. Through diligence, aggressive security, proactive monitoring, and vigilance, you can guard against leaving your WordPress website more vulnerable.

Len Benyola, Support Manager, recommends taking the following steps to take to lock down and secure a WordPress website:

1. Set strong passwords and use two-factor user authentication.
2. Change the default WordPress login URL from WPAdmin or WPLogin.
3. Set up a security firewall and site monitoring.
4. Back up your site (off your server, remotely and capture site baseline).
5. Keep your plugins secure and up-to-date; check logs, update plugins, stay current with WordPress core updates.

You can code your own site security or use plugins. Less secure code is vulnerable to hackers. When you install a plugin, you are giving the plugin to interact intimately with your code.

Shore Digital recommends the following applications and plugins:

• Wordfence Security (paid version) for security
• BulletProof Security (BPS) for security
• UpdraftPlus for backups
• When needed, Sucuri for monitoring

Shore Digital installs the plugin combination of Wordfence and BulltetProof Security when creating WordPress sites. With this combination, you can generate strong and randomly generated passwords, change the WordPress login URL, and modify the .htaccess file to funnel browsing through the home page index file. The paid version of Wordfence includes live firewall monitoring that shows the IP addresses that hackers use; you can block a domain of IP addresses or a domain range.

If you observe your site under heavy attack, Shore Digital recommends and uses Sucuri to monitor for malware and modified files.

Before going live, back up your site to a secure, remote location off of your server. Know how to back up and restore your site, and use a site baseline for restores and analysis.

Ongoing monitoring is crucial. Always check logs, keep plugins up-to-date, and stay current with security-related WordPress core updates. For example, if a developer discontinues service on a plugin, and does not update to a new plugin, users of the deprecated plugin can be more vulnerable to hackers. When evaluating plugins, look for reputable sources with ongoing development, timely and appropriate updates, and regular maintenance.

Note: Though Shore Digital recommends these plugins today, the market constantly changes. Keep current on what is available, read reviews, and do research.