10 Tips to Improve the Security of a WordPress Site

Disable debugging The debugging feature should not be enabled in production environments, as it may provide useful information to potential hackers.

define( 'WP_DEBUG', false ); #if WP_DEBUG_LOG is enabled, you have to enable WP_DEBUG as well define( 'WP_DEBUG_LOG', true ); define( 'WP_DEBUG_DISPLAY', false ); Debugging information is very useful while developing a WordPress application. However, it is important that this parameter is set to "false" again before uploading the system to an online server. Errors should be tracked, but never exposed to unauthorized users.

Use strong database credentials Each WordPress installation should have its own database with a dedicated user and a secure, unique password.

define( 'DB_NAME', 'unique_database_name' ); define( 'DB_USER', 'unique_database_user' ); define( 'DB_PASSWORD', 'strong_and_unique_password' ); When installing WordPress, a table prefix may be specified. This would allow multiple WordPress installations to run on the same database. However, sharing a database between different installations is dangerous because, if one instance is attacked, the other installations are also at risk. Also, you should avoid using a root account on the database, as it has full access to all databases on the server.

Use unique keys and keys Your keys and keys should be unique to each WordPress installation, as this is the only way to ensure secure user management.

#These values ​​are intentionally left blank to avoid copy-pastes define( 'AUTH_KEY', '' ); define( 'SECURE_AUTH_KEY', '' ); define( 'LOGGED_IN_KEY', '' ); define( 'NONCE_KEY', '' ); define( 'AUTH_SALT', '' ); define( 'SECURE_AUTH_SALT', '' ); define( 'LOGGED_IN_SALT', '' ); define( 'NONCE_SALT', '' ); Salts and keys are important for a number of features in WordPress. Among other things, they enable secure management of sessions and logins. The values ​​are automatically chosen randomly during installation. However, a WordPress installation may be duplicated. During deployment, it is highly recommended to generate new values ​​for these constants. These values ​​can be generated through the API accessible from the following link:

https://api.wordpress.org/secret-key/1.1/salt/

Use SSL encryption No one should have the ability to intercept and sniff the traffic between the user and the server. Use SSL encryption and force WordPress to only use this type of connection.

define( 'WP_SITEURL', 'https://www.mydomain.com' ); define( 'WP_HOME', 'https://www.mydomain.com' ); define( 'FORCE_SSL_ADMIN', true ); define( 'FORCE_SSL_LOGIN',true ); It is now common practice to encrypt traffic. Almost all browsers mark unencrypted connections as dangerous and unsafe. Very often hosting providers offer their customers free SSL certificates to enable SSL encryption, such as those offered by Let's Encrypt.

Prohibit database repair WordPress supports automatic database repair. This should not be possible without a prior database backup.

define( 'WP_ALLOW_REPAIR', false ); The path wp-admin/maint/repair.php , accessible even to unauthenticated users, starts this automatic process. This could be very useful in case of database malfunctions or corruption. However, the process should never be launched without first taking a database backup.

Disabling Unfiltered Content Admins and Editors can post unfiltered HTML or files. If this is not strictly necessary, it is recommended to activate the following filters:

define( 'DISALLOW_UNFILTERED_HTML', true ); define( 'ALLOW_UNFILTERED_UPLOADS', false ); By default, Admins and Editors can write unfiltered HTML in post titles, content, and comments. File type filtering can also be turned off. These filters should remain enabled.

Enabling Automatic Security Updates A WordPress installation should always be up to date to deal with the latest attacks. Enable automatic updates for security releases.

define( 'AUTOMATIC_UPDATER_DISABLED', false ); define( 'WP_AUTO_UPDATE_CORE', 'minor' ); Since WordPress is one of the most used CMS in the world, many hackers try to exploit known vulnerabilities in outdated installations. It is recommended to perform a full backup before any core upgrade, therefore only "minor" updates containing security patches should be installed automatically.

https://codex.wordpress.org/Configuring_Automatic_Background_Updates

Block external requests Access from your WordPress installation to external resources should be restricted. It is recommended to accept only trusted resources.

define( 'WP_HTTP_BLOCK_EXTERNAL', true ); define( 'WP_ACCESSIBLE_HOSTS', 'api.wordpress.org, *.github.com, www.trusteddomain.com' ); You should not only control access to WordPress from outside, but also access from the system to external resources. Therefore apply the principle of white lists instead of black lists.

Disable file modifications Prohibit the modification of lines of code in plugins and themes by administrators and editors. Disable the file editor for all extensions.

define( 'DISALLOW_FILE_EDIT', true ); By manipulating the code, a trusted extension could become a vehicle for attacks.

Disabling System Modification To further harden a WordPress installation you can prevent any system modification by prohibiting the installation of plugins and themes.

define( 'DISALLOW_FILE_MODS', true ); Themes and plugins don't just bring advantages and benefits to a WordPress installation. You need to be able to trust the developers of these extensions. By activating this "barrier" it will be possible to prevent administrators and editors from loading and installing untrustworthy extensions

Translation of the study carried out by RipsTech: " WordPress Configuration Cheat Sheet ".

Hosting Optimized for WordPress At Host we have always given great importance to the compatibility and optimization of our Hosting profiles with the most popular CMS. Our Hosting includes SSH access and WP_CLI so you can manage all aspects of your WordPress site. Also included are SSL and HTTP/2 certificates to guarantee security and performance.

WORDPRESS HOSTING FROM €59/YEAR