What Are The Best (Must Have) Security Practices?

  • I’m a total beginner to building my WP site. I plan to use my site as a personal blog that I will monetize via affiliate income once I gain steady readers. So its just a basic basic not overly complex event.

    Nonetheless I want to make sure I have a solid and secure foundation.

    What are the best practices, plugins, and security features that I should enable to make sure that my site/readers will be protected?

    From my research it seems I need 1. Backup Plugin; 2. Malware plugin; 3. Firewall plugin; 4. Keep all themes/plugins/WP up to date; 5. Use strong passwords and enable login protection to prevent brute force attacks.

    For my needs would I need anything else other than what I outlined above?

    Also plugin recommendations that you personally use would be nice.

    Thanks,
    -Rob

Viewing 6 replies - 1 through 6 (of 6 total)
  • Moderator t-p

    (@t-p)

    the recommended security measures.

    2. Malware plugin;
    3. Firewall plugin;
    5. Use strong passwords and enable login protection to prevent brute force attacks.

    Malware:
    Most vulnerabilities are *introduced* by adding insecure plugins and /or themes. Be careful what plugins/themes you use. Check security forums to see if they have been reported as insecure, and if so, were they fixed.

    If you want to avoid an attack from a server side exploit, best practice is to use a VPS rather than a shared website environment.

    Very rarely vulnerabilities are found in WordPress themselves which are usually quickly fixed but nevertheless do occur.

    Firewall
    Few security plugins that offer little real world defense against faulty coding in themes, plugins and even the core WordPress coding errors – that open your website up for attack. Do your due diligence and don’t just install the most popular security plugins, many of them merely block last years attack vectors.

    Passwords:
    Use a password manager. You will need the following passwords:
    – FTP
    – MYSQL Database
    – Admin login
    – Editor login

    These should all be different passwords. When you use a password manager this is easy to do.

    • This reply was modified 6 years, 10 months ago by te_taipo.
    • This reply was modified 6 years, 10 months ago by te_taipo.
    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    The best security practices? The link that t-p posted is good but this really is the magic formula.

    1. Off site regularly scheduled backups.
    2. Practice and document how to restore your backups.
    3. Keep your code up to date. WordPress, plugins, themes and your host environment. The most hardened WordPress installation comes to naught if the server is insecure and vulnerable.
    4. In the event of a compromise see step #2.

    If you keep your code up to date and follow those practiced that t-p linked to, then you should be good.

    Thread Starter mrrobtfp

    (@mrrobtfp)

    Hey, thank you for your input. Websites can definitely feel a bit overwhelming to pure beginners.

    @te_taipo- So what your saying is not to worry so much about getting the best security plugin but more so make sure that there aren’t any breaches of integrity in the plugins, theme, and coding making up my WP site?

    @Jan- “If you keep your code up to date and follow those practiced that t-p linked to, then you should be good.”

    I’m not a coder or programmer, how do I keep my code up to date? (Or is it just as simple as making sure I install the latest updates of WP, my plugins, and theme?)

    Thank you for your input.
    -Rob

    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    For the WordPress portion, it’s just a matter of logging into your WordPress dashboard. If you’ve a version or plugin or theme that has an update then you’ll see that notification in your dashboard. It’s very prominent and you just click and you’re updated.

    For the host part, it’s a matter of picking a good host. I don’t want to get too much into that as host conversations get closed due to the likely amount of spam those topics generate.

    You may need to do some host research for that part off of this site. ??

    Thread Starter mrrobtfp

    (@mrrobtfp)

    Ok thanks Jan!

    I read through the WP security article and implemented most of the suggestions outlined.

    I installed a backup plugin that will allow for offsite backups (UpdraftPlus). And I installed a free highly rated all in one firewall/malware/password plugin (Wordfence).

    I think if I continue to abide by the best practices you all have outlined in tandem with these plugins I should do just fine given my needs (personal blog with zero traffic and have yet to even write my first blog post).

    I’ll upgrade once I expand my user base and take the leap from blog to business.

    That’s my plan for now (lmk if I should do otherwise). Thanks for your input!

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘What Are The Best (Must Have) Security Practices?’ is closed to new replies.