How to protect your WordPress blog site

By Jeff On · Leave a Comment

WordPress is a very popular content management system. But because of it’s popularity and the source code is open for everyone your blog site could be very vulnerable.

I will share to you things you could do to protect your WordPress blog site. Here it goes:

1. Change The â€œAdminâ€ User

After installing WordPress, the default user will be “admin”. Make sure to replace this one and make your own user name. Simply create a new user for your blog, and give it â€œAdministratorâ€ privileges. Then log in with that user, and delete the â€œadminâ€ user.

2. Regularly change password.

Changing password regularly is essential. Make sure to use a very strong password combination. Make password combination with 8-12 characters + small letters + capital letters + number + characters.

3. Always do regular back ups

Sometimes you don’t have absolute control over your blog site. Your site might crash or someone will erase your blog totally, at least you have your back ups. Remember to backup your blog (both the database and the site files) as often as possible.

4. Keep Your WordPress Updated

Always update to a newer version of WordPress. Newer version always offer better security and protection.

5. Do not install untrusted/unestablished plugins.

Use plugins from trusted and established developers. Sometimes inexperienced plugin developers will leave security holes on their code. Use plugins that are popular and have been used by thousands of WordPress users. And always update your plugins too.

6. Remove the Generator Meta Tag

If you open the source code of your WordPress blog, you should see a meta tag that looks like this:

Revealing your WordPress version is dangerous because hackers and malicious users would know what security holes you might have.

7. Delete the ReadMe.html File

Also ReadMe.html reveals your WordPress version. Delete this also.

8. Protect the /wp-admin/ Folder and disable folder browsing.

Ask your Web Hosting company about this. Web Hosting companies might have different ways on how to protect your files and folders and some web hosting companies have easier way to do this or they can do it for you.

9. Make sure you have the right permission settings.

When you upload or download files to your site using an FTP Client, you will see the permission which is set to a particular folder or file.
Some FTP clients will display it as “Permissions”, “Chmod” or “File Attributes”. Make sure your WordPress folders have the 755 permission and single files have 664.

I use FileZilla because it’s much easier. When you use CoreFTP, it will not display the numbers, instead something like this “-drw-rw-r-”. I can’t remember the exact value display by CoreFTP since I am now using FileZilla instead.

Hope this can help you. For indept training and lessons, I do recommend you join OnlineProfits. They have “The Most Complete Program on The Web”. And their opening their doors now. That’s right it’s free to join. See here for more details…