Online Security Tips for WordPress Site Owners [Infographic]

What is your online security strategy? If you’re running a WordPress site, securing and protecting your data needs a three-pronged approach: your computer, the server the site lives on & WordPress itself. In this infographic, we compile our best tips for actions you can take today to keep you and your WordPress website safe.

Download the Infographic

Online Security Tips for WordPress Site Owners

1. Keep your computers secure:

• Keep your software update-to-date. This means the operating system itself and all the software running on it.
• Use a strong password and two-factor authentication if possible. Run antivirus and antimalware scans.
• Use an email provider that blocks known malware and phishing attempts.
• Don’t install software from unknown sources to the system you use to administrate the site.
• Ensure that your computer is secured with a strong password. This is especially important in environments where unknown people can gain physical access to your computer.
• Use password managers and enable two-factor authentication for all users that have access to that account. Password managers not only allow easier use of stronger passwords, they help protect against phishing attempts.

2. Keep server secure:

• Use a strong password and two-factor authentication if possible.
• Use a trusted web host. Assume that your host can access anything on your server if they want to. This includes dedicated servers and VPS servers installed with full disk encryption. If they can physically touch your server, they can access the data on it.
• Use a secure file transfer protocol such as SFTP or SSH rather than insecure protocols such as FTP.
• Ensure that a strong password is used to access the account.
• Talk to the host and ask what options they have to ensure that people can’t hijack the account or gain access to it via social engineering.
• Ensure that the host is keeping up with software updates.

3. Keep WordPress secure:

• Keep the sites up-to-date. This includes WordPress, plugins, and themes. This can be managed more easily by using a remote administration tool that can manage multiple sites from one location, such as iThemes Sync.
• Use a strong password and two-factor authentication if possible.
• Enforce use of strong passwords.
• Use plugins and themes from reliable providers that update their software. Only install plugins and themes from reliable sources.
• Secure the site with SSL. Force all logins and dashboard accesses to go through an https connection.