I created a website which was hacked multiple times? I removed the entire website and recreated the site. What is the best way to secure the site so it does not get hacked?
4
-
I like to use Wordfence Security plugin.– PimOct 11, 2016 at 12:06
-
It's not as simple as that by saying if you do this your site don't get hacked. Hacking is a beast and there are many ways to do it and those can be protected in many ways. This question is too broad and gets opinion based answers or answers that don't get to the point.– bravokeylOct 11, 2016 at 13:01
-
2Carefully follow codex.wordpress.org/FAQ_My_site_was_hacked Then take a look at the recommended security measures in codex.wordpress.org/Hardening_WordPress and codex.wordpress.org/Brute_Force_Attacks– markratledgeOct 11, 2016 at 15:24
-
hi Rahul, I wanted to encourage you to write more good questions like this. Possible you may also answer your question, providing the results you found since the community may learn something new.– prostiOct 14, 2016 at 12:45
Add a comment
|
4 Answers
Wordfence should be adequate to protect your wordpress back-end from being bruteforced.
However, I guess the answer to this would depend on how it got hacked in the first place.
It could be related to plugins/wordpress not up to date, badly coded plugins, insecure code, bad server configuration, etc.
I'd find the root cause of the hack and then take action accordingly.
There are a number of good security plugins.
1) Have recent backups. At least daily. 2) Use something like Sucuri Security for hardening and automated malware scanning. 3) Wordfence for web application firewall.
You could get WP specific hosting, they are fairly cheap these days and they take care of your security, daily backups, automatic WP core updates.
I managed a nonprofit website that was constantly getting attacked and infected. I moved the site to [wpengine].1 They cleaned the site for free on the initial free migration and after that never had a problem again. I also recently got siteground WP hosting and they also offered a free cleaning on one infected site. They are little cheaper, but their support is not as good as WPengine in terms of expertise and from my experience it takes me longer to resolve things with them.
-
Please edit your answer to provide more detail. See How do I write a good answer? for more info.– Pat JOct 17, 2016 at 0:14
For the lazy people, this would be simple to do list.
- Make sure you have trusted hosting company behind.
- Make sure you have latest PHP running on your web server
- Make sure you have latest Apache/Nginx version running
- You forbid direct access to /wp* folders
- Make sure you haven't used any suspicious plugins or themes. (What are nulled themes? Should I install plugins to my WordPress installation from web sites having in URL "nulled" or, "null"? )
- Make sure your WordPress website developer haven't used
nulledthemes or plugins. - Use themes and plugins from respectable sources like WordPress.org or other markets with quality control.
If you acquire to have only this you will be very very good.
