I created a website which was hacked multiple times? I removed the entire website and recreated the site. What is the best way to secure the site so it does not get hacked?
closed as off-topic by cjbj, markratledge, Dave Romsey, Pat J, Mayeenul Islam Oct 18 '16 at 11:56
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions that are too localized (such as syntax errors, code with restricted access, hacked sites, hosting or support issues) are not in scope. See how do I ask a good question?" – cjbj, markratledge, Dave Romsey, Pat J, Mayeenul Islam
Wordfence should be adequate to protect your wordpress back-end from being bruteforced.
However, I guess the answer to this would depend on how it got hacked in the first place.
It could be related to plugins/wordpress not up to date, badly coded plugins, insecure code, bad server configuration, etc.
I'd find the root cause of the hack and then take action accordingly.
There are a number of good security plugins.
1) Have recent backups. At least daily. 2) Use something like Sucuri Security for hardening and automated malware scanning. 3) Wordfence for web application firewall.
You could get WP specific hosting, they are fairly cheap these days and they take care of your security, daily backups, automatic WP core updates.
I managed a nonprofit website that was constantly getting attacked and infected. I moved the site to [wpengine].1 They cleaned the site for free on the initial free migration and after that never had a problem again. I also recently got siteground WP hosting and they also offered a free cleaning on one infected site. They are little cheaper, but their support is not as good as WPengine in terms of expertise and from my experience it takes me longer to resolve things with them.
For the lazy people, this would be simple to do list.
- Make sure you have trusted hosting company behind.
- Make sure you have latest PHP running on your web server
- Make sure you have latest Apache/Nginx version running
- You forbid direct access to /wp* folders
- Make sure you haven't used any suspicious plugins or themes. (What are nulled themes? Should I install plugins to my WordPress installation from web sites having in URL "nulled" or, "null"? )
- Make sure your WordPress website developer haven't used
nulledthemes or plugins.
- Use themes and plugins from respectable sources like WordPress.org or other markets with quality control.
If you acquire to have only this you will be very very good.