Standard Method for Securing a WordPress Site

Question

I have been working with WordPress since last 5 years almost. But so far I didn't get a standard solution to secure a WordPress site.

I have a clients hosting account which has 11 WordPress websites that keeps getting hacked every year almost. Even Finally I had to leave the Hostgator or they suspended that account because of this. Now I bought a new hosting and I don't want it to be happen again and again.

So far what I did to secure my site is I have used "Wordfence" Plugins and set it up correctly. Tried to hide my wordpress installation using "Hide My Wp" Plugin. Has set the login attempt to 5 in Wordfence settings that could help it to protect from Ddos attack. Always using updated version of plugins and themes and WordPress core. By following these steps still I have been hacked 6 times in Hosgator hosting.

Now my question is that as I have moved to new host and off course I am using all fresh new installation in my new hosting for these existing sites; How I can I make all these site secure or what is the best standard methods to secure a WordPress site ?

Thanks to you all in Advance.

Answer 1

If you are looking for some kind of "set it up and forget it" security solution, then you are going to be disappointed. There are things that can help mitigate risks, such as firewalls and obscuring your installation, but ultimately a site will only be as secure as the software that runs it and the processes and tools that are used to administer it.

With a WordPress site, you have various plugins and themes installed beside WordPress core, and any one of these can contain security vulnerabilities. Keeping your plugins up to date is a good practice, but it won't fully protect you because there are plugins that have 0-day vulnerabilities in the most recent version. So unfortunately, while keeping up to date is a good start, it is important to also monitor whether the plugins you use may contain vulnerabilities that haven't yet been fixed. (The Plugin Vulnerabilities plugin can notify you of 0-day vulnerabilities; I use it on my sites.)

Apart from the software side of things, you also have to consider whether you are following best practices in how you administer the site. Are you using a secure connection? Does your computer have antivirus software installed? Do you disable scripts from all but trusted sites in your browser? And so forth.

At last, if your site is hacked, the most important thing to do is to find out how the attacker got in. If you don't do this, your site will very probably remain vulnerable. But when you know how the hacker got in, you can fix the issue.

So in summary, there isn't a simple solution, unfortunately. But there are probably a few more things that you can do to reduce the possibility of being hacked, and to learn from an attack after it occurs.

Answer 2

Most important one to me: rename wp-login.php! Bots only check the defaults, even moving it to /login/ will drop the risk of brute forcing considerably. You should still make sure your client uses good passwords, obviously. Edit: Having looked up "Hide my WP", it apparently does it already. From the name I figured they are trying to hide the fact that you are using WP.

Also, always do a post mortem analysis to find out HOW the site was hacked so you can close that hole. And make sure that the backups you restore from don't already contain back doors (but if it happens in long intervals, that usually means this isn't the case).

Use different (sub-) accounts for each site so if one is infected, it only concerns that one.

If you have a lot of plugins, you might try to deny requests to php files in /wp-content/plugins/ alltogether. Plugins should go through /wp-admin/admin-ajax.php for AJAX and have little reason to receive direct requests. "Try", because even though they should, doesn't mean they will, so you'll have to test whether anything breaks if you do.