I'm doing a draft of a WordPress site on localhost.

If I am using PHP snippets to do the sort of back-end functionality. How do I know that, when this goes to a real platform, the php code cannot be tampered with? How can I ensure that login information (password especially) is secure? Should I be doing password validation in the PHP snippets, or is there a more secure way?

closed as too broad by Jacob Peattie, bosco, Pat J, Fayaz, Jack Johansson Sep 7 '18 at 7:44

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


You cannot be 100% sure you are safe.

Check this Security reading from WordPress.

That been said, there are some things you can do.

  • Keeping WordPress Updated
  • Keeping theme and plugins Updated
  • Use Strong Passwords
  • You can use a Security Plugin, although it's arguable. When a client request it I use Sucuri.
  • Change the Default “admin” username
  • Limit Login Attempts
  • Change WordPress Database Prefix
  • Use double authentication

All that won't be enough but it will give intruders a hard time trying to get in.

  • 1
    Thank you for your concise answer! I will definitely being going through all these before the site goes live to give me some peace of mind. – ellen Aug 10 '18 at 19:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.