![\"wordpress](\"https:\/\/www.skynetindia.info\/blog\/wp-content\/uploads\/2020\/09\/wordpress-safe-login.jpg\" "\\"wordpress")
<\/p>\nMany rely on\u00a0WordPress\u00a0to build websites, since, unlike other CMS, it is possible to use it very easily even without having any knowledge of web design.\u00a0Unlike in the\u00a0past, moreover, it is now much easier to install it on a\u00a0hosting service. For example, you can do it\u00a0with a click, without having to resort to uploading via FTP.<\/p>\n
However,\u00a0WordPress is also one of the CMS most exposed to the dangers of the network and often those who use it do not know exactly what to do to prevent attacks on their site, which can range from simple\u00a0bot\u00a0spam\u00a0in comments up to malicious code injection or more.<\/p>\n
In this guide we will help you understand what are some of the most vulnerable aspects of\u00a0WordPress\u00a0and what you can do to\u00a0make your site more secure.<\/p>\n
Many newbies still make this mistake: the username \u201cadmin\u201d and password such as \u201cpassword\u201d, \u201c1234\u201d or even your date of birth is absolutely to be avoided, as they are a first-rate vulnerability for sites in WordPress. Hackers, through so-called\u00a0bots\u00a0(i.e. automatic scripts), continually scan the web knowing that sooner or later they will be able to sneak into some site through standard credentials.<\/p>\n
Standards represent important weaknesses for CMS like WordPress, precisely because as such they are aware of everyone.\u00a0Creating\u00a0unique Username and Password\u00a0is the first essential step to prevent hackers from entering the site, but the second is to hide the front door.<\/p>\n
Even if you don’t have a\u00a0login button\u00a0on the site, it is known that by default the page to access the WordPress admin panel is located at the addresses\u00a0\/wp-login.php\u00a0or\u00a0\/wp-admin.\u00a0The latter are therefore constantly targeted by bots, who find the page and try to login by entering numerous combinations of standard credentials, including “admin”, “password”, “1234” or even the name of your site.<\/p>\n
To\u00a0change your WordPress login address\u00a0you can very simply resort to a plugin.\u00a0One very light and useful for this purpose is\u00a0WP Hide Login: once installed and activated, go to settings, in the\u00a0General\u00a0section, and at the bottom of the page replace the login address as you like (make sure you can memorize it or write it down in a safe place).\u00a0Finally click on\u00a0save changes.<\/p>\n
<\/p>\n
By doing this, you will already be safe from most\u00a0brute-force attacks.\u00a0Furthermore, you will also have secured the\u00a0registration\u00a0page\u00a0(if you have it active), since it directly depends on the login page: the default one is found on\u00a0\/wp-login.php?action=register.<\/p>\n
If you are looking for the ultimate in security, another WordPress standard that should be revised is\u00a0the database table prefix, which usually, without customization, is \u201cwp_\u00a0\u201c. This change should be made\u00a0the first time you install WordPress, but if you are looking to make a\u00a0site already online\u00a0more secure, you can change the database prefix in a few clicks using plugins like\u00a0Brozzme DB PREFIX.<\/p>\n
Even in cases, already includes security software on the hosting, it is good that you also have a plugin on your WordPress site that acts as a\u00a0firewall, protecting you from more complex types of attacks than simple brute-force on the login.<\/p>\n
The most effective and used to do this is\u00a0Wordfence, which carefully monitors the site and keeps you constantly updated, notifying you via email small and large vulnerabilities (even simply an outdated plugin), and has very useful functions such as\u00a0malware\u00a0scan,\u00a0blocking IP manual\u00a0and\u00a0limitation of login attempts.<\/p>\n
The free version of\u00a0Cloudflare, which\u00a0can be easily activated from your Customer Area,\u00a0offers you an excellent\u00a0CDN\u00a0(Content Delivery Network) service that greatly improves the\u00a0performance\u00a0of your site, but in addition to this, with Cloudflare Pro you can also have a very valid ally for the security. Check out more WordPress Security Tips<\/a> to Keep Your Business Investment Safe.<\/p>\n The\u00a0Pro\u00a0version\u00a0in fact includes protection from DDoS attacks and the\u00a0Web Application Firewall (WAF), which promptly stops all attacks that aim to exploit vulnerabilities, including SQLi, XSS and the like.\u00a0If you buy\u00a0Cloudflare Pro\u00a0from us you don’t even have to worry about all the necessary settings on the service, because\u00a0our technicians take care\u00a0of setting everything up to perfection!<\/p>\n You can request Cloudflare Pro\u00a0by sending us a ticket\u00a0or more simply by going to the\u00a0Hosting\u00a0section\u00a0of your\u00a0Customer Area, clicking on the\u00a0gear icon to\u00a0the right of the domain name and looking for it in “Buy additional services”.<\/p>\n If you have a\u00a0comments section\u00a0within your WordPress site,\u00a0rest\u00a0assured that\u00a0spambots\u00a0will try to link us to disreputable sites, and often there is no Wordfence or Google Captcha to care.<\/p>\n For this reason, if you encounter frequent cases of\u00a0spamming, you would do well to have a lightweight and effective plugin that prevents attackers from doing their own thing in the comments, undermining the safety of your visitors and ruining the reputation of your website. For this purpose we would like to recommend\u00a0Akismet, the best known anti-spam plugin for WordPress, or even\u00a0Stop Spammers, both very easy to use.<\/p>\n Regular backups are essential in order not to waste hours, days or more of valuable online work.\u00a0You can also use a\u00a0plugin\u00a0in this case\u00a0(but remember that it is always better to install as little as possible!).\u00a0One of the best is\u00a0UpdraftPlus, which allows you to save backups even on cloud platforms such as Dropbox or Google Drive.<\/p>\n The web is full of\u00a0pirated WordPress premium themes and plugins, and often newcomer may find it inviting to take advantage of them, thus enjoying all the options available without having to open their wallet.\u00a0But is it really worth it?<\/p>\n Shortcuts, as always, have more\u00a0pitfalls\u00a0than you think.\u00a0In this case, pirated themes and plugins not only create\u00a0vulnerabilities\u00a0due to not being able to\u00a0update\u00a0them\u00a0regularly like the legal ones, but above all they can enclose\u00a0backdoors, predict\u00a0data theft, the\u00a0injection of malicious code\u00a0into the website or more.<\/p>\n Keeping WordPress always updated to the latest version, along with the themes and plugins you have installed, is essential to reduce vulnerabilities as much as possible. The update operations can be performed manually from the admin panel of your site.<\/p>\n If your WordPress site requires other users to register, always pay attention to the roles you assign them:<\/p>\n Subscriber:<\/strong>\u00a0can only read and comment<\/p>\n Accountant:<\/strong>\u00a0can edit and delete articles<\/p>\n Author:<\/strong>\u00a0can create, modify, publish and delete articles<\/p>\n Publisher:<\/strong>\u00a0has full powers over articles and pages<\/p>\n Administrator:<\/strong>\u00a0has full powers over the entire site<\/p>\n Make sure newly enrolled users have a role as simple\u00a0subscribers\u00a0by default.<\/p>\n Nowadays it is practically essential to have an SSL certificate<\/a> applied to your site and therefore to offer your visitors a connection with the https protocol.\u00a0In terms of\u00a0security, this guarantees users encrypted connections while preserving the\u00a0privacy\u00a0of their data, but it also means not being penalized in\u00a0SEO\u00a0or browsing on the main browsers such as\u00a0Chrome, which now tend to report sites without SSL as unsafe.<\/p>\n WordPress security requires regular and active maintenance and monitoring in order to keep it running smoothly. It is advisable to hire a dedicated WordPress website service provider to protect and secure your codebase and keep your business investment safe.<\/p>\n If you are looking for a WordPress web development and other related web development services, please explore our WordPress web development services<\/a>! We also provide WordPress website maintenance services and WordPress application security audit. For more information, please visit our WordPress maintenance services<\/a>!<\/p>\n","protected":false},"excerpt":{"rendered":" Many rely on\u00a0WordPress\u00a0to build websites, since, unlike other CMS, it is possible to use it very easily even without having any knowledge of web design.\u00a0Unlike in the\u00a0past, moreover, it is now much easier to install it on a\u00a0hosting service. For example, you can do it\u00a0with a click, without having to resort to uploading via FTP. […]<\/p>\n","protected":false},"author":1,"featured_media":2253,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[920],"tags":[1039,117,593,594,1034,1040,1036,1042,1037,1041,597,133,136,1035,1038],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\t\n\t\n\t\nFind a good anti-spam<\/h2>\n
Make backups regularly<\/h2>\n
Use only official themes and plugins<\/h2>\n
Regularly update WordPress, themes and plugins<\/h2>\n
Pay attention to the roles you assign to users<\/h2>\n
Apply SSL certificate to the site<\/h2>\n