How to give your WordPress site a security checkup

Are you responsible for a self-hosted WordPress site?

If so, one of the most important things you can do to keep it healthy is to give it a security checkup and make sure you’re maintaining it in accordance with all of the recommended best practices. That way, its likelihood of being hacked by the Internet’s hive of scum and villainy is reduced.

Here’s a step-by-step guide to giving your site a security checkup. (Most of these steps are adapted from the Hardening WordPress presentation that I’ve been giving to members of the WordPress community for several years.)

Step One: Backup your site!

There are several ways to manually back up. From within WordPress, backing up can be done with one of many plugins available from the WordPress repository. If you have shell access, making a manual backup is as easy as running a couple of commands. For example, from the directory above your site root, you could run:

bash:~$ tar -zcvf MONTH-DAY-YEAR-Site-Backup.tar.gz public_html/

Then, to make a snapshot of the database (presuming you’re using MySQL):

bash:~$ mysqldump -h hostname -u username -p databasename > MONTH-DAY-YEAR-Site-Database-Backup.sql

If wp-cli is installed on your server, exporting a database becomes even easier:

bash:~$ /home/user/path/to/wordpress/ wp db export

A few words of caution: Do not keep backup files in your publicly accessible web space unless your host doesn’t give you access to the directory above your web root. Leaving backup files in your publicly accessible web space jeopardizes the integrity of your site and is a surefire way for your credentials to leak. If backups must be stored in your web space, make sure access to that folder is restricted. On a server running Apache, this can be done by setting directives in an .htaccess file.

For bonus points, verify the integrity of the backup by using the archive files you made to create a local copy of your WordPress installation.

It’s nice to be able to know how to make a backup on demand, but the key to ensuring backups get made is automating them. This saves time and ensures that a copy of the site is being made at regular intervals.

To automate backups with shell commands, simply create a cron job by editing crontab or using your host’s cron job manager. With a plugin, you’ll need to visit the configuration page to specify how often backups should be made, and where they should be stored. You should have a set of backups stored locally on the server, and another set stored offsite in a secure cloud repository. That way, in the event disaster strikes and your host’s datacenter is beset by a catastrophe, your data is safe.

For most WordPress users, a plugin is the easiest and best way to automate and manage backups. I recommend UpdraftPlus.

Step Two: Install pending updates (if any)

Once your backup is made, you should install any pending updates to WordPress, your installed plugins, and your installed themes. You can do this using wp-cli, or from within WordPress using the built-in Updater. If you have plugins or themes installed that you bought from an online marketplace, you should go back to that marketplace and see if there are updated versions available. If there are, download them and install them by deactivating the version on your site, deleting the old code, and uploading the new version.

Some premium plugins and themes can be automatically updated from within WordPress just like ones installed from the repository, but access to automatic updates usually requires a license key from the developer. Consider renewing any subscriptions to premium plugins that have expired — it’ll make installing updates much simpler in the future.

Step Three: Scan your site for problems

With backups made and updates installed, it’s now time to scan your site for problems. Wordfence, my favorite security suite, comes with a powerful scanner which is always getting smarter thanks to Defiant’s threat intelligence.

Install Wordfence if you don’t already have it in your site, and put the scanner to work to see if there are any issues that need your attention.

If your site has been around for a few years and has a bunch of plugins installed, chances are good that at least one of them will show up in the scan results as abandoned.

It’s a good idea to replace abandoned plugins with ones that are currently maintained. If you are notified of an abandoned plugin (which is one of the most common results I see in a scan of an otherwise healthy site), head over to the repository to look for a replacement.

Again, chances are, you’ll find one that does pretty much the same thing as the one that is no longer maintained.

Step Four: Make sure your site is protected by a firewall

Another powerful capability you get with Wordfence is the ability to deploy a Web Application Firewall (WAF). Deploying a WAF is one of the most important ways you can protect your site.

At many hosts, deploying the Wordfence WAF is as simple as clicking a few buttons. At other hosts, some intervention on your part may be required to enable extended protection mode and realize the full benefits of the WAF. Defiant has a tutorial on how to get the Wordfence WAF set up if you’re having trouble.

Step Five: Change your passwords

Since you’re giving your site a security checkup, take advantage of the opportunity to change all your hosting-related passwords now.

Consider installing a password manager like Dashlane or 1Password to securely generate and store your new passwords. A manager greatly reduces the complexity and anxiety involved in coming up with strong passwords and keeping them safe. You should have unique passwords for:

  • your hosting control panel
  • your database (MySQL, MariaDB, etc.) user
  • your WordPress account(s)
  • any additiontal shell accounts or FTP users you have

Step Six: Turn on multi-factor authentication (MFA, also called 2FA)

Many hosts will let you add another layer of protection to your site by turning on multi-factor authentication (MFA), also called two-factor authentication.

To find out if your host will let you set up MFA to restrict access to your control panel, check their support center or knowledge base for an article about “MFA” or “2FA”.

With MFA, access to your online accounts is secured by something you *have* in addition to your password. That something could be a mobile device (the most common second factor), or a hardware authentication module like a YubiKey.

If you’re using your mobile device, I recommend using an authenticator app instead of using SMS (short message service) if possible, as authenticator apps are more secure.

The three most popular authenticator apps currently available are Google Authenticator, Authy, and Duthio.

Do you use Jetpack? Turning on multi-factor authentication at will help protect your site from the nasty Jetpack remote management attack that’s afflicted a lot of WordPress websites recently.

If you have Wordfence Premium, you can turn on MFA (also known as cellphone sign in) for your WordPress installation’s administrator accounts as well. This tutorial explains how to do it.

Step Seven: Configure and use HTTPS on your site

Help encrypt the Web by configuring and using HTTPS (HyperText Transfer Protocol Secure) on your WordPress site. When you make the switch to HTTPS, you’ll no longer be sending your username and password in the clear when you login to manage your site, and your users’ comments and form submissions will likewise be encrypted while in transmit between their computer and your site’s server.

Switching to HTTPS is one of the most important ways you can protect your WordPress site. Switching to HTTPS now will also ensure you’re prepared for the day when Google Chrome (and other browsers) begin marking non-HTTPS pages as “Insecure”, which is due to happen this September.

The process for configuring HTTPS varies by host, so as with the previous step, you’ll want to check your provider’s documentation.  You will need to obtain a secure certificate from a certificate authority to securely access your site in a browser without triggering a scary-looking warning.

Certificates can be obtained for free through Let’s Encrypt or for a fee from a number of traditional certificate authorities. Note that some hosts require you to buy a certificate through them in order to set up HTTPS on the server that serves your website.

After you’ve configured HTTPS, you’ll need to make changes to your site to enforce its use. First, modify your site’s wp-config.php file to require HTTPS for all administrative sessions by adding this constant:

// Require encryption for administrative sessions and logins
define('FORCE_SSL_ADMIN', true);

This is the recommended way to force HTTPS on your site’s backend because it doesn’t depend on a plugin being active.

Note that setting this constant does not require HTTPS on your site’s frontend… the public-facing part of your website.

To force HTTPS on the frontend, start by going to your site’s Settings (you’ll want the General screen) and changing the site and Home URLs to begin with https:// instead of http://. You will be immediately logged out once you save this change, and will have to login again.

You’ll then want to use a plugin like Velvet Blues Update URLs to replace all the hard-coded http:// URLs in your site with https:// URLs. If you don’t do this, some of your site’s resources, like images and scripts, may not load securely.

Always make a fresh backup of your site (repeating what you did in Step One) before you run a plugin like Update URLs.

The last step is to browse around your site and look for any mixed-content warnings. You may need to modify your theme files or theme settings to get rid of a final http:// reference or two.

Made it through all that? Good work!

Completing the steps above is the ticket to a safer, happier WordPress site. If you’d previously completed some of the steps, congratulations on completing the remaining ones. And if you’ve never done work to strengthen your site’s security posture before, but have been inspired to do so, I hope this post helped you take action.