10 Best WordPress Security Tips Without The Use Of Plugins

Having a secure website is a prime concern for every website owner. While you can secure your website with all the plugins available, there are some easy tips as well that you can implement for ensuring good WordPress security. There are some instances where the security plugins conflict with the theme of your website or do not work as expected but you can remarkably pump up the security of your WordPress website without the use of any third party tools.

You can start implementing some best practices through WordPress admin and through your cPanel account. You can also ensure security by editing these configuration files : wp-config.php (for WP config) and .htaccess (for server config), these files are present in the public_html folder of your WordPress installation.

Here are the tips that can be implemented for ensuring WordPress website security:

Perform Updates Regularly

WordPress team analyses and addresses the security issues regularly. Whenever they come across vulnerability, they fix it. You will find bug fixes and security patches as updates in the section – Dashboard > Updates menu in the WordPress admin area. It is important to ensure that your website is updated on a regular basis. Your job is not over just after updating WordPress to the latest version, you must also pay attention to the plugins and themes you are using, if there is a new update available for them, update them. The plugin and theme authors also generally release the security updates when they are necessary.

Related : The Complete Guide To Update Your WordPress

Restrict User Privileges

Refrain from giving too many privileges to common users on your WordPress website. If there are multiple users on your website, they should only have the privileges that are necessary. WordPress provides an intelligent user management system with the following user roles:

• Contributor
• Subscriber
• Author
• Editor
• Administrator

Restrict admin privileges to yourself or only to the users who are responsible for performing the tasks like updating the WordPress version, updating the plugins, modifying the settings, monitoring comments, installing themes and making changes in the theme. You can easily change the roles of your existing users on the ‘Users’ admin page.

In order to make your WordPress website safer, analyze this table – ‘Roles and Capabilities’ present in WordPress Codex and decide which permissions are required for the users on your website. Do not grant admin privileges unless they are really required.

Related : How To Add, Remove And Manage Users In WordPress?

Do Not Use The Default ‘Admin’ Username

There are chances of becoming prey to cyber crime if you use the default word ‘admin’ as your username. Cyber criminals can create automated brute force attacks that generally target the admin user accounts. These are low quality attacks that are not created for some specific website, what they basically do is that they try to find the usernames with the default name ‘admin’.

All you have to do is change your admin username, you will have all the admin privileges but you have to change your username from ‘admin’ to something else. In this way, you won’t make it obvious that this is the admin user account and thereby there are less possibilities of your account getting compromised under brute force attacks. It is not easy to change the ‘admin’ username as WordPress does not permit the users to change their username through the admin area. You can change your username in the database! However the perfect solution for having a different admin username is to have a new username with admin privileges, when you create a new admin username, you can delete the old one and start using the new one.

Related : How To Change The Admin Username In WordPress?

 Use Strong Passwords

This has become a highly known and common security measure for every website. Even through you know about it, have you implemented it yet? If not then change your password to a complicated one right away! Your password should have a combination of alphabets, numbers and special characters that cannot be guessed easily. Use of strong passwords is important to all the users but it is specifically important to the admin and high-level users.

When a new user is registered, a strong password is created by WordPress by default, but when the user registration is complete, the user can change it to a password they prefer which can be weak. It is highly important to set a strong password and if you think you can’t remember it, you can always use the password manager application.

Related : Resetting WordPress Admin Password

Export Your Content On A Regular Basis

It is important to safeguard your WordPress content. Backups are important as during some attacks, your website’s posts, pages, images and other content on your website might get compromised. You can either export your WordPress content through WordPress admin or you can create database backups. You can create a backup of your database through the cPanel control panel that is provided in your hosting account. Choose the File > Backups menu in your cPanel and download your SQL backup file. If anything goes wrong you can quickly restore your full database using the backup file.

All your content can be easily exported through Tools > Export menu present in the WordPress admin area. When you click on the ‘Download Export File’ button, WordPress creates an XML file that can be downloaded. Whenever required, you can easily reproduce your content by uploading it to the XML file resent in Tools > Import admin page.

Remove The Plugins And Themes That You Don’t Need

Generally, website owners install a lot of plugins which they might not need at a later point of time. The unused plugins and themes might at times hamper the security of your WordPress website. A large number of plugins and themes means more vulnerability of your website, it means that you are at a higher risk of getting hacked. Therefore make sure to only have the plugins and themes that you use and that are absolutely necessary. Deactivating the plugins is not a permanent solution, if you are not using a plugin or a theme, delete it completely. As you can use only one theme on your WordPress website, it does not make any sense to have more than one themes installed on your website. For enhanced WordPress security, it is important to delete the inactive plugins and themes.

Create Regular backups Of Your Database

Select a WordPress hosting plan that provides an option of creating backups of your WordPress website. If you opt for MilesWeb’s WordPress hosting plan, there is no way you will lose your website data as they provide a feature of daily backups. You can create backups for your WordPress website files, folders and databases through the automated daily cloud backup feature. The cloud backup software tracks each and every change made on your website on a daily basis through which you can revive all your website data whenever required.

Use The HTTPS Protocol

Even if you have a WordPress blog, it is important to secure your website by installing an SSL certificate. At times blog owners might think that an SSL certificate is not required for a blog website, but that’s not the case, you might be having subscribers on your website therefore it is necessary to secure your website. The users on your website should login through a secure SSL protocol. You can buy a suitable SSL certificate from your hosting provider. If you opt for WordPress hosting at MilesWeb, you are entitled to a free SSL certificate. When you buy an SSL certificate, you can either use the HTTPS protocol only for the admin area or for the complete website. It is advisable to use the HTTPS protocol for the complete website as even Google favors a secure and fast website.

Disallow Unfiltered HTML

WordPress enables the admins and editors of a website to post Java script and HTML markup inside of a <script> tag in pages, posts, widgets and comments. However, this can be harmful if any of the admin’s or editor’s account gets compromised. Therefore, you can filter the HTML markup or code posted by them by adding the rule mentioned below in the wp-config file:

define( ‘DISALLOW_UNFILTERED_HTML’, true );

After setting the rule mentioned above, the HTML and JavaScript won’t be executed, it will be shown on the website as a plain text string.

Deny Access To Your .htaccess Files

It is possible to restrict unauthorized access to all your .htaccess files of your WordPress installation. Your .htaccess files comprise of Apache server configuration; however, they are available publically in the browser.

If you type this in your browser – https://yourwebsitename.com/.htaccess, you can see if your main .htaccess file can be accessed by everyone on the net. You will have to use the following .htaccess rule for protecting all your .htaccess files:

<Files ~ “^.*\.([Hh][Tt][Aa])”>

Order Allow,Deny

Deny from all

Satisfy all

</Files>

Over to you…

Implementing the best security practices will make your website safer and difficult to hack. You surely can install security plugins but you will be able to go a step ahead by implementing some useful security tricks.