Do Not Botch With The Security Of Your WP Website

We pay a lot of heed on the functionalities and fail to pay attention to the security concerns of our websites. This is where malicious users take advantage and attack your website.

It’s better not to wait for the milk to split, thus you need to follow some security measures which will save you from becoming a victim of malicious attacks.


Generate OTP for two step authentication:

Two factor authentication means that while logging into your WordPress website you need to input a One Time password (OTP) along with your login credentials . These OTPs are generated randomly via cryptographic functions in real time and it is sent to the user’s communication device via over a secure channel. This is generally the mobile phone of the user which is the most common communication device.

To achieve two factor authentication you need to:

In order to authenticate the login of your website you can also apply an OTP generation plugin which adds a two factor authentication on your WP website. There are numerous plugins available on your website which are paid as well as free. Two Factor Auth and Duo Two-Factor Authentication is the two widely used and free plugins in the WP plugin repository.

You do not require a lot of skills in order to install these plugins in your WordPress website. However, it is advised to go through their installation and set up guidelines available on their webpages before moving ahead in this process.

Disable Template File Editing Through WP Dashboard:

All you need to do is to mover down to this path Appearance > Editor, on your WP user account with administrative authorities in order to edit the template files. This is very easy for the hacker to make alterations on your WP website as all they need to do is to get the credentials of your admin account. Therefore, to prevent such things you can simple disable the file editing settings.

Steps to disable file editing:

You need to write the code mentioned below in the configuration file of your WordPress website so as to disable the privilege of editing the file using the dashboard editor. You then need to visit your file hosting program depicted on your control panel and go through your root directory. From there you need to go to the wp-config.php file and open it using a text editor and then add the following code in it.

view source
define( ‘DISALLOW_FILE_EDIT’, true );

While installing WordPress you will find out that the default administrative account is names as ‘admin’. This has increased the vulnerability of your website and this is utilized by the hackers many a times. Now from this we have derived the idea that it’s better to change the name as directly feeding the adim name is like serving the website to the hackers with alacrity. Thus, instead of using the word ‘admin’ you can have any other name for your administrative account. Although, it won’t make your account completely hack proof, but this will surely add on to the level of difficulty for the hackers.

Remove ‘admin’ user to reduce hack risk

If you already have an admin account, then there is a different method to delete it from those who have not yet installed WP.

If you haven’t installed WP yet:

If you are about to create a new hosting WordPress website, then you can easily remove the ‘admin’ user account during the installation process itself. On the very installation screen you get to see the options for configuration itself. There is an ‘Install’ button which is placed right at the bottom of the screen, so before clicking on it you simply need to replace the default user name ‘admin’ from any other name. That’s it and now you can simply carry on with the regular installation process.

If your WP is already installed: For those who already have an existing WP website need to login to their ‘admin’ account and then after creating a new login account. You need to know is that you need to provide all the administrative authorities to this new user. After this log out from your admin account and then log in from that new user account which has all the administrative authorities. Now you need to delete the ‘admin’ user account and for this you need to go to the ‘Users’ tab. As you no longer have an admin account, thus it reduces chances of getting hacked from the malicious users.

Use SSL Mode for Login Sessions

Adding SSL mode on the login makes the transfer of data from a web server and web browser securely.
After using SSL on your WordPress website the web browser encrypts the credentials of the user account before it sends it to the web server.

SSL mode on all the user accounts

The very first requirement to ensure security is that there should be a valid SSL installed in your hosting server. You need to give SSL login preferences in configuration files for all the login accounts on which you wish to apply SSL mode. You can use this in two ways: either only on the admin account or all user login accounts. Now you need to go to the root directory and from their open up the wp-config.php file. There you need to add any of the following piece of code there.

For Admin login:

define('FORCE_SSL_ADMIN', true);

For all user login sessions:

view source

define('FORCE_SSL_LOGIN', true);

Author Bio: Sophia Phillips is a PSD to responsive WordPress expert with a hands-on experience in developing front-end for websites. Currently, she is employed with WordPrax Ltd.- a leading PSD Design to WordPress company. Sophia has written a remarkable number of articles on WordPress tricks and tip.


You may also like

Free Brush Font: Leafy

Leafy is a handwritten brush font. It features 95 characters and has all the basic glyphs. The download contains a .otf file.

Jan 25, 2017 6:35 AM