Do you know the biggest mistake you could possibly make about your WordPress security?
Assuming a plugin will handle it all for you.
A lot of people just installed WordFence and call it a day. They think their job is done. The plugin will handle anything and everything and they don’t even need to think about security.
Plugins can help, but only so much
Can a plugin really save you if your password is ilovepuppies ?
Can a plugin save you from using a plugin that you haven’t updated in six months?
Plugins can provide a little extra aid, but they can’t do all the work for you. They can’t save you from poor decisions or security holes you might create yourself.
Use plugins to solve a specific problem or plug a specific hole, but you have to do your part too!
1: Set a strong password, pleaaaase
- Good Password
@@A3PHo91$D@kNrW0sZD5T$1KsFhs$Ox - Good Password
I love windshields in "winter" because it's snowing!(WTF? LOL) - Bad Password
puppies123 - Bad Password
ilovebooks!
Your password should be long long long, and strong strong strong. A dictionary word (or two) with a number (or two) just isn’t going to cut it. Computers can blaze right through that password faster than you think.
Make your password stronger by making it long as fuck. The longer the better. Seriously.
2: Update EVERYTHING
- Plugins
- Themes
- WordPress itself
Update those bitches.
Yeah, yeah, sometimes an update can break a plugin or even crash your site. But would you rather have something break that’s incredibly easy to fix (forcibly deactivate the broken plugin) or find a replacement for, or would you rather have your entire site infected with sex adverts that spread across every file and costs you an arm and a leg to hire someone to clean?
3: Keep yourself informed
- Subscribe to Sucuri’s blog. They regularly report on known vulnerabilities and hacks they see spreading across the community.
- WordFence also has a great blog where they report on known vulnerabilities and offer security advice.
- Although not only about security, WP Tavern also often reports on some of the plugin vulnerabilities that affect large user bases.
The best thing you can do for yourself and your site is to stay active, involved, and play a role in your own security. Don’t chill in the backseat and assume a plugin will do everything.
Thanks for the links. I had a site redirected to a casino a while back and ever since then I’ve been especially diligent. Getting users to go along with extra security measures isn’t easy – they don’t see what the big deal is all about and they think I’m being a pest! Oh well…..
I’m assuming you do all the updating for your hosting clients? That’s a big reason I’m happy to pay a bit extra for the service. It’s worth it for me not to have to think about that!
Yes I do all the updates. 🙂
Yay!
Yessssssssssssss. That is all.
/pointless comment of the year
So I have a question Ashley. I do many of these things. I have a unique and long password. I have it copied in multiple ways so I don’t forget it and can look it up if I need to. But this past week my server has gone down, and my hosting was telling me it was due to the wordfence security plugin. Which I had never had a problem with before. What are other good security plugins that would be safe to use?
Hi Renee,
I’d personally just use something simple to stop brute force attacks, like Login Lockdown. That’s the only thing that’s really needed.
Great tips Ashley