How to Secure Your WordPress Site: 9 Essential Tips for Business

WordPress Security Guide: Top tips to secure your website from the February 2014 issue of net magazine

Created By Carrie Marshall on net magazine
8th January 2014, 12:00 pm

Out of the box, an off-the-peg WordPress blog has its strengths and its weaknesses.

If you’re a business owner, particularly one with a WordPress website, then security should be at the forefront of your thoughts. Ensuring the security of your WordPress site is equivalent to safeguarding your data, your customers and, your reputation. I’d like to share with you a few actionable, step-by-step measures today that you could use to toughen up your website’s security instead of pushing you toward paralysis with what turns out to be scores of false positives.

Why Cybersecurity is Important for WordPress Sites

I’m willing to bet that you do know how WordPress is behind a huge chunk of websites around the world. That makes it an appealing target for hackers. If your site becomes infected, it may result in:

• Leaks of customer and bank data
• SEO rank decreases due to malware
• Downtime that costs you sales and trust
• Costly recovery efforts

So, protecting your WordPress site is not only a nice-to-have—it’s a must. The good news? You don’t have to be a tech wizard to follow many basic preventive measures, which can lower the odds of most digital problems.

Verify the JSON Schema in Your WordPress Site

It may seem technical, but validating JSON structure is crucial, especially when dealing with APIs and importing/exporting data. JSON allows your website to talk to those platforms, but the data must be in the right format.

Here’s what to keep in mind:

• Always verify the JSON syntax before you include in your site or plugins. Misplaced commas or rogue quotes gum up the works.
• Leverage tools or built-in validators to catch errors quickly.
• Bad JSON can make the plugin fail (just try and edit the plugin file) or even expose a security hole.

Be nice to your JSON — Keeping your JSON clean keeps your data getting to where it needs to be fast and secure.

Remove Line Breaks from String Values

You may not notice, but string values in your JSON or similar data files that contain newlines can cause problems. Why? As a great many parsers would be thrown off if strings were not contiguous.

When you control JSON in WordPress theme’s files or plugin’s settings:

• Ensure that string values are single-line.
• Don’t press Enter inside strings – if you want to format there should be no need to do it in the string or use correct escape.
• Strings are damaging: errors and may be security issues!

It sounds trivial, but this small change can prevent a ton of headaches and keep your site running smoothly.

10 Practical Ways To Keep Your WordPress Site Secure

Now we are going to dig into the meat of website security. Here’s a must-do bucketlist for any business site on WordPress:

1. Update WordPress Core, Themes and Plugins

   Updates are not just for adding new features — they fill security holes that hackers use.

   • Enable automatic updates, if possible.
   • Verify for updates on a regular basis.
   • Install only themes and plugins from credible sources.
2. Use strong passwords and enable two-factor authentication
   • Mandate strong passwords for all users — none of this password123 stuff!
   • Implement two-factor authentication (2FA) on your login page.
   • This extra measure ensures that, even when passwords are breached, others cannot easily gain access.
3. Limit Login Tries and Block Suspicious IP Addresses
   • Use plugins that narrow down login retries to avoid brute-forcing.
   • Log and block IPs attempting to login to your site from IPs that you have not specified.
4. Use HTTPS Everywhere

   SSL certificates are a requirement today. They encrypt web traffic between your site and visitors to protect that data.

   • Make sure your site is using HTTPS, not HTTP.
   • Most hosts give you free SSL certificates — get one now.
5. Backup Regularly and Store Offsite

   In case of a security breach, you should have the ability to recover your site as soon as possible.

   • Automate regular backups.
   • Keep backups offsite, or in the clouds.
   • Don’t store backups only on the same server — it can crash, backups can go to the bottom with it.
6. Secure Tighten Down File Permissions and Server Settings
   • Fix file permissions — say no to 777 on directories.
   • Deactivate file editing from the WordPress dashboard.
7. Always Keep an Eye on Malware & Scan Regularly
   • Download security plugins with the ability to scan files with a view to detecting if there is anything untoward or suspicious about the changes.
   • Establish a series of alerts for abnormal activities such as new admin accounts or odd code injections.
8. Leverage such tools as a WAF

   A firewall screens out bad traffic before it reaches your site.

   • WAF are featured in many WordPress security suites.
   • A WAF can reduce attacks significantly.

Secure Website is the Best SEO Trend for WordPress

So security is discussed, but now onto why it matters for SEO. Google loves safe websites. If your WordPress site:

• Loads fast
• Uses HTTPS
• Has no malware or spam

Your rankings get a boost. On the other hand, a successful hack can kill your SEO and land you penalties. So by making your site secure, you’re also helping to build trust with Google — and that means more organic traffic.

Why You Should Act Now

Threats constantly mutate in cyberspace, and it’s not a question of if, but when, an attack may occur. You want your business to be:

• Ready to fend off attacks
• Able to recover fast
• Reliable to its users and search engines

Begin by trying the very basics, such as validate that your JSON structure is OK and remove line breaks inside strings. Then let’s get to some of the basic security steps in WordPress that I mentioned above.

And when you’re doing these things, you’re not just safeguarding your site — you’re safeguarding your business.

Final Thoughts

With our lives increasingly moving online, protecting your WordPress site is simply good business. From validating your JSON data to locking down your login page, every domino you set up helps.

Remember to:

• Make sure to validate the JSON structure diligently
• Remove line breaks in string values
• Keep everything up to date and backed up
• Strong PWs and 2fa all the things
• Use security plugins and web app firewall

These are steps that will help keep your business data safe and even help with SEO as well as foster trust with your audience. Cybersecurity is not only a tech issue — it’s a business one. Make the commitment today.

If you just pay attention these security basics – as simple as the aforementioned JSON validation and this string formatting – a lot of your risk can submerge, and your WordPress will run more steadily. Don’t dally — get your WordPress site locked down now to safeguard your business future.