Yoast recommends Sucuri  ## Metadata - Author: [[Jono Alderson]] - Full Title: Yoast recommends Sucuri - Category: #articles - Summary: If you are serious about your website, you are serious about your security. Get the complete security package of Website Security Stack now: Get your Sucuri Website Security Stack NOW. - URL: https://cdn.ampproject.org/c/s/yoast.com/wordpress-security/amp/ Drive **more traffic** to your site. **Save time** on doing SEO tasks. Reduce your site’s **carbon footprint**. And get **24/7** **support**. If you’re working with or using WordPress, then you should always think about your site’s security. WordPress isn’t any more or less secure than any other platform, but the number of users, plugins and third-party add-ons makes it a common target for attackers. Don’t worry though, there are some basic steps you can take to keep your site safe (even if you’re not very tech-savvy)! #### Table of contents #### Don’t use ‘admin’ as a username Most WordPress ‘hacks’ and attacks don’t do anything more sophisticated than try and [brute-force](http://en.wikipedia.org/wiki/Brute-force_attack) their way into your admin area by guessing your password. That’s much easier for them to do if they don’t also have to guess your admin username! Avoiding using common words (like *admin*) for your usernames can make brute-force attacks much less effective. If you’re working with an older site that already has an ‘admin’ user, it might be time to delete that account and transfer any content or access to a more secure username! #### Use a complex password Having a better password can make it much harder to guess or to brute-force. An easy tip to remember is *CLU*: Complex. Long. Unique. But longer, unique passwords can be hard to remember, right? That’s where tools like [1Password](https://agilebits.com/onepassword) and [LastPass](https://lastpass.com/) come into play, as they each have password generators. You type in the required length, and it generates a password for you. You save the link, save the password, and move on with your day. Depending on how [secure](https://howsecureismypassword.net/) you want the password to be, it’s sensible to set a *long* password (20 characters is good) and decide on things like the inclusion of less usual characters like `#` or `*`. #### Add two-factor authentication Even if you’re taking steps to lock down your site, brute-force attacks can still be a problem. Two-factor authentication can add extra security to your login process, and reduce the risk of someone guessing your password. The principle is that, rather than just entering your login details, you also need to confirm that you’re *you* by entering a one-time code from another device you own (usually through an app on your phone). That’s much harder for attackers to fake! Two popular plugins for handling authentification in WordPress are the [Google Authenticator](https://wordpress.org/plugins/google-authenticator/) and [Rublon Plugin](https://wordpress.org/plugins/rublon/) (which takes a slightly different approach). Just make sure that you don’t lose your backup codes, or you might find yourself locked out. #### Employ ‘least privileged’ principles The WordPress.org team has put together a great article in the WordPress Codex regarding [Roles and Capabilities](https://wordpress.org/support/article/roles-and-capabilities/). We encourage you to read it and become familiar with it because it applies to the following step. The concept of *least privileged* is simple. Only give permissions to: * those that need it, * when they need it and * only for the time they need it. If someone requires temporary administrator access for a configuration change, grant it, but then remove it upon completion of the task. The good news is you don’t have to do much here, other than employ best practices. Contrary to popular belief, not every user accessing your WordPress instance needs to be categorized under the *Administrator role*. Assign people to the appropriate roles (like ‘*Editor*‘ or ‘*Contributor*‘), and you’ll greatly reduce your security risk. If you need more fine-grained control, plugins like [User Role Editor](https://en-gb.wordpress.org/plugins/user-role-editor/) enable you to tweak access rules and individual user privileges. #### Hide system files Your `wp-config.php` and `.htaccess` files can be critical to your WordPress security. They often contain your system credentials and can expose information about your site’s structure and configuration. Ensuring that attackers can’t gain access to them is vital. Hiding these files is relatively easy to do, but doing it wrong might make your site inaccessible. Make a backup and proceed with caution. [Yoast SEO for WordPress](https://yoast.com/wordpress/plugins/seo/) makes this process somewhat easier for you. Just go to “*Tools > File Editor*” to [edit your](https://yoast.com/help/how-to-edit-htaccess-through-yoast-seo/) `[.htaccess](https://yoast.com/help/how-to-edit-htaccess-through-yoast-seo/)` file. For better WordPress security, you will need to add this to your `.htaccess` file to protect `wp-config.php`: ``` <Files wp-config.php> order allow,deny deny from all </Files> ``` That will prevent the file from being accessed. Similar code can be used for your `.htaccess` file itself: ``` <Files .htaccess> order allow,deny deny from all </Files> ``` #### Use WordPress security keys Your `wp-config.php` file has a dedicated area where you can provide ‘Authentication keys’ and ‘salts’. These are a set of random values, which are unique to your website. They’re used by WordPress to encrypt any information stored in cookies, which makes it harder for attackers to sneak in by pretending to be an authenticated user. An example of authentication keys and salts in `wp-config.php` You can define your own random values, or use the [handy generator](https://api.wordpress.org/secret-key/1.1/salt/) to get a set which you can just paste in. #### Disable file editing If a hacker gets in, the easiest way for them to change your files would be to go to “*Appearance > Editor*” in WordPress. To improve your WordPress security, you could [disable](https://wordpress.org/support/article/editing-wp-config-php/#disable-the-plugin-and-theme-editor) the editing of these files via that editor. Again, you can do this from within your `wp-config.php` file by adding this line of code: ``` define('DISALLOW_FILE_EDIT', true); ``` You will still be able to edit your templates via your favorite (S)FTP application (or build processes). You just won’t be able to do it via WordPress itself. #### Hide your login and limit login attempts Brute-force attacks usually target your login form. So changing where that lives can make it harder for attackers to get in. The [All in One WP Security & Firewall plugin](https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/) has an option to simply change the default URL (from `/wp-admin/`) to something more secure. Next to that, you can also limit the number of attempts to log in from a certain IP address. There are [several WordPress plugins](https://wordpress.org/plugins/tags/brute-force) to help you protect your login form from IP addresses that fire a multitude of login attempts your way. #### Be selective with XML-RPC *XML-RPC* is an application program interface (API) that’s been around for a while. It’s used by a number of plugins and themes, so we caution the less technical to be mindful of how they implement this specific hardening tip. While functional, disabling can come at a cost. This is why we don’t recommend disabling for everything, but being more selective on how and what you allow to access it. In WordPress, if you use [Jetpack](https://jetpack.com/2015/10/12/jetpack-protection-from-brute-force-xml-rpc-attacks/) you’ll want to be [extra careful](https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html) here. There are a number of plugins that help you be very selective in the way you implement and [disable XML-RPC](https://wordpress.org/plugins/search.php?q=disable+xml-rpc) by default. #### Get good hosting Even if you’re meticulous when it comes to the security of your website, if it’s hosted by a company that isn’t just as meticulous, you may as well not have done anything at all. If an attacker can gain access to your website hosting, they can take complete control of everything. That means it’s *really* important that you choose (or move to) a host that takes hosting seriously. Cheaper hosting options often don’t come with good security or backups, or might not offer support to help you clean up a hacked site. Finding the right hosting partner can be complex – but not if you start with [our recommended hosting companies](https://yoast.com/wordpress-hosting/). Some of these come with their own dedicated WordPress plugins, too, which provide even stronger security benefits. #### Stay up to date It’s critical that you update your theme(s), software, plugins, and other components as part of an ongoing routine. Otherwise, you’re leaving the door open to attackers. If you’re a user of the Yoast SEO plugin, just follow these easy steps [to update your Yoast SEO plugin](https://yoast.com/help/how-can-i-update-my-premium-plugin/). If you’re running an up-to-date version of WordPress, you can also configure your site and plugins to automatically update whenever there’s a new version. Lastly, don’t forget to look at the other moving parts of your setup. From your hosting system, to your own computer’s operating system, anything which is running software or using passwords needs to be kept up to date. #### Make regular backups If something goes wrong, you’ll need to have backups in place in order to safely roll back to an earlier date. Good hosting companies will provide backup facilities as part of their packages, but if you want to shop around, there are some excellent [plugins](https://wordpress.org/plugins/search/backups/) available. #### Consider using a security plugin If all of this feels like a lot of work, don’t worry – help is available, in the form of [firewall plugins](https://wordpress.org/plugins/search/firewall/) and general [security plugins](https://wordpress.org/plugins/search/security/). These plugins look for known attackers and common attack patterns and stop them before they have a chance to compromise your site. Some of the more popular security plugins (like [Sucuri Security](https://en-gb.wordpress.org/plugins/sucuri-scanner/) and [Wordfence](https://www.wordfence.com/)) are maintained by companies that employ security researchers who monitor, educate on and patch issues. That helps to keep your site protected against all of the latest threats. You’ll still need to take care of the basics, but these plugins can help you shore up your defences, and to react quickly to emerging threats. It’s worth spending time exploring their settings, reading their documentation, and making sure that you’ve tailored the setup to meet your site’s unique needs. #### Stop attacks at the ‘edge’ with a CDN The best security solutions prevent attackers from ever getting anywhere near your website or admin controls. Many [Content Delivery Systems](https://yoast.com/what-is-a-cdn/) include sophisticated firewall functionality; combining performance optimization with protection. These systems can identify and intercept bad traffic at the network level, and stop it from ever reaching your website. [Cloudflare](https://www.cloudflare.com/) in particular does a great job of blocking ‘bad traffic’ and even has rules and scans specifically developed to protect WordPress sites. Their ‘[Zero Trust](https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/)‘ approach to security expands on our recommendations to employ ‘least privileged’ principles, to assume that *all* traffic and requests are ‘bad’ until proven otherwise – and their tools do a great job of preventing common and brute-force attacks. #### Don’t forget logs & monitoring Even with the best protections, sometimes things can go wrong. If they do, it’s important to be able to find out what happened, and what you can do to prevent it from happening again. Adding an [activity logging plugin](https://wordpress.org/plugins/wp-security-audit-log/) to your WordPress website can be a great help in diagnosing what might have happened after a hack, as well as helping you to keep an eye on day-to-day activity. #### Anything else? Like optimizing your website for SEO, security is something that you should be looking at all of the time. There are a lot of different areas that you should explore, and this list barely scratches the surface. If you’d like to learn more, we recommend exploring the ‘[hardening WordPress](https://wordpress.org/support/article/hardening-wordpress/)‘ page on wordpress.org, and talking to your hosting company. Jono is our Head of SEO, and part of our leadership team. He's a digital strategist, marketing technologist, and full stack developer. He's into technical SEO, emerging technologies, and brand strategy. [#### WordPress for beginners series](https://yoast.com/series/wordpress-for-beginners/) [See more from the WordPress for beginners series »](https://yoast.com/series/wordpress-for-beginners/) #### Coming up next!, Yoast recommends Sucuri, Jono Alderson, 01gnmcy2yn3bv7e43a4mn9f9bf.