Also available in: Português

WordPress powers 34% of the world’s websites

WordPress is the most popular content management system in the world, powering about 34% of all websites. But today we are not here to talk about how versatile and practical it is to use WordPress to build websites and blogs — we also need to pay attention to security. It may be easy to use, but without a good security configuration our website can be easily hacked.

How to improve the security of your WordPress site

Let’s get down to business: how to make your site more secure. There are many options available these days, but since we are talking about WordPress, there is one plugin that is very good at improving the security of your WordPress site: All in One WP Security.

All in One WP Security

It was built specifically for WordPress, and with it we get plenty of options to make the site more secure.

Supports Best Practices: All-In-One Security identifies whether an account uses the default ‘admin’ username or whether a user has identical login and display names, encouraging the user to change this in support of security best practices.
Hides the Login Page from Bots: Sets a custom URL for the WordPress ‘Admin’ login page, making it harder for bots to find. For example, nowadays the default is wp-admin; with this option we can change it to any name we want!
Login Lockout: External users who make repeated login attempts can be blocked for a configurable period. You can also block users with invalid usernames. View a list of all locked users and unlock them with one click.
Reports: All-In-One Security provides a wealth of information about the site’s users. See activity by username, IP address, and login/logout dates and times. See a list of currently logged-in users and all failed login attempts.
Force Logouts: Ensure users are not logged in indefinitely. With All-In-One Security, you can force logouts for all users after a configurable period.
Bot Verification: For extra security and spam-registration prevention, implement Cloudflare Turnstile, Google reCAPTCHA, simple math CAPTCHA, or a honeypot on registration pages, or enable manual approval of user accounts.

There are many other options inside the plugin, some paid and some free, but most of the ones listed above are free — and with that alone we can greatly improve our site’s security. I’ll leave the plugin link here Plugin website

SSL Certificates (Secure Socket Layer)

SSL plays a crucial role in secure online communication, offering significant benefits. If you have ever seen that https and http before a site’s URL, you should know it comes down to the SSL certificate.

Data Encryption: SSL encrypts the data transmitted between the user’s browser and the web server. This means sensitive information, such as login data, personal information, and financial transactions, is protected and can hardly be intercepted by malicious third parties.
SEO (Search Engine Optimization): Search engines, such as Google, consider website security as a ranking factor. Sites that use SSL have an SEO advantage, which can result in better positioning in search results.
Protection Against Man-in-the-Middle Attacks: SSL protects against “man-in-the-middle” attacks, in which an attacker tries to intercept or alter the communications between the user and the server. SSL encryption makes it extremely difficult for malicious third parties to compromise data integrity during transmission.
Server Authentication: The SSL certificate validates the identity of the server. This ensures users are connecting to the legitimate website and not to a fake page designed to steal information. SSL certificates are issued by trusted certificate authorities, providing an extra layer of security.

SSL (Secure Socket Layer) certificates are obtained by following these steps:

Choose a Provider:
    Choose an SSL provider, such as Let's Encrypt, Comodo, or DigiCert.

Select the Certificate Type:
    Choose between a Domain Validation (DV), Organization Validation (OV), or Extended Validation (EV) certificate.

Generate a CSR:
    Create a Certificate Signing Request (CSR) on your server.

Fill in the Information on the Provider's Website:
    Provide domain, organization, and contact details on the provider's website.

Domain Ownership Verification:
    Prove that you own the domain via email, DNS records, or other methods.

Install the Certificate on the Server:
    After approval, receive the certificate files and follow the instructions to install them on your server.

Update Web Server Settings:
    Adjust the web server settings (Apache, Nginx, IIS) to apply the certificate.

Check That It Is Working:
    Make sure the certificate is working by accessing the site using "https://" and looking for the padlock icon in the browser.

Some providers, such as Let’s Encrypt, offer free certificates. The process may vary depending on the provider and the server configuration.