If you’ve ever faced the frustration of dealing with a hacked website, you’re not alone. My website was repeatedly injected with spam code every few weeks, and I had to spend hundreds of dollars fixing it.
It was a nightmare!
But after much research and trial and error, I found a combination of tools and steps that successfully protected my site from future attacks.
In this blog post, I’ll share the exact steps I took to secure my website. These steps are easy to follow, even if you’re not a technical expert.
Step 1: Install Essential Security Plugins
I used a combination of three powerful plugins to secure my WordPress website. Each has unique features that complement one another:
- Wordfence Security (Download here)
- Protects your website with a robust firewall and malware scanner.
- Protects your website with a robust firewall and malware scanner.
- WP Cerber Security (Download here)
- Helps prevent brute force attacks and unauthorized logins.
- Helps prevent brute force attacks and unauthorized logins.
- Anti-Malware Security (Download here)
- Scans your site for malware and suspicious files and provides tools to clean them.
- Scans your site for malware and suspicious files and provides tools to clean them.
- Updraft Plus (Download here)
- Protects your website with a robust firewall and malware scanner.
Install these plugins from your WordPress dashboard by going to Plugins > Add New, then search for each plugin’s name and click Install Now and Activate.
Step 2: Change Your Admin URL
By default, the admin login page for WordPress is accessible at /wp-admin or /wp-login.php. Hackers often target these URLs.
Using the settings in WP Cerber, change your admin login URL to something unique. For example, instead of yoursite.com/wp-admin, use something like yoursite.com/mysecurelogin.
How to Change Admin URL:
Go to WP Cerber > Hardening.
Enable the option to change the login URL.
Set a unique URL and save the changes.
Step 3: Enable Two-Factor Authentication (2FA)
Two-factor authentication adds an extra layer of security to your login process. Even if someone gets your password, they’ll need the second authentication factor to log in.
How to Enable 2FA:
In Wordfence, go to Login Security > Two-Factor Authentication.
Follow the instructions to set up 2FA using an authenticator app like Google Authenticator.
Step 4: Limit Login Attempts
Limiting the number of login attempts prevents hackers from repeatedly guessing your password.
How to Set Up Login Limits:
Go to WP Cerber > Main Settings.
Under Login Attempts, set the maximum number of allowed attempts (e.g., 3 attempts).
Set the lockout duration for failed login attempts.
Step 5: Block Suspicious IP Addresses
Automatically block IP addresses after multiple failed login attempts to prevent brute force attacks.
How to Block IPs:
In WP Cerber, go to Access Lists.
Enable automatic IP blocking after several failed login attempts.
Step 6: Regular Malware Scans
Keep your website clean by regularly scanning it for malware or suspicious files.
How to Scan for Malware:
Go to Anti-Malware Security > Scan Settings.
Run a full scan of your website.
Follow the recommendations to remove any detected threats.
Step 7: Take Regular Backups
Even with the best security measures, it’s crucial to have backups of your website in case something goes wrong. I use UpdraftPlus for this purpose.
How to Set Up Automatic Backups:
Install and activate UpdraftPlus from the WordPress plugin directory.
Go to Settings > UpdraftPlus Backups.
Configure automatic backups to save your website data at regular intervals.
Set up remote storage options like Dropbox or Google Drive to upload backups automatically.
With these backups, you can easily restore your website if it gets compromised
Bonus Tips
Keep WordPress, themes, and plugins updated to avoid vulnerabilities.
Use strong passwords and change them regularly.
Take regular backups using plugins like UpdraftPlus, so you can restore your site if needed.
Final Words
Securing your website doesn’t have to be complicated or expensive. By following these steps and using the recommended plugins, you can protect your site from hackers and save yourself the stress and cost of constant repairs.
If you’re facing similar issues or have questions about any of the steps, feel free to comment below. I’d be happy to help!
