Tag: best wordpress security plugin

12 Most Important Tips To Improve WordPress Security
Recently. WPTemplate shared an infographic on WordPress security issue. The figures were shocking. Each year, thousands of websites are compromised and the figures keep increasing every year.

In year 2012, more than 170,000 WordPress sites were hacked and that’s crazy!

The million dollar question could easily be, “Are you doing enough when it comes to securiting your website security?”

Source: WordPress Templates

So, what you can do to improve your WordPress security?

Did you notice two of the biggest contributor to WordPress security are hosting companies and WordPress themes? And heck, most of thought that WordPress security has always associated with weak security password.

WordPress is one the biggest blogging platform in the world and thus, it is not something new that it is targeted by hackers every single day.

Being said that, you should not take WordPress security for granted and therefore, you should act now.

Yes mate, right now … by doing these easy steps!

1. Practice frequent updates

When was the last time you upgraded your WordPress or plugins? Usually, the latest updates are the one that has security patches or even newer features. If you have yet to get them updated, do it now. It wouldn’t take you more than 5 minutes.

At least, do it for the sake of your website security. Seriously!

2. Perform housekeeping and clean up on your website regularly

Safety first when it comes to website security

Do you know that it is best to delete or uninstall those unwanted plugins you have on your database? Yes, even though they have been deactivated, you should … and by all means remove them immediately. Having lesser plugins also provide a better website loading speed and not to forget, leaving a better experience for readers as well.

The main reasons is because there are many plugins which might pose a threat especially to WordPress. You have to remember that even though you might have deactivated them, they are still accessible in your website database.

3. Avoid using Admin username

This is the same mistake everyone does. You should never use Admin as your administrator ID. I know some WordPress sites advice users to create Admin username without any administrator access. For me, it is best to leave Admin untouched.

The first thing a hacker would try is to brute force login using Admin or Administrator ID. If you are using either one of those username, then you are basically making their life (of hacking) easier!

It is always best to have a mixture of words, symbols and numbers. Of course, you can further boost your WordPress security by adding capital letters as well.

4. Turn off membership registration

Proper ‘security check’ for members is vital to improve your WordPress security

Yes, I don’t allow open registration at all for my sites. Instead, I’ll manually add members myself. This is to ensure that I have complete control over security matters. Small security actions goes a long, long way when it comes to securing your WordPress site.

If everyone is able to register on your site freely, then you might have problem when you’ll find spam bots and potential hackers trying to break the website security.

I truly understand that adding membership manually might be a real pain but it is worth it for those who really cares about security matters. Of course, if you are running a big company, uses WordPress and has a full list of members, Premise might be the best WordPress membership for you.

5. Changing table prefix

This is one hell of efficient method when it comes to WordPress security. Better WP Security plugin makes it sound easy with just a press of a button. No, it isn’t that easy!

You got to learn how to change the prefix correctly or else, you are going to destroy your website … literally. I changed the last round and I accidentally ‘destroyed’ my theme. Ouch!

6. Backup, backup and backup

Nothing goes more important than backup … when it comes to website and stuffs. Lucky for you, there are some seriously good backup plugins and programs that work perfectly for WordPress. Why backup you may ask. Well, imagine you are being hacked or something bad happen to your site today. You can easily restore everything in a very short period since you have a backup file. What happens if you have no backup files? Then you would need to start back from scratch!

Real case scenario. Three months ago, I had several websites running and when ‘something’ bad happened to them, I practically lose hundreds of articles. Yes, I do backup but I only did once a month which is clearly, insufficient! However, it was good that at least, I still have a month old backup. If not, I would be doing everything from scratch … and for over five websites!

7. Security plugins could help

Hello, you’re being monitored.

Let’s say you are less geeky and need help with securing your website. There are WordPress security plugins such as WordFence and Better WP Security which could provide above average security features with just a few clicks of the mouse. Can’t decide which to use? You may find my review here, Wordfence vs Better Wp Security plugin.

Basically, these plugins will boost your WordPress security level and even provide you the well needed security notifications. Definitely worth a shot for those who prefer to be on the safe side.

8. Increase your security features with Content Delivery Network (CDN) services

Heard about Cloudflare and Incapsula? If not, you should definitely use one. Seriously!

Content delivery network or CDN could provide minimal security especially when you are using a free service. Well, some security is always better than no security right? No? 🙂

I always consider CDN to work very well especially when it comes to preventing Distributed Denial of Service (DDoS) attacks and also improving the website loading speed. Personally, if you are using a CDN for security, Incapsula has a very good security background while Cloudflare is much better of with improving website loading speed (with some security features).

9. Know your WordPress plugins

We all talk about WP everyday.

Now, ask yourself a question. How much do you know about your plugins?

I used to download and try all types of plugins last time and without even bother to check the reviews. Now, I do check their reviews first and even a little bit of Google-ing before installing anything. Some malicious plugins could be hacker’s backdoor to your admin area and protected files. So, always have a good grip of what you are installing and decide if they are really worth the time (and your website security).

Nothing is too personal when it comes to website security!

10. The last level of security comes from you

Me? Seriously?

Yes this is true! Who is your best, most accountable and trusted watch guard for your website? It’s you for Christ’s sake! You got to be on your toes and at least, check on basic changes done that you should be worried about. Let’s take a simple example below.

I had Better WP Security installed on one of my niche website and every time changes are done to my site, I”ll receive an email notification immediately. Imagine small changes such as uploading an image to my gallery and it triggers an email notification. Good? Excellent I would say!

Thing is, you got to at least know what’s happening on your website. Well, you might not have the technical skills to know what to do but at least, you’re still able to alert your hosting provider or developer to check on that.

And when you think that are all …

Hold on there tiger! The above are 10 important security tips when it comes to WordPress and I still have two more under my sleeves!

11. Choose the right WordPress theme for your website

Do you know that 29% of security problems originated from using the wrong WordPress themes? There’s absolutely no denial that there are thousands of free WordPress themes out there. My personal advice?

Ditch those free themes for crying out loud! Jesus! Don’t you see it? These themes might have some codes inside which could compromise your security. Not all, but certainly, I know a lot of them who actually are!

I don’t get it … I really, really don’t get it on … you know … free WordPress themes.

If you are willing to buy premium WordPress theme, you have to be careful as well as not all themes are coded properly. Badly codes one will actually affect your website in many ways.

Here are two of the best WordPress themes I would recommend any day; Genesis Framework and Thesis theme.

Personally, I’m a huge fan of Genesis because:
- Genesis 2.0 says out with the old (XHTML) and in with the new (HTML5), and if you want your website to be future-compatible it needs to use HTML5
- Genesis 2.0’s support of Schema.org code — used by Google, Bing, Pinterest, and many others — allows you to incorporate microdata into your site’s code, further enhancing your SEO
- Genesis 2.0 has code that, if you can believe it, is even cleaner and more lightweight than ever before — which means less bloat and faster load times for readers
- Genesis 2.0 is responsive, and thus most of the child theme are as well
- Genesis 2.0 is backwards-compatible (which makes update a brief)
Don’t take my words for that. Check them out yourself and decide which is best using the links below:

Genesis Framework | Genesis Child Themes | Thesis Theme

12. The importance of hosting companies

Last but not least, the infographic provided by WPTemplate proved that hosting companies play a huge role in terms of WordPress security. With 41% of website hacks originated from website hosting, I bet the figure explains it all.

Personally, I know there are so many hosting companies that are offering cheaper than usual hosting packages. I totally get it that hosting is a competitive industry but have you ever thought that cheap hosting might not provide even the slightest security features for your lovely website?

Let’s take some ‘stats’ for example, shall we?
- Yoast SEO, Chris Brogan, Jay Baer and Chris Pirillo uses Web Synthesis hosting
- HTC, FourSquare, SoundCloud and Balsamiq uses WP Engine hosting
- Volkswagen, Samsung, Sony and dribbble uses Media Temple hosting
Now, does all these makes any logical sense to you?

The above are examples of big brands trusting their hosting companies. Do you see why they don’t go for cheaper corporate hosting? C’mon, give me a guess and I’ll wait! Yes, you got it right mate. It’s all about security.

When it comes to WordPress security, it is best to leave it to the pros if you have limited expertise.

Obviously, these brands are having a much bigger package but it doesn’t mean that you can’t join the big boys’ club. There are packages below $20 which could work very well on your budget and most importantly, a piece of mind 24/7.

You may be using a package say $5 per month but you have to do all the job and maintenance yourself. Simply by adding $15 a month, you would can leave all the maintenance work to the pros … for free.

With proper web hosting, you can forget about spending hundreds or thousands of dollars on webmasters who will take care of your websites (no offence though).

Last time, I was with GoDaddy and then, moved over to HostGator. Even though I was happy with my money spend with them, I wasn’t too happy about the support. What can you expect from a $4 or less web hosting package right?

Again (and like what I always say), don’t take my word for it. Go have a look at their websites have to offer.

Recommended high end web hosting companies: Web Synthesis | WP Engine | Media Temple

You may also take a look at my review on why BlueHost is my top choice for affordable web hosting service.

Over to you…

If you think that SEO and all those blogging tips are important, think again. WordPress security is much more important nowadays. Thousands had done them wrongly and I certainly do not hope that you are one of them! Remember that hackers are always out there and you need to be ready for them.

Do you have any other WordPress security tips to share? If you do, drop me a comment below and let’s discuss it over.

**If you find this article interesting, I would be very grateful if you could share it using the red button below.
January 5, 2024
Better WP Security vs Wordfence Security: The Battle For WordPress Best Security Plugin
We could have probably heard that website security is vital especially when hackers are all around nowadays. I am not going to leave any security loopholes in my WordPress site and I am sure you are either. When it comes to WordPress security plugin, there could have hundreds of plugins you can choose from but when you talk about the best, there could be two which comes to my mind.

Introducing Better WP Security and Wordfence Security.

Here are some information on both the plugins.

WordPress is the most popular blogging platform but security threats are very real

What is Better WP Security Plugin?

Created by: Bit51

What Better WP Security does:
- Remove the meta “Generator” tag
- Change the urls for WordPress dashboard including login, admin, and more
- Completely turn off the ability to login for a given time period (away mode)
- Remove theme, plugin, and core update notifications from users who do not have permission to update them
- Remove Windows Live Write header information
- Remove RSD header information
- Rename “admin” account
- Change the ID on the user with ID 1
- Change the WordPress database table prefix
- Change wp-content path
- Removes login error messages
- Display a random version number to non administrative users anywhere version is used
- Scan your site to instantly tell where vulnerabilities are and fix them in seconds
- Ban troublesome bots and other hosts
- Ban troublesome user agents
- Prevent brute force attacks by banning hosts and users with too many invalid login attempts
- Strengthen server security
- Enforce strong passwords for all accounts of a configurable minimum role
- Force SSL for admin pages (on supporting servers)
- Force SSL for any page or post (on supporting servers)
- Turn off file editing from within WordPress admin area
- Detect and block numerous attacks to your filesystem and database
What is Wordfence Security plugin?

Created by: Mark Maunder

What Wordfence Security does:
- Scans core files, themes and plugins against WordPress.org repository versions to check their integrity.
- Includes a firewall to block common security threats like fake Googlebots, malicious scans from hackers and botnets.
- Includes advanced IP and Domain WHOIS to report malicious IP’s or networks and block entire networks using the firewall.
- See how files have changed. Optionally repair changed files that are security threats.
- Scans for signatures of over 44,000 known malware variants that are known security threats.
- Scans for many known backdoors including C99, R57, RootShell, Crystal Shell, Matamu, Cybershell, W4cking, Sniper, Predator, Jackal, Phantasma, GFS, Dive, Dx and many many more.
- Continuously scans for malware and phishing URL’s including all URL’s on the Google Safe Browsing List in all your comments, posts and files that are security threats.
- Scans for heuristics of backdoors, trojans, suspicious code and other security issues.
- Checks the strength of all user and admin passwords to enhance login security.
- Monitor your DNS security for unauthorized DNS changes.
- Rate limit or block security threats like aggressive crawlers, scrapers and bots doing security scans for vulnerabilities in your site.
- Choose whether you want to block or throttle users and robots who break your security rules.
- Includes login security to lock out brute force hacks and to stop WordPress from revealing info that will compromise security.
- See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
- A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
- Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
- Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
- Wordfence Security for multi-site also scans all posts and comments across all blogs from one admin panel.
- WordPress Multi-Site (or WordPress MU in the older parlance) compatible.
- Premium users can also block countries and schedule scans for specific times and a higher frequency.
I know the list is rather long but it is relatively easy to say that both are trying their best to compete with one another. I tested both Better WP Security and Wordfence Security for a week each on various websites and I was surprised at my decision…really. Let me tell you why.

Security effectiveness

Better WP Security – 9.5/10, Wordfence Security – 9.5/10

When it comes to security, I can tell you that both plugins look very seriously into the matter. Both actually impressed me more than what I actually expected them to perform. If you are going to install either one of these, rest assured your security effectiveness will be top of the chart. And that, I am definitely sure.

User-friendly UI

Better WP Security – 9/10, Wordfence Security – 9.5/10

I have very split decision in this. I love Better WP Security’s direct layout but I prefer the Wordfence Security interface. Basically in Better WP Security, you will be able to see all the issues in different colours (red as dangerous, green as safe etc). With a simple click, it will redirect you immediately to the setting for you to do any adjustment required. Compared to Wordfence Security, the layout is more ‘WordPress-like’ (imagine using W3TC).

Both plugins layout are extremely versatile and easy to navigate through. At the same time, both the plugins developers are doing a great job by trying to provide a compact view on the plugin dashboard itself. Here’s are what both dashboards look like:

Better WP Security Dashboard

Wordfence Security Dashboard

Plugin usability

Better WP Security – 7/10, Wordfence Security – 9/10

When it comes to security plugin usability, this is where it makes all the difference. Better WP Security plugin is great but what makes it short from getting a higher score from me is because it requires a higher curve of WordPress understanding for a person to actually utilize it properly. In other words, you are open to all options to configure your WordPress but you are prone to create an accidental mistake if you have no idea what you are doing.

Compared to Wordfence Security, most options are pretty direct and even a beginner could use the plugin to the maximum of its capabilities. This definitely gives a better rating to Wordfence Security compared to the latter.

How important is website loading speed for you?

Better WP Security – 10/10, Wordfence Security – 8/10

To be very honest, I been trying to search for this answer but failed miserably. Whenever I use Wordfence Security, I noticed that my site is loading less than one second slower compared to the time I used Better WP Security. after checking with various programs and tools, it really seems like Wordfence Security’s firewall feature is creating a small ‘lag’ which affects the page loading speed. Maybe this could be me but I am not experiencing that when I am using Better WP Security.

My honest conclusion between Better WP Security and Wordfence

If I would to choose and could only choose one as my best WordPress security plugin, then my money is going to Better WP Security. I know! I love Wordfence Security plugin and it is very close to flawless.

However, having the small page load ‘penalty’ really turns me off. Regardless what WordPress security plugin you choose, I am sure both of these plugins will not let you down.

How about you? Do you have any favorite security plugins you would like to share? Or, maybe you have your opinion on both the plugins? Feel free to fill the form below and tell us what you think.

If you like this article, could you please share this for me using the red Google+ button below?
December 6, 2023