If you thought an expensive piece of software was the only way to have the best website security, think again! Here, we'll share some simple changes you can make right now to greatly improve your protection.
1. Auto-enable ALL of your plugins
WordPress is constantly updating it's codebase, and it's up to the plugin maker to make sure their software is compliant and compatible with the latest releases. It's common for plugin makers to find vulnerabilities in their code, and they often need to update their plugins to fix them. You don't want to miss these updates, which could put your website at risk. That's why we recommend enabling auto updates. It's very easy to do and only takes a minute!
Login to your WordPress admin dashboard.
On the left vertical menu, select plugins.
You should see a list of all your plugins. In the last column, it will say Automatic Updates. Now Enable auto-updates for each plugin.
That's it, you're all set! As always, if you are no longer using a plugin, be sure to remove it!
2. Remove inactive users
It's common for most WordPress websites to have multiple usernames with admin access. If you are not using them, do yourself a favor and remove them! These usernames can easily be found by brute force bots, and if the passwords are not secure, they can be easily cracked. Here is how you can remove them right now.
Login to your WordPress Admin dashboard.
On the left vertical menu, select users.
On the users page, select administrators on the top of the page.
Select the users that are not being used, and delete.
If there is existing content created by the user(s), the system will ask to attribute it to another user (most likely it will be yourself).
That wasn't so hard, right? It's best to regularly review your admin users and prune as needed.
3. Make your admin password STRONG
You ear this all the time, but let's face it, it works. 10 digit passwords are nearly impossible to crack by brute force bots if you use the right combination of characters. Use at least 10 characters with uppercase, lowercase, numbers and special characters. An example of a strong password would look like this Ah0BhYSF+EZ4Ph%Nw*nU9?jiRj (This is an example, DO NOT use this as your password). WordPress has an excellent built-in password generator. Use it.
If you forgot how to change your admin user password, here is a quick step-by-step guide on how to do it.
Login to your WordPress Admin dashboard.
On the left vertical menu, select users.
On the users page, select administrators on the top of the page.
Select the user(s) you'd like to update.
On the user profile page, scroll all the way to the bottom where it says set new password. Select it and follow the instructions.
Repeat this for all of your admin users. It's also good practice to change it every year or so due to certain viruses that can log your key strokes.