How to secure your self hosted website

Securing a self-hosted website and website security is a very crucial factor. Especially important if you have moved or planning to move to a self-hosted site on WordPress or any other platform. You mustn't take security lightly.

You do not want your hard work to be destroyed by malicious attackers or hackers who are determined to break your site. It would be a nightmare to find your data completely erased or re-directing someplace else. The hackers usually either install malware or try to get important confidential information.

There are simple ways to secure your site for free using plugins and some other simple options that are listed below. Hope you find them useful.

GOOD HOSTING PROVIDER

A good web hosting provider will take care of almost all your security concerns. They will have multiple layers of security, take regular backups, and keep your content secure. I have been using Siteground and they are one of the top contenders due to their dedication to excellent customer support, security, uptime, and speed. They are the number one hosting favorites in many surveys and polls on Facebook as well.

Recently on the occasion of their 15 years of successful completion, they added some cool features to some of their plans. The basic startup plan has been upgraded to have free backups. So we will now be able to use the restore tool for free. They keep 30 automatic backup copies which are very useful in case your website becomes inaccessible due to any issues.  In terms of security, they have a web application firewall that protects clients from security breaches, runs virus and malware scans, uses http/2 technology, and sends proactive patches when there are threats. I would highly recommend Siteground as one of the best hosting providers.

UPDATE PLUGINS , THEMES AND WORD PRESS VERSIONS TO LATEST:

A good web hosting provider may solve most security concerns. But this does not mean that you do not do your part to keep your hosted site secure. Always ensure that you are updated to the latest versions of plugins and themes. There are often many releases of patches with minor bug fixes or security fixes which should not be ignored. Delete any unused plugins or themes. Just deactivating is not enough, it is best to completely remove what you are not using as the inactive files can be used to hack into your hosting account. It is also suggested to use fewer plugins as much as possible. Update Word press versions to the latest always to be secure.

AVOID NULLED THEMES:

Some premium themes may be illegally available cheaper or for free. They are called nulled or cracked themes. They are dangerous for your site and may contain malware codes which could cause many problems and is best to avoid them.

USE SECURITY PLUGINS:

The importance of using security plugins cannot be stressed enough. They help minimize brute attacks, provide malware scans to minimize vulnerabilities, send emails, and alerts if any threats are observed, and block certain IPs based on their activity. Some of the top-rated security plugins are Wordfence, iThemes Security, All in one WP Security, and Sucuri Security.

I use the free version of Word Fence and am pretty happy with it. You can view your live traffic, filter the traffic by human/bot or blocked users, etc. You can set up malware scans to scan your site along with WordPress files, plugins, themes, and alerts of issues. The file repair feature can even help clean by replacing the hacked file with the original file. The paid version provides many more cool features and helps make your site hard and unbreakable. They are also simple to set up and use.

SECURE YOUR LOGIN PAGE URL BY RENAMING:

We all know the login page to WordPress can be accessed by wp-login.php or wp-admin added to the website's URL. This URL can be used to brute force and hack into your site. One way to protect yourself is to rename the URL . There are plugins to do this . One such plugin is the WPS Hide Login. This helps you to rename wp-admin or wp-login.php to whatever you want. So then your login page URL for example could become > and this will redirect to your admin page. This rename of the login page URL makes it difficult for the hacker to get access.

CHANGE DEFAULT ADMIN USERNAME:

When you install WordPress, remember not to choose “admin” as the username, (which is the default ) for your main administrator account. This can be easily guessed as the username. Using this name and a combination of passwords will make it easy for hackers to get into your site.

DISABLE FILE EDITING:

To disable editing of your plugins and themes file, add the following code to your wp-config.php file define(‘DISALLOW_FILE_EDIT’, true); This will ensure that if the hacker gets access to your admin panel, they cannot access the code editor to edit the themes and plugins from Appearance> Editor or Plugins>Editor. They can add malicious code from here. For any reason you want to re-enable it back, just delete that line from the wp-config.php file.

INSTALL SSL CERTIFICATE:

This is usually mandatory for sites that process sensitive information like payments but is helpful for all sites. Google provides sites with SSL certificates for better traffic and ranking in its search results. So having an SSL certificate is worth it. It ensures secure data transfer between user browsers and the server and hackers will find it difficult to breach. Good hosting companies even sometimes provide free SSL certificates.

MODIFY FUNCTIONS.PHP FILE

By adding the following three lines of code in the functions.php file, the WordPress platform version is unreadable from the XML-RPC file. This is useful as this makes the current version of WordPress used to be hidden or unknown to hackers who are looking out for it.

remove action( ‘wp_head’, ‘wp_generator’ );  
remove action( ‘wp_head’,’rsd_link’ );  
remove action( ‘wp_head’,’rsd_link’ ); 

By adding the following two lines of code in the functions.php file, you protect yourself from giving out your wrongly spelled passwords while logging in. As these errors are saved in a log file, they can be used to gain access and the hackers could try various combinations to log in.

function no_errors_here()  
{   
return 'nothing';   
}   
add_filter( ‘login_errors’, ‘no_errors_here’ ); 

STRONG PASSWORDS:

Last but not least, use strong passwords that cannot be easily guessed. It is good to use a complex password, or even better an auto-generated one with a variety of numbers, nonsensical letter combinations, and special characters like % or @ which makes it difficult to guess.

There are many simpler tricks and advanced techniques to make your website hardened and unbreakable. These are however some of the basics that every beginner can easily follow. Website security gives you peace of mind and the more you work on taking care of the simple stuff mentioned above, makes it harder for your site to be hacked into.

Disclaimer :*Please note this post contains affiliate links, I recommend the products here only because I find them useful. The opinions in this post are all my own and based on my blogging experiences * .