WordPress Security Mistakes

/, WordPress/WordPress Security Mistakes

WordPress Security Mistakes

WordPress is the most popular website builder. It’s free, easy to use, and has powerful features and plug-ins that make it a flexible, preferred choice for website design. No matter what content management system you choose for your website, security should be a top priority. Security vulnerabilities can come from both the WordPress core and the plugins you use. Harden your website against security weakness by avoiding these WordPress security mistakes.

WordPress Security Mistake #1

Weak Passwords

Always use a strong password, with a combination of numbers, letters, special characters, and capitalization. Use a strong password generator.  Do not use this password anywhere else. Store your passwords securely in a password manager like LastPass.

WordPress Security Mistake #2


Login forms need a plugin form such as reCAPTCHA to prevent spam entries and brute force attacks.

WordPress Security Mistake #3

Not Using Two-Factor Authentication

Adding a two-step process means that the password alone will not give access to the site. A text, phone call, or time-based one-time password will be issued to prevent brute force attacks.

WordPress Security Mistake #4

Keeping the Login Page as the Default Admin URL

This is the first way hackers will attempt to access your login page. Change it from /wp-admin to avoid easy access.

WordPress Security Mistake #5

Using Outdated Software, Themes, and Plugins

When these things aren’t up-to-date, rogue code can be inserted and your site can be compromised, search engine results affected, and your site may even be blocked by Google for distributing spam. Regularly update your WordPress software, themes, and plugins to prevent this. In addition, older website versions can cause your site to break. These updates typically include bug fixes and security patches. Almost 56% of hacked WordPress sites are compromised through outdated plugins. Find out the basic WordPress plugins you need here.

WordPress Security Mistake #6

Not Limiting Login Attempts

Do not give hackers or bots unlimited tries to guess your password. Use a plugin that limits login attempts. Limit Login Attempts Reloaded will block IP addresses after a specified number of failed attempts.

WordPress Security Mistake #7

Not Using an SSL Certificate

An SSL certificate runs your site on HTTPS. This maintains a secure connection between your site and the browser. Some think that an SSL certificate is only needed for eCommerce sites dealing with sensitive information, but in reality, all sites should run using HTTPS for necessary security. HTTP does not encrypt data, so sensitive data is at risk of exposure.

WordPress Security Mistake #8

Not Backing Up Your Site

Backups are essential, especially if your website is compromised. You will have to pay a monthly fee for this, but without backups if your site is compromised you could lose everything permanently. An infected site that isn’t backed up must be restored manually, a time-consuming process that won’t restore erased data. Use a plugin or a hosting service such as HostGator that provides backup plans https://www.hostgator.com/codeguard-portal

WordPress Security Mistake #9

Not Disabling Unnecessary Features

Disable plugins and features you no longer use, as these are vulnerable to brute force attacks.

Avoiding these WordPress security mistakes hardens your site against hackers and bots that are constantly looking for website vulnerabilities. In addition to vigilant WordPress security measures, your employees should be trained to recognize phishing attacks and practice other forms of cybersecurity

About the Author:

Sheri Holshouser is a marketing manager based in Dallas, Texas. In her free time, she likes to read science fiction novels and play with her pug Chloe. Learn more about her professional qualifications on LinkedIn.