I am very particular about security, so I shall be sharing with us over the next few lines, a few blog security tips and tools for website security.
The tips are so that your site is always safe secure and “almost” unhackable… The tools are for you to test the security of your site (and maybe of others too, so use these tools at your risk please – they are for educational purposes only)
I blog on WordPress, but the general ones should work for other CMSes, but don’t crucify me if most of my talk is about WP.
- Always stay up to date. Update your WordPress installation, your plugins, and your themes (sorry users of ‘cracked’ themes and plugins that can’t update, you have to buy :-P)
- If you don’t use a plugin, delete it. I repeat, do not just deactivate it, DELETE IT. The presence of inactive vulnerable plugins alone can affect the entire site security. It applies to themes too (but not always)
- Hide your sensitive WordPress files e.g. wp-config.php, htaccess, wp-admin. I’ll explain how to do that in the tools section
- Generate complex secret keys for your wp-config.php file
- Get a WordPress security plugin. I personally recommend Better WP Security plugin. It helps to solve majority of your WordPress security problems like hiding your sensitive WordPress files, generating complex secret keys for your wp-config.php file, renaming your wp-content folder, disabling/deleting the default admin, restricting access to the dashboard to selected IP addresses, and many more. If you have a better security plugin, you could leave a comment below
- Scan your wordpress site for vulnerabilities. There are software to do this. I recommend Acunetix for Windows and probably Mac (free trial). If you use Android, try to ‘hack’ your site with a tool called WPScan. It’s free. If you want an online version, try Sucuri’s ScanWP and Malware Scanner to scan your site for possible malware
If you have any good security tools, please feel free to share too, and If you have any questions or additions, please leave a comment