DIY WordPress Security TIPS You Should Know!

Eh? Security? Yes! All this fuss about WordPress security. Having a WordPress site is great, blogging at it makes you feel like you own an Empire. But somehow, it never remains safe when intruders get in. When they try to dethrone you.

No matter what happens, you got to do what is necessary for your rule. This is a funny way to put our common life words in analogy with WordPress.

Securing your WordPress blog from the bad guys is the goal of every blogger these days. That is an issue with ultimate importance as well. But, most of the bloggers do it wrong way. They are not quite sure about choosing the best WordPress template or a plugin, where they end up with messed up blogging career with screwed up blog.

Certainly, leaving these issues behind is not an option for us anymore. So, getting to point, in this WordPress tutorial you will be learning a lot about WordPress security, how to DO IT YOURSELF and harden it to the core. Let’s kick in Yay? Nay?


Step #1 is all about how to save your blog from being hacked, by notorious login hacks.

Admin username is your doomsday

One should never have Admin or admin as the username of Administrator account. Change it while you install the WordPress. If you don’t change your username from Admin to anything else while installing, then there is a little trick that will do just good. Make a new user with different username and set its role as Administrator, then log out. Log in with the new user, you just created, go to Users >> All Users and delete the user Admin.

Some Plugins that help

In case of login hacks there are several plugins that help a lot.

Secure WordPress

With a lot of other stuff this plugin takes care of removing login notice.

Login LockDown

This plugin locks down the login screen if specific number of wrong login attempts are made by some hacker (defined in admin panel).

Google Authenticator Plugin

With Google Authenticator Plugin you can devise two way authentication. The Google Authenticator plugin for WordPress gives you two-factor authentication using the Google Authenticator app for Android/iPhone/Blackberry.

More conscious about Security?

Askapache Password protect

This plugin can be used to add .htpasswd file in wp-admin directory, so that whenever you want to access the login page you will be asked for an extra user and password. You can do this all by manual placement of .htpasswd file, through the “cPanel >>Password Protection on a Directory” option (only if you are using Linux on your hosting account and have cPanel on it).


One Time Password

This plugin sets up a password for you to use once. After that the password is deleted from the database and no one can use it to log in to your admin panel.

Still need more hack proof login page?

  • Simple Advice: Make use of a strong password e.g. v1!r2u3$4 this is virus with 1234 🙂
  • Create a file name it as .htaccess place is under /wp-admin/ directory of your WordPress and in it deny access from all other IPs except yours (it can get you into issues if you have Dynamic IP Changing)
AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "Only Admins to Access"
AuthType Basic
deny from all
# whitelistYour IP address
allow from xxxx.xxxx.xxxx.xxxx

Step#2: The wp-config paradox

This little file named as wp-config.php has utmost importance in WordPress. It is present right in the root of where you install your WordPress.

Moving it

You can move it to one step behind in your web host where no one can ever have access to it. By that I mean moving it to one level above from public_html or httdocs folder (Don’t worry if you don’t do this, your WordPress will still be fine). You should have latest version of WordPress installed before you try to move your wp-config.php file.

Changing Default Security Keys

So, I assume you have your wp-config.php file right in-front of you. It is present in the root of WordPress installation, open it and change the salt keys. You will see the text just like one below. All you have to do is open this LINK and copy what you find there, after that replace the below text in wp-config.php with the copied one.

define('AUTH_KEY', 'put your unique phrase here');
define('SECURE_AUTH_KEY', 'put your unique phrase here'); 
define('LOGGED_IN_KEY', 'put your unique phrase here'); 
define('NONCE_KEY', 'put your unique phrase here');

Step#3: Final Checks with few more Plugins

Let me tell you there is nothing final. You just need to stay up to date. Always keep checking for new threats, whereas keep your WordPress with its themes and plugins updated.

More stuff? Still thirsty? Hardening your WordPress core seems fun eh?

Change DB Prefix

Always keep your database prefix different from “wp_” you can use this handy plugin to do that

Hide your Directories

Open your .htaccess file in the WordPress root and at the top of it put this

Options -Indexes

It will keep your directory structure hidden from the others, in case you have no index.html present in them

Never satisfied with this much?

If so here are some more WordPress plugins that will make your work easier and rock solid.

WordPress Exploit Scanner

This plugin searches the files and database of your WordPress install for signs that may indicate that it has fallen victim to malicious hackers.

Theme Authenticity Checker

This plugin checks all the files of your themes to make sure they are not affected with any kind of malicious code or virus.

WP Security Scan (Recommended)

This is the plugin that I recommend to a lot of WordPress Users.

WP Security Scan checks your WordPress blog for most of the vulnerabilities that it can hold in worst cases

  • Passwords
  • File permissions
  • Database security
  • Version hiding
  • WordPress admin protection/security
  • Removes WP Generator META tag from core code

That’s all?

Nah! That isn’t all but that is good enough to make your WordPress security rock solid. In my next article over Template Monster I will discuss about Templates of WordPress. Stay tuned for more exciting stuff.

Don’t miss out these all-time favourites

  1. The best hosting for a WordPress website. Tap our link to get the best price on the market with 82% off. If HostPapa didn’t impress you check out other alternatives.
  2. Website Installation service - to get your template up and running within just 6 hours without hassle. No minute is wasted and the work is going.
  3. ONE Membership - to download unlimited number of WordPress themes, plugins, ppt and other products within one license. Since bigger is always better.
  4. Ready-to-Use Website service is the ultimate solution that includes full template installation & configuration, content integration, implementation of must-have plugins, security features and Extended on-page SEO optimization. A team of developers will do all the work for you.
  5. Must-Have WordPress Plugins - to get the most essential plugins for your website in one bundle. All plugins will be installed, activated and checked for proper functioning. 
  6. Finest Stock Images for Websites - to create amazing visuals. You’ll get access to to choose 15 images with unlimited topic and size selection.
  7. SSL Certificate Creation service - to get the absolute trust of your website visitors. Comodo Certificate is the most reliable https protocol that ensures users data safety against cyber attacks. 
  8. Website speed optimization service - to increase UX of your site and get a better Google PageSpeed score.

Ahmad Awais

Eager to learn more about working WordPress hacks? See what Ahmad highlights in his articles.

Get more to your email

Subscribe to our newsletter and access exclusive content and offers available only to MonsterPost subscribers.

From was successfully send!
Server error. Please, try again later.

Leave a Reply