# WordPress security

> Protect your WordPress site with strong logins, updates, backups, security plugins and other essential measures.

Source: https://helpcenter.ruachost.com/ssl-security/website-security/wordpress-security/

WordPress is the world’s most popular content management system (CMS), which makes it a frequent target for hackers. Securing your WordPress site is essential to protect your data, maintain uptime, and preserve customer trust.

## Essential WordPress Security Measures

### 1. Strong WordPress Passwords

- Use long, complex, and unique passwords for all administrator accounts.
- Change passwords periodically.
- Weak passwords are easily guessed and vulnerable to brute‑force attacks.

### 2. Unique WordPress Username

- Avoid using the default `admin` username.
- Create a new administrator account with a unique username.
- Delete the default `admin` account after migration.

### 3. Update WordPress, Plugins, and Themes

- WordPress releases regular updates to patch vulnerabilities.
- Outdated plugins and themes are common entry points for attackers.
- Always run the latest versions of WordPress core, plugins, and themes.

### 4. Delete Unused Plugins and Themes

- Even disabled plugins/themes expose code that hackers can exploit.
- Remove unused components to reduce attack surface.

### 5. Regular Backups

- Backups won’t prevent attacks but allow quick recovery.
- Use tools like **Softaculous** or other backup plugins.
- Store backups securely offsite or in the cloud.

## Defending Against Brute Force Attacks

Brute force attacks attempt to guess login credentials by repeatedly trying combinations of usernames and passwords. To defend against them:

### Method #1: Password‑Protect the WordPress Login Page

- Add password protection to `wp-login.php` using `.htaccess`.
- This adds an extra authentication layer before WordPress login.

### Method #2: Block IP Addresses

- Restrict access to `wp-login.php` by allowing only specific IPs.
- Configure `.htaccess` rules to deny all other IPs.

### Method #3: Change the WordPress Login URL

- Install the **Rename wp-login.php** plugin.
- Change the default login URL to something unique.
- Attack scripts targeting `wp-login.php` will fail.

### Method #4: Enable Cloudflare

- Cloudflare blocks malicious requests before they reach your server.
- Provides DDoS protection and performance optimization.

> **Note:**
- If your site is compromised, change both passwords and **security keys** in `wp-config.php`.
- Always test login functionality after applying restrictions.
- Combining multiple methods provides stronger protection.