How to prevent your WordPress website from getting hacked like a PRO

[Escanor64]

I created a "shallow" thread about preventing your WordPress sites from getting hacked or being injected with malicious codes one time which surprisingly, many found to be very valuable and helpful. This time around, I will share my experience with the method I adopted after my websites were hacked severally.

I will also be sharing the plugins I used in securing my website, all of which I downloaded from Babiato here. Note that this applies to corrective and preventive sites. In order words, if your site has been hacked or you just would love to secure your site to prevent it from being accessed by hackers.

First, the needed plugins, where to download them on the forum and how necessary they are for the purpose of securing your website like a Pro:

S/N	Plugin Name	Purpose	Comment	Download Link
1	WordFence Pro	Malware scanning, detection and removal	IMPORTANT!	WordFence Pro Download
2	Defender Pro	Mask login page, harmful bots banning, XML-RPC disabling, disabling file editor, updating old security keys, user agent banning, IP banning, login protection.	IMPORTANT!	Defender Pro Download
3	Permatters Pro	Site speed optimization and tune up.	RECOMMENDED!	Permatters Pro
4	Sucuri	File change detection	OPTIONAL!	WordPress Repository

WordFence Pro:

WordFence Pro is needed for the sake of this process in order to be able to clean your website in the event that it has been hacked. For the record, WordFence's purpose is a whole lot and almost similar to Defender Pro, if not more. However, WordFence will be restricted to malware detection, scanning and removal or repair of hacked files. The free version can also work but it skips some parts of the scan process.

To use it, first, download the plugin from the link above, set it up and navigate to the scan page to scan your website. Allow the scan to be completed. If it catches malwares or malicious codes, repair the files and folders they were injected into or delete them if they are not the default WordPress files or folders. After this is done, click "UPDATES" under "DASHBOARD" and reinstall the latest version of WordPress. When this done, you are ready to move on to the next phase.

PS: WordFence is a very solid plugin but the alerts sent when there is a brute force attack can be annoying, which is why we only need WordFence for malware scan and fixes.

Defender Pro:

Defender Pro is a super solid plugin and most of what you will do to secure your website lies with this plugin. When you have installed it, start with the security recommendations:

1. Disable File editor (You want to make sure hackers that find a way into your site's backend do not inject or lace your root files with terrible codes that will destroy your blogging or business career).
2. Disable XML-RPC (This is the most crucial thing to disable on your WordPress website. If you don't disable it and follow all the steps on this thread, your site will still get hacked. Disabling the XML-RPC will make sure hackers cannot communicate remotely with your website and brute force your site. I shared a code on the other thread to include in your function.php file but with Defender Pro, you do not need the code. The plugin handles it just perfectly.
3. Update old security keys (WordPress Salt and Security Keys are a big deal for those who are neck deep in security. Thankfully, with Defender Pro, you can effortlessly change your WordPress SALT and Security Keys every 30, 60, 90 days and so on. The plugin does it automatically, meaning you don't have to revisit it every time. You can learn more about WordPress SALT and Security Keys here.
4. Login Protection (Here, you can ban certain usernames such as the generic "admin", "user" or "administrator" usernames and set them to "permanent" such that if anyone tries those usernames, they are banned permanently, unlike that of WordFence where you have to manually mark and place blocked usernames in a ban.
5. User Agent Banning (I didn't know this was a big deal until I started using Defender Pro. For anyone who knows, user agents such as MJ12Bot, AhrefsBot, SEMrushBot,, and DotBot are all used to hack websites and eat up your server's resources. Typically, this is included in AISEOP but free to use here. You can also whitelist search engine bots from the list of bots to exclude from querying your site.)
6. Mask Login Area (You should activate this under "Tools" in Defender Pro. The default login area of WordPress sites is .com/wp-admin. Anyone who gets this login area can launch attacks of any any kind. However, if the login area is masked (for instance, example.com/nutricionales, only those who know that "nutricionales" is the extra link added to your site will and can access the page. With WordPress, if they don't know your login area, it is nearly impossible to manually hack your website.)
PS: Be sure to write the new login URL somewhere you won't lose it.
7. Security Headers (For extra layer of protection, you can turn on security headers. I personally recommend turning on X-Frame Options, X-XSS Protection, leave it at "Sanitize" and Enable X-Content-Type Options, particularly for sites that allow users upload gifs, images through comments or other places.

That should be all concerning Defender Pro!

Perfmatters Pro:

If your website has been hacked before, you'll agree that you experience slow response time, no matter how hard you try. You can use Perfmatters to optimize and speed up your site. Don't get tempted and turn on every feature. Some of them may end up hurting your site more than they can help. The most important is that YOU SHOULD NOT DISABLE YOUR RSS FEEDS OR REMOVE RSS FEED LINKS. If you do and you use Google News or Opera News, your site will suffer a terrible set back.

You should hide your WordPress version, disable emojis (if you are not using some fancy theme that requires emojis to work), Disable Embeds, Remove jQuery Migrate, and some other features that are not useful to WordPress.) Save this when you are done and that's it with enhancing your site's security and optimizing your site speed. You can use Perfmatters alongside a cache plugin.

What to Note!
Just because your site is fully secure does not mean you should not update your plugins and themes constantly. As a matter of fact, they are part of the ongoing process of securing your website. If you feel your site was at some point compromised, go ahead and change your database password, DirectAdmin or cPanel login details and finally your site's password. Remember to update your details in the wp-config file. With all of these is place, your site is FULLY SECURED! DO NOT USE THE RECAPTCHA ON DEFENDER PRO ON YOUR LOGIN PAGE. YOU WILL GET LOCKED OUT OF YOUR SITE!

As earlier mentioned, WordFence is a packed plugin. The downside is the crazy alerts. You're more likely to get locked out of your site easily if you make a mistake.

Defender Pro towers above plugins such as WP Hide Security Enhancer Pro and Hide My WP. I have used them in the past and I hate them because they do not exactly keep your .htaccess file simple. What's worse is that your site could go down if you rename your .htaccess file or want to generate a new one to troubleshoot a problem, which invariably means that you will be required to go through the same steps all over again.

All the best with adding that 100% layer of security!

 

[MusoniusRufus]

I find that Defender Pro is redundant there.

With both Perfmatters and Wordfence, you can achieve 95% of what that plugin does, and you don't need to overload a system that is, by itself, enough overloaded.

 

[lachhab]

The issue i experimented with most of the security plugins is that they're resource-hungry.

 

[alexhost]

I don't recommend those plugins will struggle with your CPU and RAM a lot.
Don't forget that plugins also have vulnerabilities and security issues which can be also a hole to hackers.

Now a days I see many people using many plugins thinking that will protect it won't.
Always make good hygiene pratice and avoid huge of "security plugins".

One is enough. However, it won't prevent you from being hacked

 

[Escanor64]

I don't recommend those plugins will struggle with your CPU and RAM a lot.
Don't forget that plugins also have vulnerabilities and security issues which can be also a hole to hackers.

Now a days I see many people using many plugins thinking that will protect it won't.
Always make good hygiene pratice and avoid huge of "security plugins".

One is enough. However, it won't prevent you from being hacked

Other than WordFence, Defender Pro and Perfmatters are not resource intensive plugins. From their sizes down to operations. I personally love WordFence but seeing how it impacts on my sites have made me to opt for Defender Pro. The essence of trimming the whole thing down to size in the first place is why Perfmatters is included.

 

[Ekushey]

I wonder, why isn't XML-RPC not disabled by default? Also, I believe Jetpack and some other plugins like ManageWP can't work with it?

 

[Escanor64]

I wonder, why isn't XML-RPC not disabled by default? Also, I believe Jetpack and some other plugins like ManageWP can't work with it?

If you disable through other plugin, Jetpack may not work as should. If you disable through Defender Pro, Jetpack will work perfectly.

There are so many WordPress features that are exactly not needed by most website owners/bloggers but the WordPress team thought to keep them anyways. These features, in turn, are exploited by hackers to remotely access your site(s) without you knowing it.

 

[Escanor64]

I find that Defender Pro is redundant there.

With both Perfmatters and Wordfence, you can achieve 95% of what that plugin does, and you don't need to overload a system that is, by itself, enough overloaded.

Not true at all. WordFence isn't exactly lightweight. All Wordfence features are found in Defender Pro. Plus, the downside of Wordfence is the ridiculous alerts it sends via email when you face brute force attacks. I have since deactivated and deleted Wordfence from my sites and use only defender pro, with all security features maxed out. Why I recommended Wordfence here is only to deep scan and repair compromised files. Other than that, Defender Pro's features, particularly with security and headers, masking logging areas and user agent banning are some of the very few features that make Defender Pro a go-to choice compared with Wordfence.

When thinking about your site's speed, you'd find out easily that Wordfence isn't exactly a great choice.

 

[Ekushey]

There are so many WordPress features that are exactly not needed by most website owners/bloggers but the WordPress team thought to keep them anyways. These features, in turn, are exploited by hackers to remotely access your site(s) without you knowing it.

That makes sense! I never used Defender Pro before (never heard of it actually), but since you recommended it, I'll check it out. Thanks.

 

[DEBAKID]

The issue i experimented with most of the security plugins is that they're resource-hungry.

I think one is enough. Loading all these will make your site slower. Even one of them will cause your site slow

 

[🅰🅳🅸🆃🆈🅰]

HEY
laughing from inside
i will not write much but you need to learn alot about the term security

wordfence + defender pro + etc...
again laughing on you
ok lets come to point
haching is like if happen no one can stop it by using peices of codes to protect peicessss of code.
if someone wants to hack your site he will do it you cant do anything to stop unless you r also some kind of techy/hacking guy

my 2+ years of experince combing with others wp masters in security i dont remember all things

what you can do it (dont remember all but in case,)
to have clouflare[firewall with 5 free rules you can setup with login condition to your wp blog ] + good hosting + secure plugins/themes + alt user other to login + backup of your site

you only need one plugin to detect any malware and remove it GOTMOL better then any plugin in market and its free then you can strength your site using .htacess and other lot of things
just read site of blackhole plugin owner he is really master

 

[lachhab]

I think one is enough. Loading all these will make your site slower. Even one of them will cause your site slow

Sorry if I wasn't clear in my input.
I used ithemes and wordfence individually on a shared hosting server and I noticed a high CPU usage.
There are many articles you'd find around which mentions this particular issue.

 

[emmsana]

Hi bro.

Good morning guys
Please I am having serious security challenges since I migrated my websites from namecheap to inmotion vps.

I have used wordfence to delete and repair several files but it keeps repeating.

I have also reinstalled the WP core files of individual website.
Check the attachment

 

[Escanor64]

Hi bro.

Good morning guys
Please I am having serious security challenges since I migrated my websites from namecheap to inmotion vps.

I have used wordfence to delete and repair several files but it keeps repeating.

I have also reinstalled the WP core files of individual website.
Check the attachment

Just repairing your files won't fix the problems. Try these:

1. Change your database password and update it in your wp-.config file.
2. Change cPanel login details.
3. Disable your XML-RPC file.
4. Change your SALT Keys using Defender Pro and Update them frequently using settings on the plugin.

 

[Niji]

I created a "shallow" thread about preventing your WordPress sites from getting hacked or being injected with malicious codes one time which surprisingly, many found to be very valuable and helpful. This time around, I will share my experience with the method I adopted after my websites were hacked severally.

I will also be sharing the plugins I used in securing my website, all of which I downloaded from Babiato here. Note that this applies to corrective and preventive sites. In order words, if your site has been hacked or you just would love to secure your site to prevent it from being accessed by hackers.

First, the needed plugins, where to download them on the forum and how necessary they are for the purpose of securing your website like a Pro:

S/N	Plugin Name	Purpose	Comment	Download Link
1	WordFence Pro	Malware scanning, detection and removal	IMPORTANT!	WordFence Pro Download
2	Defender Pro	Mask login page, harmful bots banning, XML-RPC disabling, disabling file editor, updating old security keys, user agent banning, IP banning, login protection.	IMPORTANT!	Defender Pro Download
3	Permatters Pro	Site speed optimization and tune up.	RECOMMENDED!	Permatters Pro
4	Sucuri	File change detection	OPTIONAL!	WordPress Repository

WordFence Pro:

WordFence Pro is needed for the sake of this process in order to be able to clean your website in the event that it has been hacked. For the record, WordFence's purpose is a whole lot and almost similar to Defender Pro, if not more. However, WordFence will be restricted to malware detection, scanning and removal or repair of hacked files. The free version can also work but it skips some parts of the scan process.

To use it, first, download the plugin from the link above, set it up and navigate to the scan page to scan your website. Allow the scan to be completed. If it catches malwares or malicious codes, repair the files and folders they were injected into or delete them if they are not the default WordPress files or folders. After this is done, click "UPDATES" under "DASHBOARD" and reinstall the latest version of WordPress. When this done, you are ready to move on to the next phase.

PS: WordFence is a very solid plugin but the alerts sent when there is a brute force attack can be annoying, which is why we only need WordFence for malware scan and fixes.

Defender Pro:

Defender Pro is a super solid plugin and most of what you will do to secure your website lies with this plugin. When you have installed it, start with the security recommendations:

1. Disable File editor (You want to make sure hackers that find a way into your site's backend do not inject or lace your root files with terrible codes that will destroy your blogging or business career).
2. Disable XML-RPC (This is the most crucial thing to disable on your WordPress website. If you don't disable it and follow all the steps on this thread, your site will still get hacked. Disabling the XML-RPC will make sure hackers cannot communicate remotely with your website and brute force your site. I shared a code on the other thread to include in your function.php file but with Defender Pro, you do not need the code. The plugin handles it just perfectly.
3. Update old security keys (WordPress Salt and Security Keys are a big deal for those who are neck deep in security. Thankfully, with Defender Pro, you can effortlessly change your WordPress SALT and Security Keys every 30, 60, 90 days and so on. The plugin does it automatically, meaning you don't have to revisit it every time. You can learn more about WordPress SALT and Security Keys here.
4. Login Protection (Here, you can ban certain usernames such as the generic "admin", "user" or "administrator" usernames and set them to "permanent" such that if anyone tries those usernames, they are banned permanently, unlike that of WordFence where you have to manually mark and place blocked usernames in a ban.
5. User Agent Banning (I didn't know this was a big deal until I started using Defender Pro. For anyone who knows, user agents such as MJ12Bot, AhrefsBot, SEMrushBot,, and DotBot are all used to hack websites and eat up your server's resources. Typically, this is included in AISEOP but free to use here. You can also whitelist search engine bots from the list of bots to exclude from querying your site.)
6. Mask Login Area (You should activate this under "Tools" in Defender Pro. The default login area of WordPress sites is .com/wp-admin. Anyone who gets this login area can launch attacks of any any kind. However, if the login area is masked (for instance, example.com/nutricionales, only those who know that "nutricionales" is the extra link added to your site will and can access the page. With WordPress, if they don't know your login area, it is nearly impossible to manually hack your website.)
PS: Be sure to write the new login URL somewhere you won't lose it.
7. Security Headers (For extra layer of protection, you can turn on security headers. I personally recommend turning on X-Frame Options, X-XSS Protection, leave it at "Sanitize" and Enable X-Content-Type Options, particularly for sites that allow users upload gifs, images through comments or other places.

That should be all concerning Defender Pro!

Perfmatters Pro:

If your website has been hacked before, you'll agree that you experience slow response time, no matter how hard you try. You can use Perfmatters to optimize and speed up your site. Don't get tempted and turn on every feature. Some of them may end up hurting your site more than they can help. The most important is that YOU SHOULD NOT DISABLE YOUR RSS FEEDS OR REMOVE RSS FEED LINKS. If you do and you use Google News or Opera News, your site will suffer a terrible set back.

You should hide your WordPress version, disable emojis (if you are not using some fancy theme that requires emojis to work), Disable Embeds, Remove jQuery Migrate, and some other features that are not useful to WordPress.) Save this when you are done and that's it with enhancing your site's security and optimizing your site speed. You can use Perfmatters alongside a cache plugin.

What to Note!
Just because your site is fully secure does not mean you should not update your plugins and themes constantly. As a matter of fact, they are part of the ongoing process of securing your website. If you feel your site was at some point compromised, go ahead and change your database password, DirectAdmin or cPanel login details and finally your site's password. Remember to update your details in the wp-config file. With all of these is place, your site is FULLY SECURED! DO NOT USE THE RECAPTCHA ON DEFENDER PRO ON YOUR LOGIN PAGE. YOU WILL GET LOCKED OUT OF YOUR SITE!

As earlier mentioned, WordFence is a packed plugin. The downside is the crazy alerts. You're more likely to get locked out of your site easily if you make a mistake.

Defender Pro towers above plugins such as WP Hide Security Enhancer Pro and Hide My WP. I have used them in the past and I hate them because they do not exactly keep your .htaccess file simple. What's worse is that your site could go down if you rename your .htaccess file or want to generate a new one to troubleshoot a problem, which invariably means that you will be required to go through the same steps all over again.

All the best with adding that 100% layer of security!

What about WP All in one security plugin??

 

[alexhost]

Just repairing your files won't fix the problems. Try these:

1. Change your database password and update it in your wp-.config file.
2. Change cPanel login details.
3. Disable your XML-RPC file.
4. Change your SALT Keys using Defender Pro and Update them frequently using settings on the plugin.

Why using plugins to change salt keys when you can do that manually?
That can create more "holes" on security of website.

Avoid plugins at all, if you can do manually perfect.

Hi bro.

Good morning guys
Please I am having serious security challenges since I migrated my websites from namecheap to inmotion vps.

I have used wordfence to delete and repair several files but it keeps repeating.

I have also reinstalled the WP core files of individual website.
Check the attachment

Use old backup, restore the website, disable wordfence and don't repair anything.
Try to use a clean backup, sometimes "security plugins" does and committs errors which can be very bad for your side.

We suggest avoid plugins at all. Use the plugins that you need. The security comes through VPS not from plugins (Plugins can help also, but not entire!)

Best Regards,
Alexhost

 

[Niji]

Why using plugins to change salt keys when you can do that manually?
That can create more "holes" on security of website.

Avoid plugins at all, if you can do manually perfect.


Use old backup, restore the website, disable wordfence and don't repair anything.
Try to use a clean backup, sometimes "security plugins" does and committs errors which can be very bad for your side.

We suggest avoid plugins at all. Use the plugins that you need. The security comes through VPS not from plugins (Plugins can help also, but not entire!)

Best Regards,
Alexhost

Not agree... it depends upon the security plugin

 

[Escanor64]

Why using plugins to change salt keys when you can do that manually?
That can create more "holes" on security of website.

Avoid plugins at all, if you can do manually perfect.


Use old backup, restore the website, disable wordfence and don't repair anything.
Try to use a clean backup, sometimes "security plugins" does and committs errors which can be very bad for your side.

We suggest avoid plugins at all. Use the plugins that you need. The security comes through VPS not from plugins (Plugins can help also, but not entire!)

Best Regards,
Alexhost

I don't agree with the bulk of your submission. "Manually" isn't a bad idea but when there is a frequency to changing that, then it is recommended to use a security plugin that handles your core security. VPS can't exactly save a WordPress website from getting hacked. WordPress is the most used CMS in the world and its sheer use means you'll be drawn to hackers and loopholes.

VPS use won't save you from getting hacked on WordPress.

 

[TylerD]

After a lot of research and searching for the best way to protect WordPress without compromising performance I follow YouTube video advice and drop Wordfence for iThemes security + BBQ Firewall.

How to secure your WordPress website

Good defence + low performance impact

 

[emmsana]

After a lot of research and searching for the best way to protect WordPress without compromising performance I follow YouTube video advice and drop Wordfence for iThemes security + BBQ Firewall.

Good defence + low performance impact

Bro can you explain the setup of iThemes security + BBQ Firewall?

Or refer to the YouTube video you followed.
Thank you