7 Security Tips for your WordPress Website
Hey, y’all. Welcome to another
WordPress Wednesday. My name is Kori Ashton. Today I want to walk you through 7 awesome things that you can do today to actually go back to your
current website, make some changes, and be sure that you have great
security in place. It’s super important that you do
these things. They’re things that you might not have thought about.
Maybe one or two of them, but maybe not all of them.
They all can make a great difference in your WordPress website. Before we get started,
just want to give some love over here to three of our incredible
partners. WP Engine is an awesome hosting company. I’m going to
talk a little bit more about their services later on in this list because
they’re hosting provides incredible security that really will help
tighten up your website and be sure that nobody is getting into it. WP Elevation. If you’re an
entrepreneur, a freelancer, somebody using WordPress to
make a living, you need to jump over to their website. Check out
their different tracks. Invest in all of their awesome resources
for you because it’s going to make a difference in your company,
how you sell you product, how you offer your services. WP 101. If you’re doing WordPress
tutorials, you’re trying to watch through some YouTube tutorials,
maybe you’re not finding the quality that you want (other
than our channel, I’m sure) but maybe you’re not finding
the exact quality you want. Jump over to WP 101.
You’re going to find some incredible, up-to-date
tutorials. Just an incredible, fantastic team over there.
Check them out. Tell them Kori Ashton sent you.
I would appreciate that. That’s kind of how I show them
my appreciation for what they do for us here at WebTegrity. 7 things. Here we go. 7 things that you might not
have thought about. The very first one … You’re probably
wondering why I’m not mentioning updates first. Updates is going
to be our second one. Our very first one is your
user name and password. Whenever you establish your
account—whenever you start to build your WordPress website—
you’re going to be entering in your user name and password.
If that is something you’ve set to a generic mindset, or very
easy to hack user name and password, you’re going to get hacked.
You might think to yourself, “Why would anybody ever want
to hack my website?” You might say, “I have a website about cats
who like blogging. Nobody would ever think about hacking
my site? It doesn’t matter. There are robots out there geared
to look for outdated WordPress websites. There are hackers out
there looking to just be malicious and cruel and take over your
website. It doesn’t matter if you think, “I’m an obscure website.
Nobody is ever going to bother me.” I promise you, if you leave these
seven things that I’m talking about untouched or untended to,
you’re going to end up with a broken website at some point.
I want you to be sure that your user name and passwords are
set in place. You certainly don’t want to be using Admin as your
user name. And you certainly don’t want to have password123 or
ABCD or 123456 or whatever those passwords are that generically
get set. You want those to be locked down and tight. That’s one of the
new updates that happened in 4.3. As you can see, our website is
our of date on the updates. That is my second tip. We want to
be sure and go in and have all of our updates in place.
Let me shrink down for a minute so you can watch
the screen a little bit more. It’s saying that 4.3.1 is out.
That actually was a really huge update needed for security
purposes. They released it with an alert saying, “Please update now.”
You want to be sure to click update. Before you do all that though,
of course, you want to have backups in place so that we know
our website is secure again, and that we know we’ll have a backup
in place in case anything goes wrong or breaks. 4.3.1: Super important
that you get here if you’re not already updated to this level. There’s been a big
security issue that was release notified. Please be sure to go in, have a
backup in place, and click update. Once you do that though, now in your
profile area, they’re giving us the ability to generate a password. Whenever you
generate that, look how long this is. They’re not expecting you to remember
it. They know that you’re computer will do that for you, or that you
should be having a system that allows you to remember to automatically
save that password. They need something in your database that is locked down,
difficult for hackers to be able to get in and have. Be sure that you’re
accessing this so you don’t have to try to figure out a long involved one.
It will do it for you now. User names and passwords:
be sure that they’re tricky. You also want to be sure that all
your updates are in place, not just your core, but also you
can see this alert. It says that I have two plug-ins that need to be
updated. I want to go ahead and be sure that all of our plug-ins at all
times are completely up to date. Again, you want to be sure that
you have a backup in place so that in case any of these updates, by chance,
would break your theme or your website, you would be able to revert back
very quickly and be up and running without any down time or any loss
of edits that you may have made. Now that all of our updates are in
place. It’s still saying I have two updates. Let’s go see what it’s griping
at me about. I think I’ve got some Themes in here. Okay. So. I’ve got
some Themes sitting over here that I have installed on our server space
that are just needing to be updated. It’s not a bad idea to keep these
up to date. They’re still files that are sitting on your server space,
so it doesn’t hurt to come through here even if you’re not using the
Themes. Either remove them completely, or go ahead and update
them since they’re sitting here with their most current secure version
on your server. I do recommend having at least one extra Theme
sitting here. We’ve talked about that before for security purposes.
In case anything were to happen to your current Theme, you can
easily activate your other Theme and you’re back up and running
and at least have an access point to get back into your website
in case it breaks. Argh. That’s always frustrating. Some people ask me,
“Why are you always looking down?” I try to do these tutorial videos
in a one-take wonder so that I’m fast for you, so I have notes.
That’s why I’m looking down here. I can’t always remember things. I do want to talk about your
comments and your spam. A lot of people, especially if
you’re using your website as a blog, struggle with having a
lot of spam hit their comments area. There are some things you can
go into with your settings. You can go into Settings and
go into Discussion. You can just read through these things.
You need to see that it starts over here. The sentence starts on the left side.
This is a little difficult because sometimes people just read down through here.
It says, “Anyone can post a comment.” Yes, we want anyone to post a comment,
but that’s not the full sentence. It says, “Email me whenever anyone
posts a comment. Email me whenever a comment is held for moderation.”
The sentence starts here. Read through all these. Be sure that “Before a comment appears,
comments must be manually approved.” You can click that. You can do all sorts
of things where you’re hiding certain comments if they contain certain
words. You can black list certain comments with any sort of words.
You can require that the user have an account and be logged in to comment.
You can require all these things. I would just suggest go through here,
see exactly how you want to work these, and make those suggestions, and
click Save Changes. And, also, any comments that do come through,
be sure that you’re moderating them. Go to your Comments section and be
sure to approve or spam them. You’ll have a whole list here and
typically an alert that says, “Yes, approved.” Or “Yes, we should
trash that comment.” Okay. Keep that in place. If you’re using comments in a comment
section, or you might have a contact form as well, what I would like to
suggest you do is a lot of people don’t like the captchas. You know
those things where you have to fill in the numbers for the code and
prove that you’re not a robot, that you’re a human. One of the things
that Gravity Forms has … If you don’t know what Gravity Forms is, check out
our tutorials. I’ve got a whole list of Gravity Forms videos that you
can figure out this awesome premium forms plug-in. You can go to Form
Settings. Each individual form you have to do this. Go to Form Settings and
there is an anti-spam honey pot. If you click that and enable that,
what it does is (it will tell you right here if you hover over the little
question box here) it will tell you that it basically gives you a hidden
field that robots don’t realize is hidden. The robots will fill it out.
And you’ll know automatically that it is a robot instead of a human
and it will trash it/spam it and not allow it to publish. That’s brilliant!
And well worth the premium price that you pay for Gravity Forms. The last few things that I want to
run through. We want to talk about a plug-in that you can throw on your
website. It’s a free plug-in. It does have a pro version but it’s
phenomenal even in its free version. You’re going to go to plug-ins and
add new. I’m going to slide off the screen so you can just watch
and see exactly what I’m doing. You’re going to do a search plug-ins
for Sucuri. That’s the name of it. You want to be sure and get the one
that has the 100,000+ installs. You install that one. And walk through
all the settings and be sure that you’ve got this locked down, in place.
It’s totally free to use. It does have an upgraded version, but this is
phenomenal. Immediately you’ll start to be able to run tests and be
sure that your website has not been hacked, that you don’t have any
malware sitting on your site, and that everything is good to go.
You just have to generate an API key. Again, it’s free though for
you to do that. That’s a great plug-in that we highly recommend. The other
thing that I wanted to mention about is WP Engine. If you don’t have really
great hosting in place, they’re not going to alert you to things that are
going on in the WordPress world. That’s why we love WP Engine.
I’ll take you over to their site really quickly so you can see
how incredible they are. These guys are just fantastic.
They only do WordPress websites. Their server support guys are just
amazing. If you have any questions, you can come over here to the Chat
and start chatting with them. It is more expensive than an average
$5 [US] hosting. It doesn’t matter though. This alert that came out that 4.3.1
that was a huge security alert, they automatically pushed through
all the updates on our websites that we knew for a fact that they
were locked down and secure. If there’s a plug-in out there that
the WordPress world alerts and says, “Hey. This plug-in is now susceptible
to hacks. It’s bad if you’re running this version,” WP Engine watches WordPress
and they will lock down that plug-in. Or send you an email really quickly
and tell you, “Hey. You’re using that plug-in. Did you know that it is
susceptible to hacks? You need to update.” It’s fantastic service. Well worth the
invested money. If you’ve ever called your hosting company and they go,
“I don’t know how to help you. That’s a WordPress issue.”
That conversation will never happen inside of WP Engine.
They will always tell you, “We know exactly what’s going on.
Let me help you.” because they only know WordPress. That’s incredible, right?! We love them. They’re amazing. If you don’t want to change
hosting companies, I’m going to challenge you to go after a secure
socket layer, or SSL (secure server license). Whatever you want to call it,
that’s what you need to go after. It’s about $50-$80 [US] a year.
Invest in that. Put that on your website. What it’s going to do is it’s going
to change your address to be https:// and then whatever your
domain name is. It puts a secure lock around your website so that
any sort of interaction that happens on your website—somebody sending
you an email, somebody typing in their contact information, somebody
typing in a registration form or a credit card or a donation amount—
all that is now a secure transaction coming through email. Really important
to have that on your website. Google likes seeing that as well. Last but not least, the 7th thing
that I want to talk to you about is your backups. That’s another reason
why we absolutely love WP Engine. They’re allowing you to do all sorts
of really great stuff when it comes to backing up. They automatically
backup not only your files but also your database. You can set that to
be backed several times a day, or daily, or weekly, or however
often you’re making changes and you want to have a fresh backup
in place. You can set that up automatically to happen with one
click [snap of the fingers] you can restore your website back to where
it was. No more freaking out about “I’ve lost my website!”
They’ve got a safety net in place that’s just phenomenal.
If you don’t want use WP Engine, I’m going to give you a free opportunity
with a plug-in called Updraft Plus. Let’s go over here and Add New.
You’re going to be looking for this plug-in: Updraft Plus is the name of it.
It is free. It does a backup for you. It’s pretty fantastic. I’ve got to say
it has saved some of our clients who are not hosting on WP Engine.
Pretty fantastic. Plug that in. Walk through the setup on that.
And be sure that you have a backup in place. If you love this video, be sure to click
this little bitty Play button right here. Click that. You’re going to subscribe to our channel and every single Wednesday
we’re going to be releasing a really cool WordPress video for you to
watch and hopefully help grow your website. If you have any questions,
be sure to put them in the description box below. Share this video. Help us out.
We’re going to keep coming back every single Wednesday. Have a great day, y’all. Bye bye.