[VGMarketing]

Making a wordpress website but is it actually secure because I've heard from a lot of people they are very insecure and can easily be hacked into.

[Truth]

depends what kind of site you are building. A small ecommerce, blog, info site will do fine.


I build wordpress sites and never really had a problem. Sure skids try to hack in but they are just skids, move on

[Rushax]

If you take all the necessary precautions, you'll be fine.
Different username apart from 'admin' or 'website name'
Strong & lengthy password (for database and dashboard login)
Install WordFence Security and do regular scans
Don't install nulled themes/outdated plugins
Keep WordPress & all plugins up-to-date

Additional:
- Upgrade WordFence security for a fee to deliver up-to-date updates & scans
- OR if you're very worried, purchase https://sucuri.net/ to monitor & protect your site.

[hdaackda]

It depends. Yes, its VERY secure if you have taken the precautions. Like keeping your themes/plugins updated AND getting a good safety plugin like WordFence (the free version is enough... but such a plugin does take up a lot of resources on your server.)

I personally don't use any such plugin, but keep my server updated. Oh and I also use cloudflare, which you can use too (hides your IP, protects against Ddos). The free version is very good.

and I learned it the hard way. ALWAYS keep a backup. ALWAYS. Regular backups will help

[Rushax]

Just two more things to add:
Make sure all directory permissions aren't accessible such as
http://example.com/wp-content
http://example.com/wp-content/themes
These should direct all users to a 404 page, and not show a directory of all files.

Another important thing is the login page, you can always use a plugin to redirect the login to another URL instead of the common two:
http://example.com/wp-admin
http://example.com/wp-login

And you can also edit your functions.php file inside to get rid of the error messages saying:
'Invalid Username' <-- Meaning its not the right username
'Incorrect Password for Username: admin' <-- I've found the admin's username now just to bruteforce the password
As these give off big hints if someone is trying to find the login credentials.

Code

function no_wordpress_errors(){
  return 'Something is wrong!';
}
add_filter( 'login_errors', 'no_wordpress_errors' );

Combine this with regular scans, updates & backups and I'm sure you'll be fine.

~Last one, I promise :)
Go through WordFence settings & edit the amount of password attempts to like 3.

[hdaackda]

Just two more things to add:
Make sure all directory permissions aren't accessible such as
http://example.com/wp-content
http://example.com/wp-content/themes
These should direct all users to a 404 page, and not show a directory of all files.

Another important thing is the login page, you can always use a plugin to redirect the login to another URL instead of the common two:
http://example.com/wp-admin
http://example.com/wp-login

And you can also edit your functions.php file inside to get rid of the error messages saying:
'Invalid Username' <-- Meaning its not the right username
'Incorrect Password for Username: admin' <-- I've found the admin's username now just to bruteforce the password
As these give off big hints if someone is trying to find the login credentials.

Code

function no_wordpress_errors(){
  return 'Something is wrong!';
}
add_filter( 'login_errors', 'no_wordpress_errors' );

Combine this with regular scans, updates & backups and I'm sure you'll be fine.

~Last one, I promise :)
Go through WordFence settings & edit the amount of password attempts to like 3.

thanks! the functions.php hint was great!

[Rushax]

thanks! the functions.php hint was great!

You're welcome ✌

[BanditDev]

On my big sites, I use a plugin called 'Hide My Wp' and that changes the file directories of everything (theme folder, plugins folder etc etc). Also if you were to use one of those Wordpress theme detectors tools, it will tell you that my sites are not wordpress. It is paid for though.

[ajay maanju]

sir its true hacking rate is more in wordpress website in comparison of custom code website that reason mostly make website in custom code where payment involved . But in wordpress also both e commerce store we developed that are secure but ou need to change wp admin password regularly.I am exprience more than 4+ year in wordpress and developed more than 300+ website but 90 percent are secure .

---

so any more help you need let me know .

[Ganja]

I don't know if this is still relevant, but here's a helpful tip:

There's 2 plugins I usually use on most WordPress websites, which will stop 97% of the attacks:

-WordFence free (scans files, emails you when anything has changed, stops a lot of automated attacks).
-Hide My WP (this plugin costs like 10$ on codecanyon, but it definetly worth it. It's easy to setup and hides the fact that you use wordpress, so almost all automated scans won't detect your website as a WordPress website.

Goodluck!

[Rushax]

Sounds like a really good plugin actually Royal, can you use it on multiple sites or 1 install/site.

[Shroomies_temp]

Making a wordpress website but is it actually secure because I've heard from a lot of people they are very insecure and can easily be hacked into.

Just my few words.
Every "open source" script you might find, will have the same pros/cons regarding security.
The fact that its open source (everyone can view code) leads to possibility of a "bad" person finding a bug in the scripts and using it.
But also, at the same time, there's a possibility that "good" person that will find the bug and patch it before someone else uses it. :)
The most important thing is to update scripts often, as most of the attacks happen on old, outdated versions which still havent fixed common bugs.

If you don't have a budget for completly custom script, sticking to "open source" scripts is not a bad idea (definetly more secure than hiring a 5$/hour programmer to do a "custom" work 😅), just remember to update it as soon as updates pop. Also, sticking to more "matured" scripts (wp/joomla) is probably a better idea for a start than finding something "new" that just came out of beta. :)

[jsmith492]

There are literally tons of ways to make a site more secure. Obviously as mentioned before, easy ways of making things a little better are not using common admin login creds. Make a limit of incorrect login attempts before account is locked. It's not convenient but two-step authentication is a possibility. As was mentioned, change your login pages to something unique.

Secure your wp-admin directory. You can password protect it to where you as an admin would have to input two passwords instead of one, but your main directory have another layer on top.

There are a ton of other things you can do. Each thing I've mentioned (if you're not super familiar with coding) has a plugin that can do this.

[Agency.co]

I don't know if this is still relevant, but here's a helpful tip:

There's 2 plugins I usually use on most WordPress websites, which will stop 97% of the attacks:

-WordFence free (scans files, emails you when anything has changed, stops a lot of automated attacks).
-Hide My WP (this plugin costs like 10$ on codecanyon, but it definetly worth it. It's easy to setup and hides the fact that you use wordpress, so almost all automated scans won't detect your website as a WordPress website.

Goodluck!

Agree with this! Wordpress can be secure if you use it right