Importance of SSL Certificates

SSL certificates are digital certificates that enable encrypted connections and authenticate a website’s identity. The term SSL stands for Secure Sockets Layer. An SSL Certificate protects sensitive information and helps websites satisfy PCI/DSS requirements. Google is also known to consider SSL certificates while deciding on the website’s ranking. Moreover, an SSL certificate also makes you look more professional in the eyes of your customer and improves trust. You can determine the level of security required to choose the SSL certificates that best fits your needs:

Domain Validated (DV) certificate 

A domain-validated certificate provides security to only a single domain. Most free SSL certificates fall under this category. A DV certificate is ideal for blogs, personal portfolio websites and small business websites.

Organization Validated (OV) Certificate 

An OV certificate validates that the domain name belongs to the actual business or organization it is associated with. It assures the website’s visitors that they’re not dealing with an impersonator. 

Extended Validated (EV) Certificate 

An EV certificate provides the highest level of security to the domain. It includes advanced features like vulnerability scanning, a secured site seal, a green address bar and full validation of your business. 

You can get an SSL certificate through a number of ways:

1) If your website is using a hosting service, the SSL certificates will be provided and managed by your hosting provider.

2) If you are hosting the website by yourself, you will need to manage the SSL certificate on your own. It can be purchased from a renowned Certification authority like Digicert, COMODO, Sectigo etc

3) There is also a free, automated and open source SSL provider called Letsencrypt. The non-profit is run by ISRG and provides free certificates valid for up to three months. These certificates can be auto-renewed every three months by a bot that manages this on your server.

WordPress Security Guide: Chapter 2

The Need for Strong Login Credentials

Why is it important to have strong login credentials?

Your credentials are the keys to your website. To keep them secure, first change the default username from admin. Secondly, passwords should be a combination of partially unrelated words, numbers and symbols. You can use a password generator to generate 16 digit unique passwords. Do not use the name of a family member, pet or friend. Phone numbers, addresses or birthdays should also be avoided. You should also put a limit to the number of failed login attempts.

WordPress Security Guide: Chapter 3

Understanding Two Factor Authentication (2FA)

What is Two Factor Authentication?

Two-factor authentication adds another layer of protection, which is unique and available only to you. WordPress offers two-factor authentication(2FA) via mobile devices and physical security keys. Once your mobile number is verified via a code, you can use it for 2FA. You can also use authenticator apps like google authenticator or authy to set up two-factor authentication. Once set up 2FA, you will be prompted to print security codes. Do not skip this step.

WordPress Security Guide: Chapter 4

The Importance of a WP Firewall

What is a Firewall?

A Firewall acts as a shield between the outer world and your website hosting server. You can implement a number of firewalls available today, like physical, software and hardware load balancers, capable of disarming the threats even before they reach your website. Some great examples of such solutions are WPMUDEV’s defender pro and Cloudflare WAF. Pre-emptively installing firewalls can save businesses from loss of data and time in case there is a breach or attack on the system. Here are some of the best WP firewall plugins:

Sucuri

Sucuri offers powerful features like DNS level firewalls, prevention from intrusion and brute force attacks and blacklist removal services. They use their cloud proxy servers to scan each request in your traffic. Legitimate requests are allowed to pass through, while malicious requests are blocked.

MaxCDN 

MaxCDN offers Layer 3 and 4 DDoS protection on its plans. Just like Sucuri, MaxCDN is a DNS-level firewall that not only improves the speed of your website it is implemented on but also protects it from any kind of malicious attacks.

Cloudflare

Cloudflare offers free CDN service and basic DDoS protection. It supports caching and boasts a larger network of servers but does not have important features like security scans on the application level, blacklist removal and protection from malware.

Wordfence 

Wordfence comes with a built-in website application firewall. It monitors your WordPress site for malicious attacks like SQL injections, file changes, DDoS attacks and brute force attacks. It also comes with on-demand and scheduled security scans. 

Jetpack

Jetpack’s free plan offers basic features like brute force protection and downtime monitoring, but you would have to upgrade to the personal plan to unlock features like automated spam filtering and automated backups. The professional plan unlocks automated malware scanning.

WordPress Security Guide: Chapter 5

Blocking PHP Execution in Untrusted Folders

How to block PHP Execution in untrusted folders?

There are certain directories, which are writeable on WordPress, to help authorized users easily upload themes, plugins, and images to the website. This capability can prove to be disastrous if it gets into the hands of hackers, who will most probably upload backdoor access files or malware to your website to gain full access to your website. To avoid the whole fiasco, you can simply disable PHP execution in certain directories where you don’t need it. 

WordPress Security Guide: Chapter 6

Securing wp-config.php File and Disabling the File Editor

How to secure the wp-config.php file and disable the file editor?

By just editing a simple code into your wp-config.php file, you can secure it and disable the file editor feature to protect your WordPress site from hackers and people with malicious intent. Search wp-config for define(‘DISALLOW_FILE_EDIT’, if it isn’t set to true, change it to look like this: 

define( ‘DISALLOW_FILE_EDIT’, true );

WordPress Security Guide: Chapter 7

The Importance of Regularly Changing Security Keys

Why should I change the security keys on WordPress?

Changing keys and salts from time to time adds another layer of security to your WordPress site’s security. Moreover, if a suspicious user has accessed the website, updating the keys and salts will force them to log out and reauthenticate to log back in.

WordPress Security Guide: Chapter 8

Securing WP-Admin

Can I increase my site’s security by securing WP-Admin?

Login access can be limited to certain IP addresses, like workplace Wi-Fi, effectively air gaping the access page from outsiders. Login hints can be disabled while also limiting the number of attempts. You can altogether create custom login pages.

WordPress Security Guide: Chapter 9

Importance of Assigning User Roles and Permissions Carefully

What are custom roles in WordPress?

WordPress enables website administrators to set custom roles and permissions for all the people accessing and working on the website. It can limit the employees’ actions and the data they can access, thereby protecting the website in case someone goes rogue.

WordPress Security Guide: Chapter 10

Importance of a Good Security plugin

What is a WordPress Security Plugin?

Internal threats are often overlooked, and a security plugin must remediate even the slightest possibility of one. Say a developer’s PC gets infected or malicious code is injected directly into the system from a known source. Such an internal attack can bring down the entire website. A security plugin helps diagnose these changes, identify any malicious codes or malware, and preemptively employ measures to stop them. 

Ensure you use a robust security plugin with a reputed and updated malware database. Scanning features will help you protect the site from any new or old malicious codes entering the system. These plugins help secure the code and are loaded with various other security features that help block threats like clickjacking, getting server access through code injection, and updating the code with malware.

One such solution is defender pro from WPMUDEV. It is the most advanced yet cheapest option available in the market. It arms your sites with advanced security features like audit logging, TFA, vulnerability reports, scheduled security scans, masking, blocklist monitoring and more.

Conclusion 

Security is essential to businesses and websites of all scales and sizes. Intellinez takes security very carefully and specializes in implementing advanced security solutions to existing and new systems. If you are looking for consultation or integration assistance in this respect, contact us now.