In today's digital age, it is almost impossible to ensure 100% security on the Internet. Any website, no matter what system it was created with, is potentially vulnerable. No matter whether Joomla, Contao, Typo3, Drupal, Magento, Shopware, Oxid or other content management systems (CMS) - even the most expensive and professional systems are not invulnerable. If these are not professionally secured, they are just as vulnerable as WordPress without security features. The safest option is still to create a purely static HTML website using CSS. Even JavaScript should be used with caution here.
So why is WordPress so often referred to as one of the most insecure systems? A comparison with Windows and macOS helps us understand this. Windows is installed much more frequently worldwide and is therefore attacked more frequently. macOS, on the other hand, is less common and is therefore less likely to be attacked. Although macOS is considered safe, there are now many ways to attack this operating system. A similar picture emerges with WordPress. Despite its widespread use and the assumption that it is insecure, WordPress can also be made very secure - but never 100 percent.
So where does WordPress’ bad reputation come from? Is it because it is open source and anyone can work on it? Or because it is free compared to paid systems that can cost over 1000 euros a month? Unfortunately, the real reason lies somewhere else. WordPress is an open source system and many agencies often just want to make money quickly. They create websites with WordPress without paying attention to security, performance, data protection, accessibility and search engine optimization. Often the problem lies not only with the agencies, but also with the customers who are not prepared to spend additional money on security and other optimizations.
Another point is that many entrepreneurs create their websites themselves or commission someone from family or friends to do it. Since WordPress is considered easy to use, it is often used quickly and without much specialist knowledge. Unfortunately, most people have no idea about security, optimization, data protection, performance or search engine optimization. However, truly professional WordPress websites are built by professionals with years of experience. A professionally built WordPress website can be just as secure as a website built with an expensive payment system.
The widespread use of WordPress makes it an attractive target for hackers. Since it is the most widely used CMS, there are many attack surfaces that can be exploited. Security holes in plugins and themes are common problems, often exacerbated by outdated versions or insecure passwords. Brute force attacks, where hackers repeatedly attempt to log into the website, also pose a major risk. Despite these challenges, WordPress can be made very secure through careful measures.
WordPress can be secured by 99% with the following measures:
Regular updates of WordPress, themes and core files
- Always keep all components up to date to close security gaps.
Use strong passwords
- Use passwords with at least 16 characters of upper and lower case letters, numbers and characters and no real words.
2-factor authentication (2FA)
- Add a second layer of security to the login, e.g. with an authentication app.
Remove unnecessary users and rights
- Delete unnecessary user accounts and reduce user rights to the necessary minimum.
Provide files and directories with correct permissions
- Make sure sensitive files and directories are only accessible to authorized users.
Restrict access to admin area
- Limit access to the admin panel, e.g. through IP address restrictions.
Use an SSL certificate for encrypted data transmission
- Use HTTPS to encrypt data transfer between the server and visitors.
Manually check files for malicious code
- Regularly check files for suspicious or malicious code.
Change database prefix
- Change the default prefix of database tables to make SQL injection attacks more difficult.
Use directory protection via .htaccess file
- Use .htaccess files to protect directories from unauthorized access.
Change default admin username
- Do not use “admin” or “administrator” as your username.
Protection of the wp-config.php file
- Secure this file by restricting access to it and placing it outside the root directory.
Create backup copies regularly and store them outside the server
- Create regular backups and store them in a secure, off-site location.
Regular monitoring of website activity and logs
- Monitor the website for unusual activity and review logs regularly.
Use secure server and hosting settings
- Make sure the server and hosting settings meet the highest security standards.
Securing connections to third-party services
- Make sure all connections to external services are secure and encrypted.
Avoiding unsafe or suspicious themes and scripts
- Only use trustworthy and well-tested themes and scripts.
Reducing the number of HTTP requests
- Optimize loading times and reduce potential attack surfaces by reducing HTTP requests.
Use Content Security Policy (CSP).
- Implement a CSP to block malicious content and maintain site integrity.
Check entries and uploads for harmful content
- Check all user input and file uploads for malicious content.
Restricted user roles and rights assignment
- Define clearly defined user roles and only assign necessary rights.
Setting up an HTTP password (htpasswd)
- Additionally protect the admin area with an HTTP password.
Setting up a server-side firewall
- Use a server-level firewall to block unwanted access.
Only use high-quality plugins from trustworthy providers
- Only install plugins that come from trusted developers and are well maintained.
Change the name of the login directory
- Change the login directory name to make it harder for hackers.
Limit number of login attempts
- Limit the number of login attempts allowed to prevent brute force attacks.
Disable comments completely
- Disable commenting when not needed to avoid spam and malicious links.
Sending emails via SMTP and not via PHP mailer
- Use SMTP for email sending to increase security and deliverability.
Delete disabled plugins
- Remove disabled plugins to close potential security vulnerabilities.
Avoid “administrator” or “admin” as a username
- Use unique usernames to make it harder for attackers.
Use the latest PHP version
- Make sure to always use the latest PHP version to avoid security vulnerabilities.
Use CDN (Content Delivery Network).
- Use a CDN to make DDoS attacks more difficult and increase resilience. Many CDN providers also offer additional security features such as Web Application Firewalls (WAF) and bot protection.
Keep plugins to a minimum
- Only install absolutely necessary plugins to minimize potential attack surfaces.
Use maintenance contract
- Take out a maintenance contract to ensure regular maintenance and security of the website.
Use plugins and page builders that write clean code
- Only use plugins and page builders that are well documented and produce clean, secure code.
Any system, be it WordPress, Joomla, Contao or another CMS, is vulnerable. Even expensive paid content management systems can be hacked. WordPress's widespread use makes it an attractive target for hackers, but that doesn't mean it's any more insecure than other systems. With the right measures, a WordPress website can also be made very secure.
It is important to be aware of the potential risks and continually work to improve the security of the website. This includes not only technical security, but also raising awareness among users and operators of security-relevant topics. A well-informed and proactive website operator can ward off many potential attacks in advance.
The measures mentioned contribute significantly to safety. However, it is just as important not to rely solely on technology. Regular training and raising user awareness of security issues, constantly adapting security strategies to new threats and the conscious use of digital resources are indispensable components of a comprehensive security strategy.
It is also worth mentioning that WordPress is used by numerous large companies and institutions that place the highest value on security. Well-known users include Sony Music, Stanford University, Euronics Blog, SAP News, The Walt Disney Company, Microsoft News Center, Time Magazine, Katy Perry, The White House and many more. These examples show that WordPress can be a reliable platform when configured and maintained correctly.
With professional maintenance and appropriate security precautions, WordPress can be just as secure a basis for websites as expensive payment systems.
Ultimately, security is a continuous process that requires constant attention and adaptation. By combining best practices and a proactive security strategy, you can protect your WordPress website from many threats and maintain its integrity.
