Updates
- WordPress core on the current version, with automatic minor updates on.
- Every plugin and theme updated. In our October audits, 12 of 23 WordPress sites we checked ran a plugin version with a published flaw. Our plugin check compares a version against known vulnerabilities.
- Plugins and themes you don’t use deleted, not just deactivated. Deactivated code can still be reached on many setups.
- Plugins that haven’t been updated by their author in a year or more replaced.
- PHP on a version that still gets security fixes. Our server check shows what your server reports.
Logins
- Two-step sign-in on every administrator account.
- No “admin” username, and as few administrators as possible. Editors don’t need admin rights.
- Login names not exposed. Many sites list usernames publicly through author pages (?author=1) or the REST API’s users list; 8 of 66 sites in our report did.
- Login attempts limited, and XML-RPC disabled if nothing you use needs it.
- Old employees and old web designers removed as users.
Backups and the server
- Daily backups stored somewhere other than the same server, and a restore tested at least once.
- HTTPS everywhere, with the security headers on. See security headers explained.
- File editing in the dashboard disabled (DISALLOW_FILE_EDIT), so a stolen admin login can’t edit code directly.
- Hosting that isolates your site from other customers’ sites.
Watch it
- Uptime and content monitoring, so a defacement or redirect is caught in minutes, not weeks.
- Search Console set up, so Google can tell you if it finds a hack.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.