Choose secure hosting
The hosting provider has a strong influence on the security of a website. We are happy to tell you which hosts we recommend and which we do not.
The control panel of the host should always be set to the recommended PHP version. Backups and data with critical content must never be publicly accessible in any way.
According to an infographic, 40% of all attacks go back to gaps in the hosting.
Keep WordPress and plugins up to date
WordPress installs important security updates by itself. Every few months, however, a major update comes out, since 2019 for example WordPress 5. The jump from 4.9 to 5 is the biggest update in many years, and it is best tackled with a specialist. All other updates you can do yourself, following the update guide we went through with you.
Plugins extend WordPress and are also a point of attack. They too need regular updates.
Every installation is different here. If you are not sure whether you can update the plugins yourself, ask your webmaster.
Add a firewall
We use a firewall in almost all WordPress installations. The best known plugins for this are WordFence and Sucuri. They protect against many different threats and show what can still be improved on your own website.
A firewall protects you even when other measures are left undone, such as regular updates.
Strong passwords for every account
With the brute force method, a program tries millions of combinations until it hits the right one or gets blocked. A weak password makes it easy for attackers. For a website, these accounts need a secure password:
- WordPress administration, with a user name other than «admin»
- Web hosting
- FTP, for transferring files to the server
- Database, created when WordPress is set up
- Email accounts
A secure password follows 4 rules:
- No dictionary word Not even when it is slightly altered.
- 12 characters That is the minimum length for a password.
- All character types Upper and lower case letters, numbers and special characters.
- Each one only once Never use the same password in different places.
The easiest way is a password manager such as LastPass, 1Password or Dashlane. It also generates new passwords.
Without a password manager, a sentence helps. From «Heute erstellen wir ein sicheres Passwort für mich» (today we create a secure password for me) you take the first letters, HewesPfm, and add numbers and special characters. It is easy to remember and still secure.
Never send passwords by email
A password sent by email may stay in your «Sent items» folder for years, and with the recipient as well. It can also be intercepted on the way.
So always send the password separately from the login address and user name. OneTimeSecret.com works well for this. You paste in the password and send the link you receive. The recipient can open the message exactly once, after that it is deleted.
Log in with two-step authentication
You may know two-factor authentication (2FA) from your bank's login. Besides user name and password, you need a code sent by SMS or to a device. This protects you even if your login details are known.
Set up 2FA with an app
- Install the app Google Authenticator or Authy on the smartphone are good choices.
- Turn on 2FA with the provider Log in to the provider, Mailchimp for example, and switch on 2FA there.
- Scan the QR code With the smartphone camera. From then on every login only works with the constantly changing code from the app.
- Print the backup codes They help if you ever lose your smartphone.
The WordPress login can also be secured with 2FA in addition. It is quick to do, and we are happy to help.
Start with your own computer
Keyloggers can pass every keystroke on to third parties, and trojans and other malware lead to virus infections. So install the operating system updates regularly.
- Learn to recognise dangerous links (tips can be found on swisscom.ch and heise.de, for example)
- Use antivirus software
- Protect your user account on the computer with a password
- Do not save passwords in the browser
- Only connect via encrypted Wi-Fi
- As a browser we recommend Firefox or Chrome
Backups in more than one place
Backups are not directly about attacks. Every website should still have them set up, and in more than one place.
- At the host Usually daily backups in the background, available for 2 to 4 weeks.
- In WordPress Additional backups through the administration, which can also be kept longer.
- In a separate place Download a backup 1-2 times a year, for example to a secure computer.
For professionals
This post covers the basics for end customers. Beyond that there are many professional settings that you should leave to a specialist:
- Protection through the .htaccess file
- Security measures in the wp-config.php file
- Disable directory browsing on the server
- Change the path to the login page
- Disallow the file manager in the backend
- Hide the WordPress version number
- Remove unnecessary header entries
- Disable XML-RPC
