{"id":28050,"date":"2016-09-22T23:01:11","date_gmt":"2016-09-22T15:01:11","guid":{"rendered":"https:\/\/www.hongkiat.com\/blog\/?p=28050"},"modified":"2022-10-18T20:12:17","modified_gmt":"2022-10-18T12:12:17","slug":"strengthen-wordpress-security","status":"publish","type":"post","link":"https:\/\/www.hongkiat.com\/blog\/strengthen-wordpress-security\/","title":{"rendered":"5 Tips to Toughen Up Your WordPress Login Security"},"content":{"rendered":"

No matter the size of your website, losing your site data or not being able to access your own website can be a nerve-wracking experience. WordPress, which powers more than 25% of the Web, is one of the most targeted websites for hackers.<\/p>\n

In our previous posts, we have shown you a number of tips and tricks which already covered almost everything to secure your WordPress website<\/a><\/strong>. Still, there is always room for improvement. In this post we will be looking at a few more tips to help you make your WordPress site harder to breach.<\/p>\n

\n\t\t\t\t\tRead Also:<\/strong>\u00a0\n\t\t\t\t\t10 Plugins to Harden WordPress Security<\/a>\n\t\t\t\t<\/p>\n

1. Bcrypt Password Hashing<\/h2>\n

WordPress was started in 2003 when PHP and the Web in general were still in their early days. Facebook was not around yet, PHP did not even have OOP (Object-oriented Programming) architecture built-in; hence, WordPress inherited legacies that are no longer ideal today \u2013 including how it encrypts<\/em> the password.<\/p>\n

\n\t\t\t\t\tRead Also:<\/strong>\u00a0\n\t\t\t\t\tLessons from Dropbox Hack: State of Web Security<\/a>\n\t\t\t\t<\/p>\n

WordPress to this day still uses MD5 hashing<\/em>. Basically, what it does is to turn your 123456<\/code> password into something like e10adc3949ba59abbe56e057f20f883e<\/code>.<\/p>\n

However, since computers are now more sophisticated than 10 years ago this hashed<\/em> password can now be easily reversed into its bare form almost instantly<\/a>.<\/p>\n

PHP has native encrypting<\/strong> since 5.5 and If your WordPress is running in PHP5.5 or above, there is handy plugin called wp-password-bcrypt<\/a> that allows you to embrace this native utility in PHP.<\/p>\n

Install and activate the plugin through Composer<\/a> or through MU-Plugins<\/a>. Re-save your password and you are all set.<\/p>\n

2. Enable WordPress.com Protect<\/h2>\n

Brute-force is a common hacking attempt where attackers try logging in to your website by guessing numerous possible passwords, typically words found in the dictionary. This is the reason why you should set a hard-to-guess password.<\/p>\n

Automattic, the people behind WordPress.com, has acquired one of the most popular WordPress plugins that can counter brute-force attacks. It is called BruteProtect<\/a>, and it is integrated with Jetpack.<\/p>\n

Based on our experience, it has tremendously helped us<\/strong> combat brute-force attacks more than close to a million<\/strong> times.<\/p>\n

\"Jetpack
Jetpack Dashboard Widget reporting the number of attack and spam encountered.<\/figcaption><\/figure>\n

To get it, you need to install Jetpack\u2019s latest version and connect your website to WordPress.com. Then enable the \u201cProtect\u201d module, and white-listing your own IP address as well.<\/p>\n

\"Jetpack<\/figure>\n

Now you should feel a bit more safer.<\/p>\n

3. Hide Your Login URL<\/h2>\n

WordPress is very well-known for the login page, wp-login.php<\/code>. Hence hackers know which exact page to direct their brute-force attacks. You can make it harder for them by disguising your WordPress login URL<\/strong>.<\/p>\n

Fortunately, there are a few plugins that provide this utility:<\/p>\n