Protecting your website is something that many WordPress users fail to do. It usually takes a hack attempt on their website to help them realize that they need to be proactive about securing their website.
For many, the task of securing a WordPress website seems daunting; however it needn’t be as you can secure your website quickly, and effectively, using a good security plugin.
One of the best security plugins available to WordPress users is All In One WP Security & Firewall. It can improve security for user accounts, user logins, user registration, files, comments, the website database, and much more.
Each setting in the plugin is labelled as “basic”, “intermediate” or “advanced”. This helps you understand the importance of a particular setting. The system works really well.
Let’s take a closer look at how All In One WP Security can make your WordPress website more secure.
How to Secure Your Website with All In One WP Security
All In One WP Security is a feature packed plugin. This becomes apparent after activating the plugin as there are 15 settings pages listing in the All In One WP Security admin menu.
The dashboard page lets you quickly view the security status of your website. The screenshot below was taken on a fresh WordPress installation with no other plugins activated, and “admin” as the administrator username. As you can see, it only achieved 25 points from a possible 425 points.
It does not take long for your security score to improve. Changing the administrator username from admin, for example, will give you 15 additional points.
The other tabs in this section give you information about your server and installation, and any IP addresses that have been locked.
The general settings area allows you to view two important WordPress configuration files: .htaccess and wp-config.php. Both of these files can be backed up and restored from this area.
WordPress adds a meta tag to the head section of all of your pages that shows the version of WordPress you are using. This can help hackers see that you are using an older version of WordPress, therefore All In One WP Security gives you a option to remove this tag.
Plugin settings can also be imported and exported in this area. This is helpful for transferring your preferred settings to other websites you own.
All In One WP Security can implement a wide range of security measures that will harden the user accounts of your website. In addition to changing the administrator username from “admin”, you can also modify user accounts that have the same login name and display name.
One of my favorite features is the password strength tool. It informs you how long it would take a PC to crack your password. This tool highlights the importance of using a strong password; as simple two word passwords can be cracked in under a minute.
A record is kept of all login attempts. Currently logged in users can also be displayed together with a list of failed login attempts.
The login lockdown feature will block out anyone who enters incorrect login attempts a specified number of times. Guessing the password of user accounts remains the most common way for hackers to break into a WordPress website; which is why it is so important to activate this feature.
Your registration form can also be strengthened by adding a captcha field and requiring all new accounts to be manually approved.
The default database prefix for WordPress websites is wp_. This can be changed through the wp-config.php file, however many website owners fail to do this. All In One WP Security lets you change this directly through the database security page at the click of a button. There is an option to automate scheduled backups too.
The plugin also reviews important files and directories and advises whether they are configured with the correct permissions. A warning is given if the wrong permissions are specified.
A WHOIS lookup tool is included that lets you see more detailed information about those who have tried to access your website without authorization. IP addresses and user agents can also be banned via a blacklist manager; which is a useful way of blocking persistent hackers.
Your website can be hardened further by activating a firewall. This will help prevent attacks from bots, stop image hotlinking, and detect attempts to view pages that do not exist.
All In One WP Security can prevent brute force attacks by changing the URL of your login page. Hackers can then be redirected to a specific URL when they attempt to login at the default WordPress login URL. Cookie based brute force prevention can also be activated and you can add a captcha field to your login form to improve security even more.
If you want to prevent your admin area further, you can specify the IP addresses that are allowed to login. It is one of the most secure ways of preventing unauthorized access to your website. All you have to do is define the IP addresses of you and any staff that update your website.
A captcha form can also be added to your comment form to help tackle spam. Spambots can be prevented from commenting and there is an option to list the IP addresses that have been used to post a specified number of comments.
Another great feature is the scanner. All In One WP Security can scan your core files, plugin files, and theme files; and determine whether any files have been changed. This is a great way of detecting malicious files and changes from hackers. Your database can also be scanned for any suspicious tables.
If you need to work on your website and address a security issue, you can place your website into maintenance mode. You can customize the message that is displayed to visitors. The visual editor can be used to write this message; which allows you to easily add bullet points, bold text, italic text, images, and more.
The last settings page is miscellaneous. Through this page you can disable the ability to copy text from your website. This will completely remove the option of right clicking your page and copying text. It may be worth activating this setting if a lot of people are scraping your content.
Final Thoughts
All In One WP Security & Firewall is one of the most complete security plugins available for WordPress. It can strengthen your website, prevent unauthorized attacks, and scan for attacks from bots and hackers.
While the plugin does pack a lot of great features, it does not take long to set up. This is because all features can be activated at the click of a button. It should not take you more than five or ten minutes to apply all changes to your website and reach a perfect score of 425 security points.
You can install the plugin by searching for “All In One WP Security & Firewall” via the plugin install page of your WordPress installation. Alternatively, you can download the plugin from WordPress.org and upload the plugin manually. I highly recommend giving it a try.