WordPress Security Tips 2

Especially if you use Plesk or cPanel, you can manage many of these settings from the panel too, but control at file level is always more reliable.

Here are technical configurations that will take your site one step further:

1. wp-config.php: Armoring the File

This file is the title deed of your site. Blocking access alone is not enough; you can increase security by adding these lines to it:

• Disable the File Editor: Prevents theme or plugin files from being changed from the panel. Even if someone breaks into the admin panel, they cannot touch your code.

  PHP

   

  define( 'DISALLOW_FILE_EDIT', true );
  

• Disable Error Display: When an error occurs on the site, attackers are not shown the server path or PHP errors.

  PHP

   

  define( 'WP_DEBUG', false );
  @ini_set( 'display_errors', 0 );
  

2. Database Security

If your site is new or you are about to migrate it, changing the default wp_ table prefix defeats 90% of SQL injection attacks.

• Example: wp_users – using a structure like wbev_42_users instead makes it impossible for an attacker to guess the table name.

3. Blocking User Name "Enumeration"

Attackers usually try to learn the administrator user name by typing yoursite.com/?author=1. To block this, in addition to the .htaccess code in our previous article, you can change the "nice name" with a plugin such as Edit Author Slug.

4. Server-Side (WAF/ModSecurity) Checks

Switching the ModSecurity settings to "fast" mode is a sensible move. However, in this mode you should watch out for the following:

• False Positives: Some security rules may block legitimate WordPress actions (e.g. saving a post). After changing the setting, try publishing a post.

• IP Whitelist: Adding your own IP address to the whitelist at server level (via Plesk/cPanel) keeps you from accidentally blocking yourself.

A Small Tip: Clean Up Unused Files

It is a good habit to delete these files from the server; they come with the WordPress installation but are never used:

1. readme.html (reveals the WordPress version)

2. license.txt

3. not needed once installation is complete)