[ad_1]
Our site is currently being brute force attacked and we’re looking to implement security measures to stop this and future attacks and generally protect the site which is live but still under development.
Is anyone able to offer advice on the best security setups?
[ad_2]
Do you have CloudFlare in front of your site? If not, I recommend doing so.
It’s easy to set up CF as your DNS provider and you can speed up, secure and optimize your site’s performance as well as enable Attack Mode.
Couple this with Wordfence, free or premium, to add a layer of defense at the site level.
Put it behind [Cloudflare](https://io.bikegremlin.com/24013/cloudflare-for-wordpress-configuration/) (and use a [hosted email service](https://io.bikegremlin.com/14310/hosted-email-pros-cons/) to not disclose your server’s IP address via [email-related DNS records](https://io.bikegremlin.com/13689/wp-site-dns/#4.6.3)).
My general [WordPress security guide](https://io.bikegremlin.com/8963/wordpress-security/).
Relja
I use the free Cloudflare features with the free version of Wordfence. The combination does a pretty good job!
Following Best Practice is the best way to keep your house in order and defend against attack – if your site is not vulnerable because it adheres to best practice – then it doesn’t matter how much hackers throw at it, nothing will compromise it! – [mySites.guru](https://mySites.guru) can help with that 🙂
https://developer.wordpress.org/advanced-administration/security/hardening/
Sucuri
One of my sites got affected by the security patch in Bricks Builder and it broke the site. I installed Wordfence and with few clicks it showed me all the effected files and fixed it for me, so ig give it a shot, its a well known plugin
I don’t know how much it helps, but on our sites we moved the login page from the default using the WPS Hide Login plugin and recently moved our wp-config files out of the root directories.
Wordfence will stop it and let you block it if you watch a few tutorials. I get Brute Force attacks on my sites all the time. It blocks them and then I go in and block the IP address permanently. Problem solved. They also have a premium version that’s the best there is. I would just download that plugin, follow the set up instructions and do it.
Sucuri is good but more complicated to use and not as popular.
Other security plugins are not as reputable. I would also use UpDraftPlus to create 3 to 4 daily back-ups of any site in case it’s hacked or just gets screwed up one day. I used it to restore my own site yesterday and it took 10 minutes.