If you’re not ecommerce and only use a few plugins you could probably skip wordfence and gain some speed.
Have a strong password.
If your code isn’t secure, your site isn’t secure. Throwing more plugins at a problem is likely just worsening the problems.
Cloudflare + Bullet Proof Security + Good SQL practices. Nothing beats BPS in all security suites for WordPress.
As a designer/developer I don’t run any sites that need Fort Knox level ultra-security, so my standards are lower, but I still use a combo of the following:
Wordfence
Strong passwords for everything
Renaming the login URL
Keep core, theme and plugins updated on a regular basis
Probably the biggest threat to security is the client themselves. After the site goes live and they take control, they’ll sometimes want admin level access and then create a password like “Mambo5” and think that’s strong because it has a capital letter and a number.
Always amazed how many clients are using extremely poor passwords for what they make their bread and butter from.
Sanitize, Sanitize, Sanitize, Sanitize and Sanitize.
This answer has levels.
A strong password is mandatory, but it is useless if your site is full of plugins that never see an update.
A site which is fully maintained and updated can still be brute forced if one of your admins has an easy password.
A site with both of the above on a terrible hosting can still be broken into from outside the WordPress environment.
A site with all of the above on a secure VPS can still be broken into if your site or hosting password is exposed elsewhere in another breach without 2FA in place.
You need to think about all angles, and only then will you reduce chances of being hacked.
Cloudflare + Wordfence
If you’re not ecommerce and only use a few plugins you could probably skip wordfence and gain some speed.
Have a strong password.
If your code isn’t secure, your site isn’t secure. Throwing more plugins at a problem is likely just worsening the problems.
Cloudflare + Bullet Proof Security + Good SQL practices. Nothing beats BPS in all security suites for WordPress.
As a designer/developer I don’t run any sites that need Fort Knox level ultra-security, so my standards are lower, but I still use a combo of the following:
Wordfence
Strong passwords for everything
Renaming the login URL
Keep core, theme and plugins updated on a regular basis
Probably the biggest threat to security is the client themselves. After the site goes live and they take control, they’ll sometimes want admin level access and then create a password like “Mambo5” and think that’s strong because it has a capital letter and a number.
Always amazed how many clients are using extremely poor passwords for what they make their bread and butter from.
Sanitize, Sanitize, Sanitize, Sanitize and Sanitize.
This answer has levels.
A strong password is mandatory, but it is useless if your site is full of plugins that never see an update.
A site which is fully maintained and updated can still be brute forced if one of your admins has an easy password.
A site with both of the above on a terrible hosting can still be broken into from outside the WordPress environment.
A site with all of the above on a secure VPS can still be broken into if your site or hosting password is exposed elsewhere in another breach without 2FA in place.
You need to think about all angles, and only then will you reduce chances of being hacked.
must read-