Our WP Alpha hosting platform contains tools that help lock down and secure your WordPress site. Applying them is one of the onboarding steps we recommend for every site, particularly a brand new site or one you have just migrated, because it protects the site from common attacks and cuts out a lot of malicious traffic. In this video we walk you through the process using our inbuilt security tools.
Step by step
- Log in to the hosting console. If the sidebar is closed, click to open it, then choose WordPress. You can also reach the WordPress manager from the menu on the left.
- If you have more than one site, choose the one you want to secure.
- On the site’s dashboard, find the security section and click Fix vulnerabilities.
- Two tabs appear. Leave WordPress vulnerabilities for now and open Security measures. The tool scans the site and lists the measures available. On a new or migrated site, many of them will be unticked.
- Select every measure that is relevant to your site, or all of them, and click Secure.
- Wait for it to finish. Progress shows in the bottom right corner, and it usually takes from about 10 seconds to a minute.
You only need to do this once per site.
What the measures do
- Change the default administrator’s username. WordPress often starts with the username admin, which is a common target for brute force attacks.
- Block author scans. Author scans are a way to discover the user names on a WordPress site.
- Block access to sensitive files that visitors have no reason to open.
- Enable bot protection, so the web server blocks bad bots.
- Forbid execution of PHP scripts in certain folders, which helps protect against hacks.
- Disable file editing in the WordPress dashboard. On our own site we leave this one off because we want to edit files from the dashboard.
- Block XML-RPC, which stops a lot of malicious traffic aimed at that entry point.
Common problems
On a standard WordPress site you can turn all of these on without breaking anything. The one to be careful with is blocking XML-RPC on a WooCommerce site, because it can break some API connections. If anything stops working after you apply a measure, it is easy to undo: select that measure and click Revert. Reverting takes a few seconds, up to about a minute.
If you have any questions, our support team can help: log a ticket from the client area or start a live chat.