- Of the top ten million websites, WordPress is used by over 41%.
- Every single minute there are 90,000 attacks on WordPress sites.
- Every single week Google blacklists 70,000 websites due to security issues.
If you’re running a WordPress website, these statistics make startling reading and underline just how critical it is to not only take WordPress security seriously but to keep bang up to date with the latest advice. Fortunately, that’s what we’re going to do right now.
Ensuring your WP site is fully secure is a given these days, but how can you achieve this effectively?
There are several WordPress security plugins that you can install to help you to protect your website from online threats. Choosing a good plugin will keep your WordPress website safe and protect it from spammers and malware.
Let’s see why it is important to secure your WordPress site, what you can do to keep it safe and examine closely six of the best WordPress plugins that will keep your site safe.
Do You Need To Secure Your WordPress Site?
No matter what the size of your site is, yes. Keeping your website secure is highly important. Spammers don’t see whether your site is big or small; they’re just looking for a way to infect your site with viruses and malware. Weekly, about 18 million websites get infected with malware. While the WordPress core software is very secure (as long as you keep it fully up to date), the themes and plugins you use can leave your website vulnerable.
If a virus, malware, or spammer successfully attacks your website, then it can:
- Affect your Google ranking
- Access all your important and private information
- Damage your website and brand reputation
- Do serious damage to your online business
But if you install a security plugin on your website, then not only it will protect your website and keep it safe but it will also:
- Keep all your confidential website files safe
- Detect and inform you whenever there is a security threat
- Block spam from contact form plugins
- Protect your website from brutal virus attacks
What Does A Good WordPress Security Plugin Contain?
Selecting a good WordPress security plugin to protect your site is highly important. There’s no need for the security plugin to be expensive, but it should have all the features you need and protect your site properly. A good WordPress security plugin should contain the following characteristics:
Protects Efficiently from Malware
Usually, WordPress sites work with folders and files, which are the most common target of malware. Malware generally affects WordPress websites when you download and install unauthorized themes or plugins on your site.
This can mean your files have already been corrupted with viruses before you’ve even thought about security, and this can make it difficult to eliminate them. The virus can be present in any file or folder, which makes it tough to identify.
To get rid of malware, you’ll need a security plugin to scan all your files and folders for viruses. Many security plugins offer malware scanning, but you have to pay to remove the infected files or activate real-time protection for all the files and folders. More importantly, some also charge extra for recovering or restoring backups.
Virus Scans That Don’t Affect Your Site’s Performance
The malware scans that security plugins perform usually slow down the website’s response times and use a high number of assets. They do so because the plugins scan directly on your server and perform the other functions simultaneously.
To avoid this situation, reputable WordPress security plugins run scans on their own servers instead of directly running on your website’s server. This avoids any negative impact on response times and work that your server might be required to do.
Quickly Clean Your Website If Your Website Is Infected
All WordPress security plugins will inform you if your website is infected with malware. This shouldn’t be the only thing that would be the deciding factor though. A good security plugin is the one that identifies and cleans up the virus, which many plugins don’t offer. It could take hours or days to clean up a hacked site thoroughly.
Along with quickly cleaning up the site, plugins should also save you from the issue that can lead to blacklisting your site from Google or your website host. Google often blacklists websites when its crawlers detect something harmful to the user, such as malware.
Continuous Support and Protection
Clean-ups and scans should be done regularly by security plugins. But many payment plans for these security plugins can include limits, such as a single scan per month, or at best, just a handful.
In this case, you should avoid these kinds of plugins as they can be expensive, and don’t provide you with the thorough and ongoing protection you need. If your WordPress site has been hacked in the past, there’s a good chance it might be targeted again.
If a plugin includes a security breach perhaps, and if you have to wait several days or weeks to carry out another scan, this is no good at all. A good security plugin should provide continuous support and protection, including from repeated attempts.
A Strong Firewall That Protects from Unwanted Traffic
Having high traffic on your site may seem a good thing, but unfortunately with high traffic comes the chance that spammers or hackers may be drawn to your site along with genuine customers. This is why it is essential to have a firewall plugin that is able to closely monitor and analyze all of the traffic coming to your site (and even data leaving your site too), identifying quickly any suspicious or unwanted visitors.
WordPress security firewall plugins work by filtering traffic to find and block malicious data before it even reaches your site. This can be done manually, but it is extremely time-consuming and inefficient. Having an active plugin constantly watching your back gives you much greater peace of mind.
Lets You Login Safely
Login pages are almost always at the highest risk of being targeted by hackers, and it’s the most common access route for hackers and spammers through to the restricted areas of your website.
One of the most frequently used methods is to simply try a huge number of different password combinations in order to log in. This is an approach that is usually automated so that many thousands of passwords can be tried very rapidly, and this method is known as a brute force attack.
Brute force attacks can be prevented by setting up a maximum login attempt threshold, but unfortunately at the time of writing WordPress still doesn’t provide this feature. However, some security plugins can offer a maximum login threshold feature, automatically protecting you from any brute force attacks.
Has A Single Dashboard To Maintain Multiple Sites And Activities
WordPress sites often need maintenance which can take a great deal of time, and maintaining multiple WordPress sites is a very time-consuming and demanding job. When running multiple websites, there’s every possibility that you’ll be using a different combination of plugins and themes, which can create a demanding workload to maintain.
Using a plugin that sets up a dashboard that you can use to monitor and support multiple sites is certainly a huge timesaver.
Provides A Strong Customer Support
A good plugin should always have a solid support system. Being able to reach out to a helpful, knowledgeable, and responsive support base is much easier than trying to sort through the problem by yourself. Very often you will find that high-quality support comes with a price, but paying for a security plugin that offers this peace of mind is money well spent.
The Top 6 WordPress Security Plugins
So far we have studied what a good security plugin should offer. Now we will take a deep dive into examining some of the very best WordPress security plugins that we think you should seriously consider.
Sucuri
Sucuri is one of the top WordPress security plugins and is highly recommended. It is used by WPBeginner themselves, which shows how highly it is valued. It has a free plan and a paid plan. The free plan offers basic features, but the paid plan offers complete protection. Some of the features offered by the paid plan include:
- Website uptime monitoring
- DNS change detection
- CDN service to speed up your WordPress website
- Provides basic HTTP/2 support for all websites
- Zero-day exploit prevention
- Automatically identifies and removes malware
- Has a Web Application Firewall (WAF) to protect your website from DDoS attacks
Pricing:
Free or $199/year for the Basic plan.
Wordfence
Wordfence is a strong security plugin that has many advanced features to protect your website from hackers. It has both free and paid version plans, and the free version works well for small sites offering a good level of basic protection. Wordfence has an advanced dashboard, which can need a little guidance to navigate if you’re a complete beginner.
The paid version of Wordfence offers the following features:
- Scans your website for malware
- Protects your website from brute force attacks by limiting login attempts
- Realtime firewall protection
- Can block specific countries
- Monitors files and folders for malicious code
- Has two-factor authentication and also provides login protection with strong password enforcement
Wordfence has a firewall that runs on your server, while Sucuri uses a cloud-based firewall. It also sends weekly updates to alert you about any malware attacks. (Don’t forget to make sure your WordPress admin email is set up and working correctly for this.)
Pricing:
Free or $99/year for one site.
Patchstack
The Patchstack security plugin is highly recommended for its firewall feature. Patchstack offers a free solution for up to 99 sites and doesn’t even require a credit card.
However, it only helps with detection, offering:
- Component detection
- Vulnerability detection
- Real-time alerts when threats are detected
- Security suggestions
For prevention or additional hardening features, you will want to subscribe to their Professional or Business package. The Professional package works great if you want to beef up security for a single site, costing $6.74 per month, per site, if you pay annually.
Apart from the features above, this also gives you:
- Virtual patching (automatic)
- Automatic updates for at-risk plugins
- Protection against brute force attacks
- Option to create custom firewall rules
- Analytics and reporting
- SSL expiration detection
- New add-ons that you can enable
- Site hardening features
Pricing:
The Community plan is free, but only offers features to detect vulnerabilities. If you want prevention and hardening features, you need the Professional ($6.74/month/site), or the Business plan, which costs $457.4 per month (billed annually), and lets you use it on unlimited sites.
All In One WP Security & Firewall (Free)
All In One WP Security & Firewall is a completely free WordPress security plugin. Don’t let the fact that this plugin is free put you off – it outperforms many paid alternatives, and provides an impressive level of security.
All In One WP Security & Firewall provides several levels of firewall protection, with a huge range of tools that allow you to tailor the security features to your preferences. It’s very user-friendly and easy to use, even for those less tech-savvy users.
The plugin displays different categories in the form of charts and graphs to show the security condition of your website and provides clear advice about what you can do to make it stronger.
It offers three different kinds of features:
- Basic
- Intermediate
- Advanced
The three features are designed to adapt to the user’s level of technical knowledge – from beginners to experienced programmers.
The different features offered by the All In One WP Security & Firewall plugin are:
- Protects your website from malware and viruses
- Provides login protection by stopping brute force attempts
- Scans files and folders for malicious patterns
- Offers blacklist functionality
- Lets you create a backup for files of the .htaccess and .wp-config formats
Pricing:
It’s completely free to use.
iThemes Security
iThemes Security is a popular security plugin that is developed by BackupBuddy developers.
This security plugin, which has been around since 2014, has an interactive dashboard that displays all the available tools and settings clearly. Some of its features are:
- Detects 404 error
- iThemes Security email notifications
- Keeps automatic backup of the database
- Detects any change in the files
- Enforce two-factor authentication and strong password feature
- Protects from brute force attacks
- Lockout bad users
The only limitation is that it doesn’t have a website firewall or malware scanner. iThemes Security uses Sucuri’s SiteCheck for malware scanning
Pricing:
iThemes pricing starts from $80 per year for a single site. For 10 sites, you’ll have to pay $127 per year. If you’re running an agency, their $199/year plan might be a good choice. You can use it with an unlimited number of sites.
For the very best offering, iThemes also offers a $499/year plan, which includes add-ons such as BackupBuddy Gold and Restrict Content Pro Professional.
MalCare
MalCare provides more security from malware than any other virus attacks. It automatically locates any malware, allowing you the option to remove it with a single click. It is easy to use and uses its own server to scan malware instead of using yours. This is a hugely important difference because the regular scans cause absolutely no reduction in speed or responsiveness on your own server.
MalCare Security has a firewall feature – which may not be quite as feature-rich as Sucuri but it still does an impressive job. The security plugin tracks thousands of websites and blocks any malicious IP addresses automatically. It also stops brute force attempts, disables file editing and executing in the upload folder, provides CAPTCHA authentication to limit login attempts or spam, and creates a three-month backup of all your website’s content.
This plugin will also stop IP addresses that it has determined to be malicious on other sites on its list, similar to the feature provided by the iThemes Security plugin. MalCare keeps track of thousands of sites used to ensure these records are always kept fully up to date.
Pricing:
Plans for MalCare start at $99/year for the Basic plan, $149/year for the Plus plan, and $299/year for the Pro plan.
Some Extra Tips To Help Keep Your Site Secure
There’s no doubt at all that using plugins like these can make a massive difference to the overall security of your website and the integrity of your data. But it’s also important to remember that there are some additional security measures you can implement yourself, without needing plugins. Here are some of the ways we would advise you to tighten up the security of your WordPress website.
Install A Security Socket Layer
An SSL or Security Socket Layer is a network protocol or set of rules which govern how data is transferred between your website and the server. You can easily tell whether a website is using an SSL because the website address will begin with HTTPS://, rather than the non-secure HTTP://. The ‘S’ (unsurprisingly) stands for ‘Secure’.
Most people today are aware that they should never input their personal data or financial details into a web form that does not include HTTPS at the start of the page address, and this is for good reason. The details are securely encoded and make it very difficult or impossible for them to be intercepted.
If this wasn’t a good enough reason by itself, it’s also important to be aware that Google is now expecting to see SSL by default, and websites failing to use this level of security will be finding their SERPs ranking falling rapidly.
Protect Your Website From XSS Attacks
A Cross-Site Scripting or XSS attack is a unique kind of attack created to harm the users of the website instead of the website or server.
The attack is made by inserting malicious JavaScript code into the output of your website. XSS attacks can also target your website using other languages or scripts, including VBScript or CSS.
Hackers can insert this bad code into forums, cookies, search fields, or comment sections. If the text included in comment sections, forms, and other user-editable sections is not sanitized, this malicious code can end up being executed, causing any of a number of issues to result.
All the crucial user information like login data, website information, and session IDs are stored in the cookies that attackers can easily access after installing the malicious code.
You can use an up-to-date SDL (Security Development Lifecycle) to protect your website from XSS attacks. The SDL limits the number of coding errors in your web application.
One of the best ways to protect your website against XSS attacks is to use a content security policy (CSP). This is a mechanism in most browsers that’s designed specifically to reduce the chances of XSS attacks.
If the browser detects an application that exhibits harmful behavior, it lets CSP restrict resources, preventing the page from loading them and reducing the chances of an XSS attack.
Make Sure Your Email Transmission Ports Are Secure
Very commonly one of the main aims of attackers targeting your websites is to access your email system rather than using the actual website content.
It’s therefore very important to secure your email transmissions. To do this you can go to your email settings and see what kind of port you’re using. The email transmissions are not secure if you’re using IMAP Port 143, SMTP Port 25, or POP3 Port 110. Otherwise, POP3 Port 995, SMTP Port 465, and IMAP Port 993 are secure as they use encryption.
Keep An Eye On Suspicious File Uploads
Allowing the uploading of files to your website by users is always a huge risk as they can include a script that can potentially provide an open door for attackers. This applies to almost any kind of files, including pictures, photos, and avatars. If your website allows multiple file uploads from various users, you will have to treat every uploaded file with suspicion. The files extension contains a comment section that can be used to store a bad PHP code.
The best approach for preventing this kind of attack is to actually prevent users from being able to upload files directly to your website. Instead, use forms that include upload capabilities that allow the file to be uploaded to an external folder, separate from the main website files. You can then add a script that will identify the appropriate files in the external folder, and if they match the file type, can be viewed within the browser.
If you want to allow uploaded files, you can use secure transport methods such as SFTP or SSH. Running your database on a different server is also a good way to safeguard your web application.
Some cloud hosting servers provide a unique environment that lets you accept or reject file uploads depending on the visitor’s location. You can also block file uploads from particular countries or IP addresses and permit everything else.
Use a Website Vulnerability Scanner
Using website vulnerability scanners such as Acunetix is another good way to figure out technical weaknesses, along with weaknesses that can lead to XSS attacks or SQL injection.
While looking for a website vulnerability scanner make sure you check that the scanner works continuously, and is automatically updated with the latest known vulnerabilities. Good support is a must, and do take the time to check reviews, and how recently it was updated.
Which WordPress Security Plugin Is Right For You?
It’s never going to be a one solution fits all when it comes to security. But having said that, it really doesn’t matter whether your website is a small business site run by you alone, or a medium or even large business with hundreds of employees. Security is a non-negotiable must.
The addons and advice we’ve included here will certainly go a long way to giving you peace of mind, giving your visitors the reassurance that you’re taking the security of their data seriously, and making Google aware that your website is worth ranking.
Let us know in the comments below if you have any questions or recommendations, and which security plugin you prefer!
