In 2018 WordPress is still the world’s most popular content managing system for designing and running websites, especially for businesses and individuals that are not primarily concerned with web design or IT. The reason is that WordPress is one of the easiest systems to use with most of the technical configuration work done for you. If you are not necessarily technology-minded but just want to set up a website that is secure, good to look at and works, then you will probably use WordPress to do this.
Security first
Of course with any website, security has to be your first consideration. That is especially the case if you are running an e-commerce site or any other website that enables financial transactions with your customers or clients. If your site is compromised then you are putting the sensitive personal and financial information of those people and organizations at risk. Once you start handling personal data you are responsible for taking care of it securely and ensuring that it doesn’t fall into the wrong hands. Failure to do so will reflect very badly on your brand and will negatively affect your organization’s reputation in the future.
High standards
That also applies if your site arranges payments to others in the form of prizes or winnings. The Lotto Gopher serving California is a website that has to take security extremely seriously, as it is in the position of running and managing the California Lotto. Millions of people use the site every week, divulging their personal information with the trust that it will not be misused or vulnerable in any way. Frankly, there’s no excuse for other sites dealing with financial transactions of any kind not to meet the same high standards.
Best protection
Wordfence is still one of the best all-round security plug-ins for a WordPress site, but you might also want to consider Defender, which comes with Log-in protection, security monitoring and full checks on any other themes and plug-ins that you’re running. It also comes with 10GB of snapshot automated backups.
Optimization
Hummingbird optimizes your content and files for best performance, and is able to compress files, monitor performance, cache past history and integrate with the Cloudflare content delivery network (CDN) which offers the best protection against denial of service attacks. Smartcrawl is a great plug-in for search engine optimization, while Smush Pro compresses and automatically resizes images on your site, preventing them from slowing down your performance. Finally, WP-Optimize focuses on keeping your MySQL database fast, clean and efficient.
No spam
It’s always a good idea to have a means for visitors to your website to contact you with queries, requests or information. If nothing else, an easy-to-find contact form inspires trust. But it can also be one of the easiest ways to hack into your site, so it pays to choose your contact plug-ins with care. Contact Form 7 is a good choice for a free secure contact form that is user-friendly, especially when paired with Akismet, the anti-spam plug-in that automatically detects malicious threats.
Proceed with caution
It certainly pays to be choosy when deciding on themes and plug-ins for your WordPress site. WordPress itself is a very secure and well-run system, but adding third-party software can be a major source of vulnerabilities. The more non-WP plug-ins and themes you use, the more security risks you run. And remember your website doesn’t have to be a big success to be a target. Hackers use automated tools that literally trawl the web for vulnerable sites, attacking any that are easy to exploit, big or small.
Choose a good host
Beyond dodgy themes and plug-ins, the second most common cause of WordPress sites being compromised is lax security on the part of the web host. That is something you can’t do anything about; all you can do is to choose your hosting service carefully. Too many run their systems on outdated software that isn’t properly maintained or updated, so if a vulnerability appears it can’t be effectively patched.
WordPress itself recommends BlueHost, which is most compatible with WordPress-running sites. It’s certainly secure and will configure smoothly with WordPress management systems, saving you a lot of technical headaches. Otherwise, SiteGround is one of the best shared hosting servers, with a good history of solid protection procedures and fast, effective responses to attacks and vulnerabilities.
Building a website using WordPress is easy, but making sure it’s secure is more difficult, especially if you’re not an IT specialist. Hiring a website developer can be expensive but can be the best idea. Otherwise, the above plug-ins coupled with best practice should give you basic protection and a certain amount of peace of mind.