Ensure the Security of your WordPress Install

If you run WordPress we recommend you take the following actions for each WordPress site in your account to help ensure the security of your data:

1. Before performing any updates or other major changes, Please follow the backup procedures outlined in the following articles:
   1. Backup Your Database
   2. Backup Your Site
2. Ensure that each of the WordPress sites in your account is running the current version of WordPress.
3. Ensure that the WordPress config file (wp-config.php) for each WordPress site in your account does not have the  “other” or “Public” read and write permission bits turned on. The “other” read and write permissions are not necessary for WordPress sites to function. You can use an FTP client to manage this permission. The numerical value for this file’s permissions should be 670.
4. Inspect your WordPress “users” panel for all users that have “Administrator” listed as their role. Change the password for all of the WordPress users with the “Administrator” role in the WordPress “users” panel.  Any unfamiliar users with the “Administrator” role should be deleted.  This can be accomplished from the WordPress Administration Panel (/wp-admin).
5. Change the WordPress database password (the password that the WordPress application uses to connect to the database server) and update the wp-config.php file with the new password. You can reset the database password through the hosting Control Panel at https://www.websitesettings.com. Click on the features tab and then click the database you want to work with. You will see the database user name near the bottom of the page. click on it to manage the password.

As usual, if you are uncomfortable with doing this yourself, please contact us. We are happy to help.