Managing a WordPress site is no small feat. Website owners have to stay up to date with the latest vulnerabilities that can attack a website. WordPress is a highly targeted system according to Sucuri, a well-respected website security firm. There are a lot of best practices for managing a WordPress site, that can help prevent individuals from accessing the website. What are these and how can a business implement these best practices? We will discuss three baseline best practices and what you need to do in order to keep your website safe and up to today’s security standards.

1. Keep Plugins Updated

The first golden rule is to keep all plugins up to date. An approach we take with customers is to have two separate websites, one will be the public facing website and the other will be the development website. Why do we incorporate two different websites? Simple, all change requests are made on the development server in order for the customer to view. We can test if a WordPress plugin breaks the site on an update or causes other components to dysfunction. Once the customer and developer have deemed all components on the site work as expected, we can move on to the quality assurance and review phase. From here, the customer will review the website, with all of the plugin updates, and verify all components are in perfect harmony. Performing the plugin updates on the beta website can be an excellent method to verify all content on the website is displayed correctly, forms are working accordingly, and no issues are occurring after the plugin update. Keeping the plugins up to date is a great WordPress management tip, which helps prevent possible attacks through an outdated plugin. There have been vulnerabilities found within plugins that have been reported throughout the WordPress community. As soon as a plugin update is available, make sure you do so. Maintain all plugins to ensure your website is secured the highest level.

 Bonus Tip: Not only is keeping WordPress plugins updated necessary, the same goes for WordPress themes and the WordPress core system.

2. Install A Backup Solution

Backups, backups, backups. How many times have you heard to backup your data? If you have been working with computers the one tip most professionals continuously communicate is back up your data. Same goes for a WordPress website. Backup is an essential component of a website and without a proper plan in place, the day a website crashes can cause a five alarm fire for all parties involved. With the proper tools and services implemented into the website, an effective backup solution will help alleviate any data lost on the website. A plugin we highly recommend for customers is VaultPress. Excellent plugin for backing up and restoring website data. Learn more about VaultPress in a previous blog post we discussed the plugin in more detail. To put it simply, VaultPress is a simple click of a button and the previous day’s site will be populate on the existing site. It really is that simple. Unfortunately, there are many different vulnerabilities found on a weekly, if not daily, basis that have yet to be discovered or announced to the public. The saying goes, better to be safe than sorry, and with backups this is absolutely true. If you are looking for a free alternative, UpdraftPlus Backup and Restoration is an efficient alternative for a free plugin.

 Bonus Tip: A backup solution can help with making sure the site is backed up on scheduled basis and saved to services like Dropbox or Amazon Storage services.

3. Secure Logins

Malicious hackers look for are weak security logins and virtual back doors that remain open. A tip is have long passwords, more than 12 characters, mixed with numbers, letters, an special characters. This makes the hackers job more frustrating into attempting to gain access to your website. There are many ways of preventing hackers from gaining access to the WordPress back end, but we will discuss one of our favorite methods. Implementing two-step verification is a great way to deter hackers. The benefit of two-step verification comes from the name, there are two-steps required in order to log into the WordPress dashboard. The WordPress admins or users types in the password associated with the WordPress site, which is followed by a code that is texted to the mobile device attached to the user’s profile. Six Revisions has an in-depth explanation on how to setup two-step verification. The main purpose of two-step verification is to prevent anonymous individuals from successfully guessing the password to the WordPress site or using brute force to log in. Even though the process is an extra 20 seconds, having the piece of mind knowing there is an additional step that prevents access from strangers will help WordPress admins and website owners sleep well at night.

 Bonus Tip: We touched on having a complex password. Be sure to incorporate a 12 characters or more password with a mix of capital and lowercase letters, numbers, and special characters.

Recap

• Keep all plugins updated and then test with the copy of the website known as a development or beta site.
• Implement a backup solution to protect website data. This will come in handy when the time comes, hopefully never though.
• Two-step login verification is another method to deter hackers from gaining access to the website.

We’d love to hear what other WordPress individuals like to use when managing a WordPress site. Let’s have a discussion in the comments section below!

In the early days of WordPress, the platform was considered insecure and unstable. Most companies did not want to place their business site on the platform. The stigma has slowly dwindled away with big corporations adopting the platform for a high end website. WordPress.org has a showcase of enterprise size companies who have designed sites on WordPress. The platform is powering sites such as the New York Times and the kings of rock n roll The Rolling Stones. There have been some scares this past year most notably the highly publicized XSS vulnerability that affected dozens of plugins, including Gravity Forms and Jetpack – and people started to worry again. The way to manage a WordPress site is to make sure all of the plugins, themes, and core files are up to date to the most stable version.

Let’s discuss best practices for site updates:

• Why is it important to keep your site up-to-date
• Best practices to keep the website updated to the most stable version
• Which components need to be updated

Why It Is Crucial to Keep WordPress Updated

The obvious reason you should be updating the website is security. Each update patches bugs that have been newly discovered during the newest iteration of the platform. Hackers are always looking for vulnerabilities in a system and the goal of the update is to find these bugs before anybody else and squash them. A content management system (CMS) that powers more than 20% becomes a target for individuals to look for security holes. Whether these holes are found in themes, plugins, or core files, making sure the components are on the latest version provides a peace of mind. Customers we have interacted with in the past have had dozens of updates that need to be pushed out and when pushing out the updates the customer is assured the site is up to date and more secure. A good example to compare these updates with Windows update. You receive a little notification about updates that are required to be run in order to provide the highest possible security.

When we encounter a site, the first action item we perform is an audit on the back end of the site. If there are numerous updates that need to take place, the best plan is to clone the current site and perform these updates on a test server. We’ll discuss this in more detail in the next section. The point is make sure you have an updated site were all security holes are plugged and can prevent any damage to the website.

Updates aren’t just for security. More often than not an update will improve the performance of WordPress itself or of a plugin or theme. When WordPress releases an update performance to the site may improve. For example, there may be code within the platform that had been used in the past, but has been slowly useless and becomes obsolete. This allows the engine for the site to improve and run faster. Same goes for theme or plugin updates, performance can improve. Whether the author removed unnecessary code that slowed down the site or updated the code to run faster, the update will help increase the performance of the site. The faster the website, the more likely visitors will interact and engage with the content.

Lastly, updates can squash bugs that have lingered within a plugin, theme, or WordPress itself. These are potential bugs on the back end that gets cleaned up. Bug squashing is not a sexy task, but necessary to make sure the code is clean and the consumer does not experience any issues now and in the long run.

Best Practices To Keep WordPress Updated Completely

With the importance stressed in the previous section about keeping your site updated, we will provide some great steps in order to keep your site updated without any issues occurring. We will provide a high level overview of what we perform for our customers. To get the details of setting up a WordPress site and how to setup a stage website, you can read the article by Patrick Garman.

To begin, the best idea of working with a website is to have a copy of the website on a separate server, we call this a stage website. A stage website is an exact copy of the production website, but only accessible from the development team and the customer. The stage website acts as the development environment where code changes are made and components are updated to determine if anything breaks the site. The best aspect of having a staging environment is the ability to break anything and have no consequences. For example, if a plugin, theme, or core update is pending, you can test the update on the development site and make sure all components look good. On the other side, if an update is pending and pushed on the development site and components begin to break, chances are you know what happen and can resolve the issue almost immediately. The good news is the development server went down and not the main website. Having the development site helps prevent a fire alarm for all parties involved.

The staging site is a trick website developers have been using for quite some time. The practice provides developers and customers to test new feature changes on the stage site before the production (public facing) site see’s the changes. It ensures a smooth transition were all features are quality assured before seeing the light of day.

What Components Need To Be Updated?

As a WordPress website owner, you know how important it is to keep the website updated and ways to test updates when needed. Let’s discuss in more detail all of the components involved for updating. Starting with plugins. Plugins are defined by WordPress as a way to extend and add to the functionality that already exists in WordPress. There are numerous types of plugins, everything from converting a regular WordPress site into an eCommerce site to adding a simple contact form. By keeping WordPress plugins updated, you ensure all components are working on the latest version and prevent most security vulnerabilities. Updating a plugin can help with enhancing the website’s speed. The developers who manage these plugins are continuously modifying and stripping unnecessary code from the plugin, which in turn will help increase site load speed. Same argument can be said about theme and WordPress updates. By being on the latest version, you ensure the site’s security and enhance the site’s speed.

Whether the updates be the plugins, website’s theme, or WordPress core files, having the site updated to the most stable version provides peace of mind. Keep the website up to date and always ensure you are the safest you can be with having the site updated.