WordPress is the most widely used web publishing platform on the internet, allowing customers to easily add and update content, often without having to write code or learn advanced web development.

However, because it is so widely used, and because WordPress includes a login structure, it can be vulnerable to hacking and compromise. 

Here are three easy steps you can take to secure your website!

First, make sure you’re applying all available updates.  There are routine updates to WordPress itself, but also frequent updates to plug-ins and themes.  You should update each of these, even if the plugins and themes aren’t in use.  Intruders will attempt to exploit security vulnerabilities in outdated themes to access your site.

If you don’t log into your website frequently, you can install plugins to either automatically run updates or to notify you when updates are available.

Second, use proper account and password security. 

• Avoid using common names for the username, i.e. admin, user, manager.  Admin, in particular, is often set up by default on WordPress sites, making it a common way for attackers to try to brute-force your login. 
• Short, simple passwords should be avoided.  Use long passwords with multiple numbers, letters and special characters (ie. !@#$).  Every character you add increases the security of your passwords and your site. You can use free services like Strong Password Generator to help you generate complex passwords.
• When you log into your WordPress dashboard, go to Users and create a new account with a new username and a strong password.  Then, log out and back in with your new account, and delete any accounts that have ‘admin’ as the username, or any that are unneeded or seem insecure.
• If you are worried about using and remembering many complex passwords, consider using a Password Manager app.  More information can be found here.

Third, a security plugin is a welcome addition to any website.  There are a number of powerful, free security plugins available in WordPress, including iThemes Security and WordFence.  These plugins will block unwanted login attempts, filter out IPs that are exhibiting malicious behaviour and scan your site for vulnerabilities.  While these plugins often have a paid or premium version, the free version is usually sufficient.  You can review the product and decide if you need extra protection.