How to Secure Your WordPress Installation on Shared Hosting Print

Securing your WordPress site is crucial, especially on shared hosting where multiple websites share the same server environment. Here are essential steps you can take to protect your WordPress installation hosted with Hosteons:

1.  Keep WordPress Updated

• Always run the latest version of WordPress.

• Regularly update themes and plugins.

• Outdated software is a common target for attackers.

2. Use Strong Login Credentials

• Use a strong username (avoid “admin”) and a complex password.

• Limit login attempts using plugins like Limit Login Attempts Reloaded.

• Enable two-factor authentication (2FA) for an extra layer of security.

3. Install a Security Plugin

Use a trusted security plugin such as:

• Wordfence

• Sucuri Security

• iThemes Security

These plugins help monitor your site for suspicious activity and protect against common threats.

4. Change the Default Login URL

By default, your login URL is yourdomain.com/wp-login.php. Changing it can help block automated attacks.

You can use plugins like WPS Hide Login to customize the login URL safely.

5. Disable File Editing via Dashboard

Add the following line to your wp-config.php file to disable theme and plugin file editing via the dashboard:

define('DISALLOW_FILE_EDIT', true);

6. Secure wp-config.php and .htaccess

Restrict access to sensitive files by adding these rules to .htaccess:

<Files wp-config.php>
order allow,deny
deny from all
</Files>

<Files .htaccess>
order allow,deny
deny from all
</Files>

7. Use SSL (HTTPS)

• Enable SSL for your website using a free Let’s Encrypt certificate from your Hosteons control panel.

• HTTPS encrypts all data transferred between your website and its visitors.

8. Regular Backups

Use plugins like UpdraftPlus or Jetpack to schedule automatic backups.

Also, download backups periodically and store them securely.

9. Set Proper File Permissions

Ensure the following permissions:

• Files: 644

• Folders: 755

• wp-config.php: 600 (if supported by the server)

You can manage file permissions via the File Manager in DirectAdmin or an FTP client.

10. Disable Directory Indexing

Add this line to your .htaccess file:

Options -Indexes

This prevents visitors from seeing a list of files in directories without index files.

Need Help?

If you need help implementing these changes, feel free to contact our support team at https://my.hosteons.com.