Introduction

WordPress is a popular choice for creating websites, but with its popularity comes the risk of security threats. Hackers and cybercriminals are constantly on the lookout for vulnerabilities in WordPress sites to exploit and gain access to sensitive information. While security plugins can provide an added layer of protection, it’s possible to create a secure WordPress site without relying on them. In this article, we’ll explore the steps you can take to create a secure WordPress site without using security plugins.

Step-by-Step Guide

Creating a secure WordPress site without security plugins requires a combination of good practices, configuration, and coding. Here’s a step-by-step guide to help you achieve this:

Step 1: Choose a Secure Web Host

The first step in creating a secure WordPress site is to choose a secure web host. Look for a web host that uses a secure connection (HTTPS) and has a good reputation for security. Some popular secure web hosts include WP Engine, SiteGround, and Kinsta.

Step 2: Use Strong Passwords and Salted Hashes

Weak passwords are a common vulnerability in many WordPress sites. To create strong passwords, use a password manager like LastPass or 1Password to generate and store unique passwords for each user. Additionally, use salted hashes to store passwords securely.

Code Sample:

<?php
function password_hash($password, $salt) {
  return hash('bcrypt', $password . $salt, false);
}

$password = 'your_password_here';
$salt = 'your_salt_here';
$hashed_password = password_hash($password, $salt);
?>

In this code sample, we’re using the password_hash function to hash a password using a salt. The hash function uses the bcrypt algorithm to generate a secure hash.

Step 3: Lock Down the Login Page

The login page is a popular target for hackers. To lock down the login page, use a combination of strong passwords, IP blocking, and CAPTCHA.

Code Sample:

<?php
function login_lockdown() {
  // Block IP addresses from known hacking servers
  $known_hacking_servers = array('192.168.1.1', '192.168.1.2');
  $visitor_ip = $_SERVER['REMOTE_ADDR'];
  if (in_array($visitor_ip, $known_hacking_servers)) {
    die('Access Denied');
  }

  // Require strong passwords
  $required_password_length = 12;
  $required_password_complexity = true;
  if (!preg_match('/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d).{'. $required_password_length .'}$/', $_POST['password'])) {
    die('Invalid Password');
  }

  // Require CAPTCHA
  require_once 'captcha.php';
  $captcha_code = $_POST['captcha_code'];
  if (!check_captcha($captcha_code)) {
    die('Invalid CAPTCHA');
  }
}

add_action('wp_login_failed', 'login_lockdown');
?>

In this code sample, we’re using the login_lockdown function to block IP addresses from known hacking servers, require strong passwords, and require CAPTCHA. The add_action function is used to hook the login_lockdown function into the WordPress login process.

Step 4: Keep WordPress and Plugins Up to Date

Keeping WordPress and plugins up to date is crucial for security. Regular updates often patch security vulnerabilities and fix bugs.

Code Sample:

<?php
function update_plugins() {
  $plugins = get_plugins();
  foreach ($plugins as $plugin) {
    if ($plugin['Version'] != $plugin['Latest']) {
      update_plugin($plugin['Name']);
    }
  }
}

add_action('wp_update_plugins', 'update_plugins');
?>

In this code sample, we’re using the update_plugins function to check if any plugins need to be updated. The get_plugins function retrieves a list of installed plugins, and the update_plugin function updates the plugin. The add_action function is used to hook the update_plugins function into the WordPress update process.

Step 5: Use Secure Connections (HTTPS)

Secure connections (HTTPS) are essential for preventing man-in-the-middle attacks and ensuring data integrity.

Code Sample:

<?php
function secure_connection() {
  if (!is_ssl()) {
    wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
    exit;
  }
}

add_action('wp', 'secure_connection');
?>

In this code sample, we’re using the secure_connection function to check if the site is using a secure connection (HTTPS). If not, it redirects the user to the secure connection. The add_action function is used to hook the secure_connection function into the WordPress loop.

Step 6: Limit Login Attempts

Limiting login attempts can help prevent brute-force attacks.

Code Sample:

<?php
function limit_login_attempts() {
  $login_attempts = get_option('login_attempts');
  if (!isset($login_attempts) || $login_attempts < 3) {
    $login_attempts = 3;
  }
  set_option('login_attempts', $login_attempts);
  if ($login_attempts > 3) {
    die('Too many login attempts. Please try again later.');
  }
}

add_action('wp_login_failed', 'limit_login_attempts');
?>

In this code sample, we’re using the limit_login_attempts function to limit the number of login attempts. The get_option function retrieves the current login attempts, and the set_option function sets the new login attempts. If the login attempts exceed the limit, it displays a message. The add_action function is used to hook the limit_login_attempts function into the WordPress login process.

Step 7: Monitor Site Activity

Monitoring site activity can help detect suspicious behavior and prevent attacks.

Code Sample:

<?php
function monitor_site_activity() {
  $activity_log = get_option('activity_log');
  if (!isset($activity_log)) {
    $activity_log = array();
  }
  $activity_log[] = array(
    'timestamp' => time(),
    'action' => $_SERVER['REQUEST_METHOD'],
    'referrer' => $_SERVER['HTTP_REFERER'],
    'user_agent' => $_SERVER['HTTP_USER_AGENT']
  );
  set_option('activity_log', $activity_log);
}

add_action('wp_footer', 'monitor_site_activity');
?>

In this code sample, we’re using the monitor_site_activity function to monitor site activity by logging requests to the site. The get_option function retrieves the current activity log, and the set_option function sets the new activity log. The add_action function is used to hook the monitor_site_activity function into the WordPress footer.

FAQ

Q: Can I still use security plugins if I choose to create a secure WordPress site without security plugins? A: Yes, you can still use security plugins, but they may not be necessary if you follow the steps outlined in this tutorial.

Q: Is it possible to create a completely secure WordPress site without any vulnerabilities? A: No, it is not possible to create a completely secure WordPress site without any vulnerabilities. However, by following the steps outlined in this tutorial, you can significantly reduce the risk of security breaches.

Q: Can I use this code on my existing WordPress site? A: Yes, you can use this code on your existing WordPress site. However, you may need to modify the code to suit your specific needs.

Conclusion

Creating a secure WordPress site without using security plugins requires a combination of good practices, configuration, and coding. By following the steps outlined in this tutorial, you can significantly reduce the risk of security breaches and create a more secure WordPress site. Remember to always keep your WordPress and plugins up to date, use strong passwords and salted hashes, and monitor site activity to ensure your site remains secure.