Skip to main content

Security Best Practices

Keep your WordPress site secure when using BracketSpace plugins with these essential security guidelines and best practices.

WordPress Care & Insurance Policies

BracketSpace offers comprehensive WordPress insurance policies that take care of updates, monitoring, and security for you. Let our experts handle the technical aspects while you focus on your business. Learn more at care.bracketspace.com.

Plugin Security Features​

Built-in Security Measures​

Our plugins include several security features:

  • Input Sanitization: All user input is properly cleaned
  • Output Escaping: Data output is escaped to prevent XSS
  • Nonce Verification: CSRF protection for all forms
  • Capability Checks: Proper user permission verification
  • SQL Injection Prevention: Parameterized database queries

Security Updates​

  • Automatic Updates: Keep plugins updated for security patches
  • Vulnerability Monitoring: We actively monitor for security issues
  • Responsible Disclosure: Report security issues privately
  • Quick Response: Security patches released within 24-48 hours

WordPress Security Hardening​

Core WordPress Security​

Keep WordPress Updated​

  • Latest Version: Always use the latest WordPress version
  • Automatic Updates: Enable automatic updates for minor versions
  • Test Updates: Use staging site for major version testing

Strong Authentication​

  • Complex Passwords: Use strong, unique passwords
  • Two-Factor Authentication: Enable 2FA with plugins
  • Limit Login Attempts: Prevent brute force attacks
  • Change Default Username: Don't use "admin" as username

Database Security​

  • Unique Prefix: Change default "wp_" table prefix
  • Database Passwords: Use strong database passwords
  • Database Backups: Regular automated backups
  • Separate DB User: Limited permissions for WordPress database user

File System Security​

  • File Permissions: Set correct permissions (folders 755, files 644)
  • wp-config.php: Move outside web root or set permissions to 600
  • Disable File Editing: Add define('DISALLOW_FILE_EDIT', true);
  • Remove Default Files: Delete readme.html, license.txt

Safe Update Procedures​

Before Updating Plugins​

Preparation Steps​

  1. Full Site Backup: Complete backup of files and database
  2. Staging Environment: Test updates on staging site first
  3. Check Compatibility: Review plugin changelogs
  4. Maintenance Mode: Put site in maintenance mode during updates

Backup Strategy​

  • Automated Backups: Daily automated backups
  • Multiple Locations: Store backups off-site
  • Test Restores: Regularly test backup restoration
  • Version Control: Keep multiple backup versions

During Updates​

  1. One at a Time: Update one plugin at a time
  2. Test Functionality: Check features after each update
  3. Monitor Logs: Watch for error messages
  4. Quick Rollback: Be ready to restore from backup

After Updates​

  1. Functionality Test: Verify all features work
  2. Security Scan: Run security scan after updates
  3. Performance Check: Monitor site speed
  4. Clear Caches: Clear all caching after updates

Server Security​

Hosting Security Features​

Choose hosting with these security features:

  • SSL Certificates: Free SSL certificates included
  • DDoS Protection: Built-in DDoS mitigation
  • Malware Scanning: Regular server-level scanning
  • Intrusion Detection: Real-time threat monitoring
  • Isolated Environments: Account isolation

Server Configuration​

Apache Security​

# Disable server signature
ServerSignature Off
ServerTokens Prod

# Protect wp-config.php
<Files "wp-config.php">
    Require all denied
</Files>

# Disable directory browsing
Options -Indexes

Nginx Security​

# Hide Nginx version
server_tokens off;

# Protect wp-config.php
location ~* /wp-config.php {
    deny all;
}

# Disable access to sensitive files
location ~* \.(log|sql|conf)$ {
    deny all;
}

PHP Security Settings​

  • display_errors: Off in production
  • expose_php: Off to hide PHP version
  • allow_url_fopen: Off to prevent remote file inclusion
  • file_uploads: Only if needed
  • max_execution_time: Reasonable limits

Data Protection​

Sensitive Data Handling​

  • Encryption: Sensitive data encrypted at rest
  • Secure Transmission: HTTPS for all data transfer
  • Access Logs: Monitor who accesses what data
  • Data Retention: Remove old data regularly

GDPR Compliance​

  • Data Collection: Only collect necessary data
  • User Consent: Clear consent for data processing
  • Data Portability: Allow users to export their data
  • Right to Deletion: Ability to delete user data
  • Privacy Policy: Clear privacy policy

Backup Security​

  • Encrypted Backups: Password-protect backup files
  • Secure Storage: Store backups in secure locations
  • Access Control: Limit who can access backups
  • Regular Testing: Test backup integrity regularly

Monitoring and Alerting​

Security Monitoring​

Set up monitoring for:

  • Failed Login Attempts: Too many failed logins
  • File Changes: Unauthorized file modifications
  • Malware Detection: Suspicious code patterns
  • Plugin Updates: Available security updates
  • SSL Certificate: Certificate expiration dates

Alert Configuration​

  • Email Notifications: Security event alerts
  • Slack/Discord: Real-time team notifications
  • SMS Alerts: Critical security incidents
  • Dashboard Monitoring: Security status overview

Incident Response​

Security Breach Response​

If you suspect a security incident:

Immediate Actions​

  1. Change All Passwords: WordPress, hosting, FTP, database
  2. Scan for Malware: Full site malware scan
  3. Check User Accounts: Review all user accounts
  4. Review Recent Changes: Check recent file modifications
  5. Update Everything: WordPress, themes, plugins

Investigation Steps​

  1. Check Access Logs: Review server access logs
  2. Identify Entry Point: How did they get in?
  3. Assess Damage: What was compromised?
  4. Clean Up: Remove malicious code
  5. Strengthen Security: Close the vulnerability

Recovery Process​

  1. Restore from Clean Backup: If needed
  2. Apply Security Patches: Fix vulnerabilities
  3. Monitor Closely: Watch for reinfection
  4. Document Incident: Learn from the experience
  5. Improve Security: Implement additional measures

Best Practices Checklist​

Daily Security Habits​

  • Monitor security alerts and notifications
  • Check for available updates
  • Review access logs for suspicious activity
  • Verify backups completed successfully

Weekly Security Tasks​

  • Run security scans
  • Review user accounts and permissions
  • Check SSL certificate status
  • Update plugins and themes

Monthly Security Review​

  • Full security audit
  • Review and update passwords
  • Test backup restoration
  • Update security documentation
  • Review access permissions
WordPress Care & Insurance Policies

BracketSpace offers comprehensive WordPress insurance policies that take care of updates, monitoring, and security for you. Let our experts handle the technical aspects while you focus on your business. Learn more at care.bracketspace.com.

Emergency Contacts​

  • Hosting Support: Your hosting provider's emergency line
  • Security Expert: Trusted security professional
  • BracketSpace Support: Contact us
  • WordPress Security: WordPress security team contact

Remember: Security is not a one-time setup but an ongoing process. Stay vigilant, keep everything updated, and follow these best practices to maintain a secure WordPress site.