Securing your WordPress sites
summary
WordPress security is framed as three concrete layers: the human (mindset and passwords), the devices/networks used, and the WordPress/host stack. Key facts: WordPress powers ~28% of sites and >50% of the top 10k, and audits find at least half of breached sites running outdated installs with many breaches tied to plugins. Defenses: use SFTP not FTP, enable two‑factor auth, run WPScan regularly, enforce HTTPS, remove unused plugins, block PHP execution in uploads, keep host patches current and keep reliable backups.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:05Statistics
- 2:27Common misconceptions
- 4:17Why FTP is bad
- 7:27Passwords
- 8:30Devices
- 9:22Hardness
- 10:05Enable 2FA
- 10:50Capture
- 11:29Backup
- 12:07Attack vectors
- 14:19WordPress obscurity
- 15:40Hosting
- 16:05OS
- 17:33QA
- 25:10Blacklist database
related talks
36mHow the WordPress Ecosystem Handles Security and What You Can Learn from It
34mSecure WordPress Without Coding Skills
22m5 Tips To Optimise WordPress To Be Faster and More Secure
14mIt's a Jungle Out There: The Security State of CMS Platforms
43mI Had WordPress, but It Got Hacked
44mI've Been Hacked, Now What
08mPractical web security
34mPrepare(): Introducing Novel Exploitation Techniques in Wordpress