Wordfence Live: 10 WordPress Security Mistakes You Might Be Making

While we are all human and we all make mistakes, it’s a lot easier to learn from the mistakes of others. And when it comes to the security of your WordPress website, learning from others’ mistakes -- and from the security experts at Wordfence -- can help you make better decisions about your WordPress site security. We’re here to run down the top 10 security mistakes we’ve seen people make with their WordPress site.

11:24 #10: Changing the login URL as a false sense of security
16:00 #9: Not using SSL/TLS certificates on your WordPress site
19:00 #8: Using "admin" as your WordPress administrative username
22:30 #7: Using weak passwords
24:05 #6: Not using a Web Application Firewall like Wordfence
41:18 #5: Using insecure hosting
44:50 #4: Poor user access management
48:13 #3: Using nulled plugins or themes
49:54 #2: Reusing passwords in multiple locations
51:28 Mistake #1: Not updating WordPress plugins, themes or WordPress core
55:00 A visit with Wordfence CEO Mark Maunder

---------------------------------------------------------
---------------------------------------------------------
Have you tried Wordfence Central? Manage all of your site's security in one easy-to-use interface.

Now, with Wordfence Central Teams! You can use Wordfence Central with your Premium AND Wordfence free sites, all for free.
---------------------------------------------------------
Check out Fast or Slow, the only free website speed profiler that tests your site from 18 locations worldwide.
---------------------------------------------------------
Sign up for the Wordfence WordPress Security mailing list. Be the first to know when there is a vulnerability in a plugin or theme you might be using.
---------------------------------------------------------
The Wordfence Learning Center has all you need to brush up on WordPress security and more:
---------------------------------------------------------
Wordfence is the most popular choice of WordPress professionals for WordPress security. We have a number of security tutorials on our YouTube channel, including Wordfence tutorials. Wordfence security plugin is the number one choice in WordPress security plugins.
---------------------------------------------------------
#wordfence #wordpress #security
---------------------------------------------------------

[johnybonny]

Thats useful and informative ....
Keep it coming 🧡🧡🧡🧡🧡

[pgutierrez]

Subscribed to this channell! Hope to see the next Wordfence Live!

[rubengalvis]

Thanks guys, Always watch your videos and tips. From Barcelona Spain.

[ramonalashbrook]

Good morning from Titusville, FL - Go ULA/ Go SpaceX

[mzosama]

Is it recommended to install Wordfence on every WordPress Account if all WP accounts hosted on the same server?

[carlodimaandal]

I think hiding your login url is ok. It's bad if it's the ONLY login security measure you use. I hide my login urls AND have other security measures in place (not using "admin", using 2fa, etc...)

[homeschoolgems]

We dropped about 95% of attacks simply by hiding the login address. For such a simple act we saved a lot of time and concern. Still believe in 2 step authentication etc.

[Rupamforever]

The official AMP plugin is removing Wordfence Scripts. Is this something to worry about? I need AMP.

[ehrichweiss]

Using htpasswd isn't a great idea if you are simply blocking all of wp-admin(which most people do) because some plugins, including your own I think, use the login under wp-admin in order to do their job.

[AwakenedEssence]

Nothing beats 60 days block on one failed login in attempt in the WFence settings. Obviously 2FA and whitelist your fixed IP. Mobile IPs tend to change almost daily (here in Oz). Ya just gotta be careful, or it's a SFTP login to rename the Wordfence directory to deactivate it and ok yourself (then SFTP the directory back so it's works again) or tether/hotspot your phone so it's a different IP. Simple and brutal...

[roxcastaneda]

Chloe is very good, but her recomendations are a bit difficult to follow up for us who do not know coding.