10 Steps to Secure Your WordPress Blog From Hackers

1. Use strong, unique passwords, for your blog plus your other accounts.

You may groan at the idea of different passwords for every site, but ask
yourself whether you would rather remember passwords or deal with the
aftermath of being hacked. Passwords should be eight characters or more
and contain a mix of letters, numbers, and symbols. Try mnemonics like
substituting symbols for letters in words, or use a password generator.
But please don't rotate between the same two or three passwords, and
don't use common words with exclamation points at the end.

2. Post as "editor" instead of "administrator."
Editor accounts can
create, modify, and edit posts, but can't make changes to WordPress
itself. Create a new administrator account and disable access to the
default one to make it harder for hackers to infiltrate.

3. Keep WordPress up to date.
There will be a reminder on your Dashboard
if there is a new version available. Don't forget to update your plug-ins
also.

4. If applicable to you: Keep your server's system software updated with the latest bug fixes
and patches, and don't run beta software.
If you want to test something,
create a server you can use for experimentation. Old computers are great
for this purpose.

5. Use the WordPress Exploit Scanner Plug-In.
It's a good idea to run this utility on a regular basis.

6. Never access WordPress from public wireless networks.
Hackers
and their automated password-harvesting software often lurk there.
The
same advice goes for e-mail, Facebook, and especially your financial
accounts.

7. Keep the computers on your network free of viruses.
The easiest way to
do this is to follow my four steps to computer security: a security
software suite, a firewall, strong unique passwords, and a method for
updating of your software including your applications (Microsoft Office,
Adobe Reader, Flash, etc) and your operating system (Windows or Mac).

If you
are using free antivirus, consider a paid version. I used to recommend
the freebies, but I've seen so many infections in my consulting business
that I decided they don't offer adequate protection anymore.

8. Make backups of your blog.
There are a number of WordPress plug-ins
that compress your blog files into an archive which can be stored on
your local computer.

9. Monitor your server's logs.
If someone is trying to get in, you may
find the first evidence here.

10. Moderate comments, and never approve spam comments.
To tell if a
comment is spam, look for poor grammar and punctuation, web sites that
don't match e-mail addresses, foreign languages, lengthy lists of links,
and comments on ancient posts. When in doubt, don't approve.