WordPress Security Guide for Bangladesh Website Owners
SNBD Host Team
WordPress security isn't a technical luxury — it's table stakes for any website owner in Bangladesh. WordPress powers a massive share of the web, which makes it a high-value target for automated attacks. Bots scan millions of sites every day looking for outdated plugins, weak passwords, and exposed login pages. Your site is not too small to be attacked. If it runs WordPress, it will eventually be probed.
The good news is that 90% of successful WordPress hacks exploit preventable issues — outdated software, reused passwords, or missing basic protections. This guide covers the practical steps that actually matter, in order of importance.
Update Everything, Always
This is the single most important thing you can do. Outdated WordPress core, outdated themes, and outdated plugins are responsible for the vast majority of successful WordPress compromises. Security vulnerabilities are discovered regularly and patched quickly — but only your sites with the patched version are protected.
Enable automatic updates where possible:
- Go to Dashboard → Updates — WordPress lets you enable automatic minor and major core updates
- For plugins, go to Plugins → click "Enable auto-updates" next to each plugin you trust
- For themes, do the same under Appearance → Themes
Some people avoid auto-updates because they're worried about breaking changes. This is a real risk, but it's smaller than the risk of running unpatched software. Mitigate it by running backups (covered below) so you can restore if an update causes issues.
Use Strong, Unique Passwords Everywhere
Brute force attacks try thousands of username/password combinations per second. If your admin password is "bangladesh123" or your business name followed by a year, a bot will crack it. No exaggeration.
Rules for WordPress credentials:
- Admin password: At least 20 characters, random. Use a password manager (Bitwarden is free) to generate and store it.
- Admin username: Never use "admin" — it's the first thing bots try. When you installed WordPress, you should have set a custom username. If you used "admin," create a new administrator account with a unique username, then delete the "admin" account.
- Database password: This is set in your cPanel and should also be long and random. Don't use the same password as your WordPress admin.
- cPanel password: Separate strong password, again stored in a password manager.
- Email account passwords: Your WordPress admin email is a recovery path — if it's compromised, your site is compromised. Secure it with a strong password and two-factor authentication.
Install a Security Plugin
A security plugin handles several protections automatically. The two most commonly used free options are:
- Wordfence Security — includes a web application firewall (WAF), malware scanner, login protection, and real-time threat intelligence. The free version covers most small sites adequately.
- Solid Security (formerly iThemes Security) — focuses more on hardening and login protection; less emphasis on firewall but good configuration options.
Install one (not both — they can conflict). For most Bangladesh site owners, Wordfence is the better starting point because it gives you visibility into attack attempts, which is useful for understanding what's happening.
After installing Wordfence, run its setup wizard, then go to Wordfence → Scan and run a full scan. If your site has been running without security protection for a while, this will tell you if anything is already wrong.
Limit Login Attempts
By default, WordPress allows unlimited login attempts. This means bots can try thousands of passwords without being stopped. Fix this immediately.
Wordfence includes brute force protection in its firewall. If you're not using Wordfence, install the Limit Login Attempts Reloaded plugin. Set it to lock out an IP after 5 failed attempts for 20 minutes, then permanently after repeated lockouts.
You can also change your WordPress login URL from the default /wp-admin or /wp-login.php to something custom using Wordfence's "Hide Login" feature or a dedicated plugin like WPS Hide Login. This doesn't stop a determined attacker but eliminates most automated scanning bots.
Enable Two-Factor Authentication
Two-factor authentication (2FA) means that even if someone gets your password, they can't log in without a second verification code. This is one of the most effective security measures available.
Wordfence has 2FA built in for WordPress logins. Enable it under Wordfence → Login Security. You'll scan a QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, or Authy — all free) and then enter a 6-digit code on each login.
Set this up for all admin-level WordPress users. It adds about 5 seconds to your login process and prevents a huge category of attacks.
Keep SSL Active and Enforced
SSL encrypts data between your visitor's browser and your server. Without it, login credentials, form submissions, and payment information travel in plaintext that can be intercepted. Every site in Bangladesh should be running on HTTPS.
SNBD HOST provides free Let's Encrypt SSL with all hosting plans. Verify it's active by checking that your site loads with a padlock icon in the browser bar.
Once SSL is active, force all traffic to HTTPS. In WordPress, go to Settings → General and ensure both URLs start with https://. Also add HTTPS redirect rules in your .htaccess (or ask SNBD HOST support to do it):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]LiteSpeed Cache plugin also has an option to force HTTPS under its CDN settings if you prefer not to touch .htaccess.
Set Up Automated Backups
Backups don't prevent attacks, but they're your recovery plan when something goes wrong. Without a recent backup, a compromised site can mean losing months of content, customer data, or order history.
Set up UpdraftPlus (free plugin) to back up automatically:
- Install and activate UpdraftPlus
- Go to Settings → UpdraftPlus Backups → Settings
- Set backup schedule: Files every week, Database every day
- Set remote storage: Google Drive or Dropbox (free). This is critical — backups stored only on your hosting server are lost if the server is compromised.
- Run a manual backup immediately and verify it works by checking your Google Drive
SNBD HOST also keeps server-level backups, but don't rely solely on hosting provider backups — maintain your own copies in a separate location.
Protect wp-config.php
wp-config.php contains your database credentials and security keys. By default it's in your WordPress root directory, accessible to PHP but not directly via browser (WordPress blocks direct access). Add an extra layer of protection via .htaccess:
<files wp-config.php>
order allow,deny
deny from all
</files>Add this to the .htaccess file in your WordPress root directory. It prevents any web request from accessing wp-config.php directly.
Disable File Editing in WordPress Admin
WordPress has a built-in code editor that lets you edit theme and plugin files from the Dashboard. If an attacker gets admin access, this editor lets them inject malicious code into your site in seconds. Disable it by adding this line to wp-config.php:
define('DISALLOW_FILE_EDIT', true);Most site owners never use the in-dashboard file editor anyway — FTP or cPanel's File Manager are better tools for the rare times you need to edit files directly.
Remove Unused Themes and Plugins
Every inactive plugin or theme is a potential attack surface. Vulnerabilities are discovered in plugins even when they're deactivated — the files are still there. Go through your installed plugins and themes, deactivate anything you're not actively using, and delete it.
Keep only what you need. A WordPress installation with 8 active plugins is much easier to secure than one with 35.
Monitor Your Site
Wordfence sends email alerts for suspicious activity — failed logins, malware detected, plugin vulnerabilities. Make sure these emails go to an address you actually check.
Also set up UptimeRobot (free) to check your site every 5 minutes and alert you if it goes down. A sudden outage can indicate a compromise, and faster detection means faster recovery.
Security is ongoing, not a one-time setup. Check Wordfence's dashboard once a month, run plugin updates as they arrive, and your site will stay protected against the overwhelming majority of automated attacks targeting WordPress sites in Bangladesh.