We all know that WordPress is mighty powerful and extremely popular. It is used for simple blogs to full blown ecommerce sites – as well as providing the content for many Facebook Business Pages. But, one frightening fact remains: It is extremely vulnerable to the scoundrels out there who love breaking in..

Beyond the obvious risk of installing WordPress in it’s famed “5 Minute Install” without changing any of the defaults – the worst thing you can do – there are many weaknesses with WordPress. However, none that can’t be tightened up in your favour.

The more plugins and theme variations etc that you add to your WordPress install makes it more and more vulnerable simply because you really DO NOT KNOW for sure that the plugins and themes stack up against hackers (and believe me, there are a lot of hackers out there just waiting to dive in and trash all your hard work for kicks or to prove how clever they are).

Here’s a quick run-through of the things you should / could do to make sure your WordPress install can’t be hacked and precautions you can take to minimise any potential damage if it ever did happen (ie: the first one, Backups!):

A quick side step:
The more of this you do manually (without the use of plugins) the better!

Right, here we go – in no particular order…

• Backup your WordPress install and database regularly.
• Stay up to date with the latest WordPress version.
• Keep your own computer virus free to prevent files you transfer being infected.
• Limit the number of plugins you install.
• Disable user registration if you don’t need it.
• Get a better username than the default ‘admin’ (defaults are dangerous).
• Keep your backup files hidden away!
• Use WordPress Security keys when you install.
• Use a secure FTP connection if possible.
• Set-up Google Alerts for your blog so you know if anyone has maliciously posted to it.
• Limit the number of attempts allowed to get the login password right.
• Rename your WordPress database prefix (do not use the default ‘wp_’).
• Restrict access to any sensitive directories.
• Limit access to your login page.
• Limit access to your registration page.
• Limit access to wp-admin.
• Ensure your .htaccess file can’t be tampered with.
• Make sure your wp-config.php file is locked away from any view.
• Remove the WordPress version number!
• Change where your files are located.
• Remove anything like “Powered by WordPress 3.1″ (it’s a dead giveaway you’re using WordPress).
• Set-up a proper robots.txt file and use NO-INDEX appropriately.

That will keep you busy for a day or two…