- Keep the application, PHP and plugins updated.
- Use strong, unique admin passwords and two-step verification.
- Point the domain to the
publicfolder only. - Turn debug mode off.
- Use HTTPS everywhere.
- Make automatic backups and test restoring one.
- Give staff only the permissions they need.
- Limit login attempts and use a captcha.
- Watch the activity log for unusual actions.
- Remove software you no longer use.
0 comments