Site Security Tips

Website security goes beyond installing updates and choosing strong passwords. It also means limiting the information hackers can gather before they ever attempt to log in.

WordPress user accounts can be a target because they provide a possible path into the website. At Firefly Marketing, we use a combination of secure account practices, login protections, and ongoing reviews to make that path much harder to follow. 

User enumeration occurs when someone searches publicly accessible areas of a WordPress website to identify valid usernames. 

Author pages, website addresses, and certain WordPress data feeds can sometimes reveal the names associated with active accounts. Automated bots can collect this information quickly. Once a valid username is identified, attackers can concentrate on guessing the password, testing credentials stolen in previous data breaches, or creating more convincing phishing messages.

• We review each client website for common sources of username exposure and may disable author archives, restrict public access to user information, or add further enumeration protection. 
• We test the website while logged out, viewing it as a public visitor or automated bot would, to confirm that common entry points do not reveal active usernames. .

WordPress allows each user to have a login username, nickname, and public display name. When all three are the same, an author name shown on a blog post may unintentionally provide an attacker with a valid login credential.

Generic usernames such as “admin,” “editor,” a company name, or an employee’s first name are easy for bots to guess. A public display name that matches the login username can also reveal information that should remain private.

• When we create client accounts, we avoid obvious username patterns and choose login information that is less predictable while remaining manageable for the authorized user.
• We configure nicknames and public display names so they do not match private login usernames, and we safely update existing accounts when changes are needed.

Not everyone who updates a website needs full control over it. Giving every user Administrator access increases the potential damage caused by a compromised account. It can also make accidental changes more likely.

A WordPress Administrator can install plugins, change settings, manage users, and alter important website functions. An Editor can update pages and publish content without having access to many of those sensitive areas.

• We generally create client accounts with Editor access, providing the tools needed to manage routine content while protecting critical website settings.
• Administrator access is granted only when it is specifically requested and necessary, with added safeguards such as two-factor authentication when appropriate.

Strong passwords are essential, but no password should be the only barrier protecting a website. Automated attacks can repeatedly test passwords and credentials obtained through data breaches. Even a strong password may become vulnerable if it is reused elsewhere or accidentally disclosed.

Old accounts create another concern. Former employees, previous vendors, and temporary contractors may retain access long after they no longer need it. Each unused account represents another set of credentials that could potentially be compromised.

• Firefly uses multiple layers of login protection, combining WP Engine’s server-level safeguards with protections managed within WordPress, such as stronger password requirements, login attempt limits, custom login addresses, and two-factor authentication. 
• During website launches and maintenance audits, we review active accounts, confirm appropriate permission levels, and remove outdated users who no longer need access.

No single plugin, password, or setting can prevent every attack. Strong security requires ongoing attention and a thoughtful approach to how users access and interact with the site. 

Much of this work happens behind the scenes. However, each step removes information or access that an attacker might otherwise use, helping make your website a more difficult target and a more dependable tool for your business.