Web Tools – Hosting Affinity https://hostingaffinity.com Web Hosting Reviews & Comparisons Wed, 30 Sep 2020 12:02:51 +0000 en-US hourly 1 https://wordpress.org/?v=5.9 https://hostingaffinity.com/wp-content/uploads/2018/08/cropped-hosting-affinity-site-icon-3-150x150.png Web Tools - Hosting Affinity https://hostingaffinity.com 32 32 How To Enhance WordPress Security With Two-Factor Authentication https://hostingaffinity.com/2020/09/30/how-to-enhance-wordpress-security-with-two-factor-authentication/ Wed, 30 Sep 2020 12:02:51 +0000 https://hostingaffinity.com/?p=4566 Read more]]>

You should indeed invest in the security of your WordPress website. Websites are prone to security threats. Taking precautionary measures, tightening security, and regular maintenance go a long way in keeping your WordPress website secure. In this article, we will explain how you can enhance the security of your WordPress website with two-factor authentication.

What is Two-factor authentication?

First, let’s understand what authentication is for a website. Whenever you enter the user name and password on any website, the website checks the username and password combination. If it matches, you get access to the website. The same thing happens when you try to log in to your WordPress website. Since your user name and password is the only way for your website to authenticate your unique identity, this form of authentication is called one-factor authentication, the factor being the username-password combination.

With two-factor authentication, another layer of authentication is added. In this method, you need to input a six-digit number sent to your device whenever you try to log in to your website. Since this code is only available on your device for a short period of time, it is difficult for hackers to impersonate you. This is the second layer of authentication that ensures that it is really you who is trying to log in to your WordPress website.

Two-factor authentication is an advanced measure of authentication that goes beyond traditional username-password combination. Passwords can be guessed, broken into with brute force attacks. Relying on just password authentication is not secure. You should add the extra layer of security to your login page with two-factor authentication.

The Pros of Two-Factor Authentication

The critical feature of two-factor authentication is that you get the six-digit code to your personal device. This means that even if someone tries to hack into your website, the attacker will have to gain access to your personal device.

With two-factor authentication, guessing the password is no longer enough. This comes in handy when your password is compromised. The extra step of entering the authentication code adds an extra layer of security so that you can be perfectly sure of your login attempts. This also ensures that you are less prone to online frauds when your WordPress website is concerned.

Another interesting benefit of two-factor authentication is that it reduces the sharing of user accounts. Even if users exchange their usernames and passwords, they will still need to enter individual credentials unique to their device.

The Cons of Two-factor Authentication

Everything has pros and cons. Two-factor authentication is no exception. The first disadvantage of two-factor authentication is that there is no guarantee that your factor of authentication will be available to when you need it. If anything happens to your smartphone (down because of low battery, damaged by water, or malfunctioning in any way) and you are not able to get the code, logging in to your website will be very difficult.

Access to your smartphone cannot always be ensured. It may get stolen or become inaccessible due to myriad reasons. With this loss, you also lose access to your second authentication layer. It becomes difficult to regain access to your WordPress website. For such cases, we recommend using a WordPress security and maintenance service that can take care of WordPress security.

With both the pros and cons in mind, let’s see how you can add two-factor authentication to your WordPress website.

Step 1: Get Authenticator App for Your Device

There are many services that offer authentication, e.g. Google Authenticator, Authy, LastPass Authenticator, etc. You can use any of them.

Here for demonstration purposes, we will explain how to use Google Authenticator.

Just head over to Play Store (Android) or Apple Store (iOS)  from your mobile device and install Google Authenticator.

Step 2: Install a Two-Factor Authenticator Plugin on your WordPress site

There are a couple of two-factor authentication plugins available for free.

Here are a few popular plugins:

  1. Two Factor
  2. Google Authenticator – WordPress Two Factor Authentication
  3. Wordfence Login Security
  4. Two Factor Authentication by Updraft

Steps to enable two-factor authentication are very similar for each of these plugins.

Let’s illustrate with the ‘Two Factor’ plugin.

Step 3: Configure The Plugin

Download and install the plugin.

Go to Users>>Profile, and find the ‘Two-Factor Options’ tab.

From here, you can configure multiple authentication options, such as:

  • Email codes
  • Time-Based One-Time Passwords (TOTP)
  • FIDO Universal 2nd Factor (U2F)
  • Backup Codes

Once enabled, you will get a notification to enter verification code from your device next time you try to log in to your website.

Every app listed above shows a similar screen where the plugin asks you to enter the verification code. With your verification code, you can securely log in to your WordPress website.

That’s it! Your WordPress website is now ready with two-factor authentication. Also, make sure that you use a secure WordPress host to ensure safety from all types of security threats.

If you enjoy this extra layer of security, do share your experience with us. Have any questions? Please reach out; we are here to help.

]]> How to Force HTTPS in WordPress Without Any Coding https://hostingaffinity.com/2019/07/27/force-https-wordpress-without-coding/ Sun, 28 Jul 2019 00:35:09 +0000 https://hostingaffinity.com/?p=3331 Read more]]>

Recently I came across a serious issue on a new client website. The unsecured HTTP version of their site was not automatically redirecting to the SSL secured version. This posed a risk in more than one way. Not only did this mean user data went unprotected if someone ended up on the HTTP version of the site, but the overall SEO of the domain was being negatively impacted as well. Its important to force HTTPS on WordPress to provide a secure browsing experience for your visitors.

What is SSL and HTTPS?

Secure Sockets Layer (SSL) is a standardized security technology that creates and encrypted link between a users browser and the web server a site is hosted on.

Hyper Text Transfer Protocol Secure (HTTPS) is the protocol used to secure communication between these two systems (server and browser). HTTP is the same protocol, just unsecured. When the communication between the server and browser is left unsecured, potential vulnerability to data loss and attack is created.

In order for the HTTPS protocol to be enabled on a website, that site must have a valid SSL certificate enabled. Luckily for us, many hosting providers offer a free basic SSL certificate included in their hosting plans.

Why it is important to redirect HTTP to HTTPS on WordPress sites

As I mentioned above, redirecting your WordPress site from the HTTP version to the secure HTTPS version is essential for a few reasons:

  • Protect your website visitors – By forcing your website to redirect the unsecured HTTP version to the safe SSL version, you are protecting your website visitors’ data being transferred between their browser and your server.
  • A valid SSL provides trust – web browsers indicate when a website has a valid SSL certificate in place or not and will alert visitors if a site is not secured. Recently, Google Chrome has begun completely blocking unsecured websites with a large warning for the visitor asking if they really want to proceed.
  • Required for PCI compliance – if you are ever hoping to accept payment on your website, a valid SSL certificate is a requirement of the Payment Card Industry (PCI) standards to do so.
  • SEO ranking factor – a secure HTTPS website will always been seen as more trustworthy than an unsecured HTTP site by the major search engines, thus receiving a higher ranking.

How to redirect to https

Luckily, its extremely easy to redirect http to https in WordPress. To do this, we recommend using a stupid easy plugin called Really Simple SSL.

  1. Login to your WordPress dashboard
  2. Download the free version of the Really Simple SSL from their website or the WordPress.org repository
  3. Upload, install and activate the plugin
  4. Go to the Really Simple SSL settings. Make sure ‘Mixed content fixer’ and ‘Enable WordPress 301 redirection to SSL’ sliders are both set to active. Click save.
  5. Check the configuration tab to ensure your SSL certificate is detected and enabled on your site

Download the Really Simple SSL plugin for free.

download really simple ssl to force https wordpress

Upload, install and activate the plugin in WordPress.

install really simple ssl wordpress plugin

Configure Really Simple SSL settings. Activate Mixed content fixer and Enable WordPress 301 redirection to SSL

how to redirect to https

Check the Configuration tab to make sure SSL is detected and enabled.

redirect http to https wordpress

💪That’s it! Your site will now force your visitors to use your dedicated SSL certificate.

]]>