The definitive guide to higher rankings for WordPress sites

WordPress is one of the best, if not the best content management systems when it comes to SEO. That being said, spending time on your WordPress SEO might seem like a waste of time, it most definitely is not. Optimizing your site to the best practices outlined in this article will help you improve your rankings, gain more subscribers and have a better website in general.
As we take quite a holistic view on (WordPress) SEO, meaning that we think good SEO should be engrained in all aspects of your online marketing and PR, this guide covers quite a lot of ground and is therefore a long read. Check out the table of contents below for some quick jumping around.

Updates to this WordPress SEO article

This article has been kept up to date with the best practices for WordPress SEO since early 2008 and the release of WordPress 2.5. The goal of this article is to let all the info of all the different articles we wrote about the topic, here and on other sites, fall into one big piece: the final WordPress SEO tutorial.
The first versions of this article were heavily based on using a plugin called HeadSpace and a series of other plugins. We’ve since released our own Yoast SEO plugin which replaces quite a few of those. That plugin has proven so powerful that sites like SearchEngineLand, and The Next Web now all use it. This Yoast SEO plugin is very stable and ready to use and this article now assumes you’re using it.

Get the most out of Yoast SEO, learn every feature and best practice in our Yoast SEO for WordPress training! »
$ 99 - Buy now » Info

If you’re using another SEO plugin, like All in One SEO pack or Ultimate SEO, but would like to switch and make use of our free and extremely powerful SEO plugin, we’ve written a migration guide for you. It’s a really easy process. If you’re not using an SEO plugin yet, grab our Yoast SEO plugin and get going.
As search, SEO, and the WordPress platform evolve we will continue to keep this article up to date with best practices. Be sure to subscribe to our WordPress & SEO newsletter to receive notification when we update this article.

Need your website reviewed?

If you need an outside look at your WordPress install, you might consider our website review. The results of this review contain a full report of improvements for your site, encompassing our findings for improvements in different key areas such as SEO to Usability to Site Speed & more. From only $699, you’ll receive a report that represents a much larger value in turn-over and profit. Get it now!

Table of Contents

• The definitive guide to higher rankings for WordPress sites
• 1 Basic WordPress SEO
  • 1.1 URLs
    • 1.1.1 Permalink structure
    • 1.1.2 WWW vs non-WWW
    • 1.1.3 Stop words
    • 1.1.4 To SSL or not to SSL
  • 1.2 Optimize your titles for SEO
    • 1.2.1 Controlling titles with the Yoast SEO plugin
    • 1.2.2 Optimizing individual posts
  • 1.3 Optimize your descriptions
  • 1.4 Image optimization
  • 1.5 XML sitemaps
• 2 Template optimization
  • 2.1 Breadcrumbs
  • 2.2 Headings
  • 2.3 Clean up your code
  • 2.4 Aim for speed
  • 2.5 Rethink that sidebar
  • 2.6 HTML sitemaps
• 3 Advanced WordPress SEO and duplicate content
  • 3.1 Noindex, follow archive pages and disable some archives
  • 3.2 Disable unnecessary archives
  • 3.3 Pagination
  • 3.4 Canonical
• 4 A site structure for high rankings
  • 4.1 Pages instead of posts
  • 4.2 New wine in an old bottle
  • 4.3 Linking to related posts
  • 4.4 Go easy on the tags
• 5 Conversion optimization
• 6 Comment optimization
  • 6.1 How you get people to comment
  • 6.2 Bond with your commenters
  • 6.3 Keeping people in the conversation
• 7 Off site blog SEO
  • 7.1 Follow your commenters
  • 7.2 Use Twitter
  • 7.3 Find related blogs, and work them
• 8 Measuring results
• 9 Conclusions on WordPress SEO

1 Basic WordPress SEO

Out of the box, WordPress is a pretty well optimized system, and does a far better job at allowing every single page to be indexed than every other CMS we have used. But there are a few things you should do to make it a lot easier still to work with.

1.1 URLs

1.1.1 Permalink structure

The first thing to change is your permalink structure. You’ll find the permalink settings under Settings → Permalinks. The default permalink is ?p=<postid>, but we prefer to use either /post-name/ or /category/post-name/. For the first option, you change the setting to /%postname%/:

To include the category, you select “Custom Structure” and change the value to /%category%/%postname%/. If you previously had ?p=<postid> as your permalink WordPress will take care of all the redirects for you. This is also true if you change from /%postname%/ to /%category%/%postname%/. If you change from any other permalink structure, you might want to consult our article on changing your WordPress permalink structure and the tool that you’ll find within it.

1.1.2 WWW vs non-WWW

You need to think about what you want your site to show up as, www.example.com or simply example.com. Make sure that in your general settings, under Settings → General, the version you want to show up is properly reflected:

Optimize your site for search & social media and keep it optimized with Yoast SEO Premium »
Buy now » Info

You will also want to set this correctly in Google Search Console. Make sure to set up your site with Google Search Console and set the preferred domain, you can find this setting under Settings → Preferred domain:

Where you can set it:

1.1.3 Stop words

The last thing you’ll want to do about your permalinks to increase your WordPress SEO, is remove so called stopwords. Words like “a”, “and”, “the” etc. As of version 1.1.6, our Yoast SEO plugin will automatically remove stop words from your slugs once you save a post, so you won’t get those ugly long URL’s when you do a sentence style post title.
This is generally not something you want to change after posts have gone live. If people have already linked to it, try to not change the permalink anymore and if you do, make sure the post is properly redirected. In most cases WordPress should redirect the old URL to the new one but if it doesn’t you need to make the redirect manually.

1.1.4 To SSL or not to SSL

In 2014, Google announced that they’d give a (admittedly minor) ranking benefit to HTTPS / SSL sites, and because of that, more and more sites have switched over to SSL. It might be a good idea for you too. If you want to move to SSL, we have an article with tips & tricks for moving to HTTPS right here.

1.2 Optimize your titles for SEO

The title, the contents of your page’s <title> tag,  is one of the single most important factors for ranking in the search results. Not only is it the literal title of the tab or browser window, it’s also the first line people see in the search results, followed by the URL (or the breadcrumb) and the snippet, usually the meta description combined with a date:

On many blogs, the title for blog posts is still “Blog title » Blog Archive » Keyword rich post title” or “Blog title » Keyword rich post title”. For your WordPress blog to get the traffic it deserves, this should be the other way around, for two reasons:

• Search engines put more weight on the early words, so if your keywords are near the start of the page title you are more likely to rank well.
• People scanning result pages see the early words first. If your keywords are at the start of your listing your page is more likely to get clicked on.

For more info on how to create enticing titles for your posts, read our article on crafting good titles for SEO.

1.2.1 Controlling titles with the Yoast SEO plugin

You can control your SEO titles with our Yoast SEO plugin. There are two parts of the plugin that control these. First of all, as soon as you install & activate the plugin, you get an SEO section in your admin. Navigate to SEO → Titles & Metas and you’ll see a bunch of tabs for different types of pages on your site. For each post type and taxonomy you can set a so called Title Template (as well as meta description templates but we’ll get to those later). For posts on our site this looks like this:

There’s a bunch of variables you can use in the titles and meta description, they’re all listed and explained in the help tab on the top right of the page. Be sure to check whether the template actually works and you’re not getting a duplicate site title for instance. If this is the case, you might need to check the “Force rewrite” checkbox on the same page or follow the instructions on that page to modify your template.
For the other pages, we have the following settings:

• Categories, Tags and other taxonomies: %%term_title%% %%sep%% Archives %%page%% %%sitename%%
• Search pages: You searched for %%searchphrase%% %%sep%% %%sitename%%
• 404 pages: Page not found - Error 404 %%sep%% %%sitename%%
• Author archives: %%name%% %%sep%% Author at %%sitename%%

There are some other cool features, for instance: you can use %%cf_<custom field name>%% to use a custom field, this can be either a post custom field, sometimes known as post meta value, or a user meta value. In this particular case it’s the custom field “role” we use to store the role of a user within our company.
The %%sep%% template code gets replaced by the separator you select on the first tab:

1.2.2 Optimizing individual posts

So now that we’ve set decent templates, we can start to optimize individual posts and pages. For that we use the snippet preview added by the Yoast SEO plugin:

This preview will automatically take the values you’ve already filled in in your blog post and apply them to your template, but you can also override the title completely using the title field just below it:

The input will show a warning below it if your title is becoming too long. The title length is not a fixed amount of characters but rather limited to the length of the display in the search results.
For titles the following things are important:

• They should always contain your brand, preferably at the end, so people may recognize you in consecutive searches.
• They should always contain the keyword you think is most important for the current post or page, which we’ll call the focus keyword from now on. The focus keyword should preferably be at the beginning of the title.
• The rest of the title should entice people to click.

1.3 Optimize your descriptions

Now that we’ve got proper titles, we should start to focus on meta descriptions. The meta description can be used by search engines to show in the snippet, it’s the black piece of text shown beneath the URL. The meta description is usually only used when it contains the keyword the searcher was searching for.
Some plugins use so-called “automated descriptions”. They use the first sentence of a post to fill the meta description by default. That’s not very smart. That first sentence might be an introductory sentence which has hardly anything to do with the subject.
Thus, the only well-written description is a hand written one, and if you’re thinking of auto-generating the meta description, you might as well not do anything and let the search engine control the snippet… If you don’t use the meta description, the search engine will find the keyword searched for in your document, and automatically pick a string around that, which gives you a bolded word or two in the results page.
Auto generating a snippet is a “shortcut”, and there are no real shortcuts in (WordPress) SEO (none that work anyway).
So, use the meta description field you find in the Yoast SEO plugin to write a meta description. Make sure it entices the reader to click through and make sure that it contains the focus keyword of your post or page at least once.
You’ll notice we do not mention meta keywords. We don’t use them and neither should you, for an explanation, read this article by Joost: meta keywords and why I don’t use them.

Content SEO: learn how to do keyword research, how to structure your site and how to write SEO friendly content »
$ 19 - Buy now » Info

1.4 Image optimization

An often overlooked part of WordPress SEO is how you handle your images. By doing stuff like writing good alt tags for images and thinking of how you name the files, you can get yourself a bit of extra traffic from the different image search engines. Next to that, you’re helping out your lesser able readers who check out your site in a screen reader, to make sense of what’s otherwise hidden to them.
Using the proper alt attributes for images is also something that is checked in the Page Analysis functionality of our Yoast SEO plugin. We have a longer article on Image SEO that will give you more tips to finetune this.

1.5 XML sitemaps

To tell Google and the other search engines that your site has been updated, you can use XML Sitemaps. Our Yoast SEO plugin contains an XML Sitemap module by default that you just have to enable. Go to Settings → XML Sitemaps and enable the XML sitemap (if it isn’t already on):

As soon as you hit Save, it’ll give you some options but in most cases you won’t need those. It generates an XML sitemap for all your posts, pages, custom post types and all your taxonomies like categories and tags and (if applicable) other custom taxonomies.
When you publish a new post or page, the XML sitemap is automatically submitted to Google & Bing allowing them to easily (and quickly) find your new content.
Other than most other XML sitemap plugins, this plugin doesn’t generate a static file, which is a very intensive process, especially for large sites. This means there is no “action” on publish, which slows down the publishing of the post. Instead it generates XML sitemaps as a sort of template using WordPress rewrites, which is much faster while also allowing caching plugins to cache the output.
It’s also being smart about splitting those sitemaps up into smaller bits, so Google only has to fetch one new XML “sub”-sitemap when a post is published, because the other sitemaps haven’t been changed, using the date modified options.
From an SEO perspective, it’s better than most others because it also includes the images in each post, which makes your images rank (better) in Google Image Search. It also integrates tightly with the rest of our SEO plugin, meaning that a no indexed post automatically is left out of the XML sitemap, with the option to “force” it in.
Lastly, it has a pretty complete API, allowing us and other developers to plugin extra sitemaps, which means we can do things like create our Local SEO, News SEO and Video SEO extension. These extensions respectively generate a news xml sitemap and video xml sitemap.

2 Template optimization

2.1 Breadcrumbs

You’ll want to add breadcrumbs to your single posts and pages. Breadcrumbs are the links, usually above the title post, that look like “Home > Articles > WordPress SEO”. They are good for two things:

• They allow your users to easily navigate your site.
• They allow search engines to determine the structure of your site more easily.

These breadcrumbs should link back to the homepage, and the category the post is in. If the post is in multiple categories it should pick one. For that to work, adapt single.php and page.php in your theme, and use the breadcrumbs from our Yoast SEO plugin. You find the settings for the breadcrumbs in the SEO → Internal Links settings page.

2.2 Headings

Although most themes for WordPress get this right, make sure your post title is an <h1>, and nothing else. Your blog’s name should only be an <h1> on your front page, and on single, post, and category pages, it should be no more than an <h3>. Your sidebar shouldn’t be crammed with <h2> and <h3>‘s either etc.
These are easy to edit in the post.php and page.php templates. To learn more about why proper headings are important read this article on Semantic HTML and SEO and our article about the Heading Structure for your Blog (from which a lot applies to non-blog WordPress sites too).

2.3 Clean up your code

All that javascript and CSS you might have in your template files, move that to external javascripts and css files, and keep your templates clean, as they’re not doing your WordPress SEO any good. This makes sure your users can cache those files on first load, and search engines don’t have to download them most of the time.

2.4 Aim for speed

A very important factor in how many pages a search engine will spider on your blog each day, is how speedy your blog loads. You can do three things to increase the speed of your WordPress.

1. Optimize the template to do as small an amount of database calls as necessary. We’ve highlighted how to do this in our post about speeding up WordPress.
2. Install a caching plugin. We recommend you use W3 Total Cache if you’re technically savvy or WP Super Cache if you’re not.
3. W3 Total Cache works even more magic when combined with a CDN like MaxCDN. Read more about WordPress CDN stuff here.

Also, be aware that underpaying for hosting, is not wise. If you actually want to succeed with your link-bait actions, and want your blog to sustain high loads, go for a good hosting package. We use VPS.net ourselves, and they’ve proven to be better than most everything we’ve seen in hosting, but we’ve got great experience with Synthesis too. If you want to know more be sure to read our article about WordPress hosting.

2.5 Rethink that sidebar

Do you really need to link out to all your buddies in your blogroll site wide? Or is it perhaps wiser to just do that on your front page? Google and other search engines these days heavily discount site wide links, so you’re not really doing your friends any more favor by giving them that site wide link, nor are you helping yourself: you’re allowing your visitors to get out of your site everywhere, when you actually want them to browse around a bit.
The same goes for the search engines: on single post pages, these links aren’t necessarily related to the topic at hand, and thus aren’t helping you at all. Thus: get rid of them. There are probably more widgets like these that only make sense on the homepage, and others that you’d only want on sub pages.
Some day you will probably be able to change this from inside WordPress, right now it forces you to either use two sidebars, one on the homepage and one on sub pages, or write specific plugins.

2.6 HTML sitemaps

For some sites an HTML sitemap might be nonsense, especially when your site is really a blog, for more corporate type sites with several levels of pages an HTML Sitemap might actually be very beneficial for both users and search engines. We’ve written an article on how to create an HTML Sitemap Page Template which would be a good start to get one going for your WordPress site.

3 Advanced WordPress SEO and duplicate content

Once you’ve done all the basic stuff, you’ll find that the rest of the problems amount to one simple thing: duplicate content. Loads of it in fact. Out of the box, WordPress comes with a few different types of taxonomy:

1. date based
2. category based
3. tag based

Next to that, it seems to think you actually need to be able to click on from page to page starting at the frontpage, way back to the first post you ever did. Last but not least, each author has his own archive too, under /author/<author-name>/, resulting in completely duplicate content on single author blogs.
In essence that means that, worst case scenario, a post is available on 5 pages outside of the single page where it should be available. We’re going to get rid of all those duplicate content pools, by still allowing them to be spidered, but not indexed, and fixing the pagination issues that come with these things.

3.1 Noindex, follow archive pages and disable some archives

Using the Yoast SEO plugin, make sure to prevent indexing (or even existence) of archive pages that do not apply for your site. You do this under SEO → Titles & Metas, where you’ll find the following options on the “Archives” tab:

The settings above are the settings for our site. As you can see, we’ve completely disabled the date based archives, as we don’t use those. Any date based link will redirect to our homepage because of this setting. We’ve left the author archives untouched, but we have set the subpages of those archives to be noindex, follow by default. So you’ll never land on page 2 of an archive on our site from the search engines (change this on SEO → Titles & Metas → Other tab):

On smaller sites it might make sense to noindex either the category or the tag structure, but in our experience noindexing those on yoast.com does little to no change at all.
There is one type of archive that is noindex,follow by default as well in the Yoast SEO plugin: the search result pages. This is a best practice from Google for which a setting is left out as you should just have that anyway.
A lot has changed in how Google handles paginated archives recently when they introduced their support for rel="next" and rel="prev" links. We’ve written an article about that: rel="next" and rel="prev" for paginated archives, which is a bit too technical to fully list here, but suffice to say our Yoast SEO plugin takes care of all the needed changes automatically.

3.2 Disable unnecessary archives

If your blog is a one author blog, or you don’t think you need author archives, use WordPress SEO to disable the author archives. Also, if you don’t think you need a date based archive: disable it as we have. Even if you’re not using these archives in your template, someone might link to them and thus break your WordPress SEO…

3.3 Pagination

Thirdly, you’ll want to make sure that if a bot goes to a category page, it can reach all underlying pages without any trouble. Otherwise, if you have a lot of posts in a category, a bot might have to go back 10 pages before being able to find the link to one of your awesome earlier posts…
There’s an easy fix, in fact, there are several plugins that deal with this. Our favorite one by far is WP-PageNavi, maintained by Scribu, one of the best WordPress developers around. If you have the Genesis Theme like we do here on Yoast.com, you can just enable numeric navigation under Theme Settings → Content Archives.

3.4 Canonical

In February 2009, the major search engines introduced the rel="canonical" element. This is another utility to help fight duplicate content. WordPress has built-in support for canonical link elements on single posts and pages, but it has some slight bugs in that. It doesn’t output canonical links on any other page. With our Yoast SEO plugin activated, you automatically get canonical link elements for every page type in WordPress.

4 A site structure for high rankings

Blogs are spidered so easily due to their structure of categories, tags etc.: all articles are well linked, and usually the markup is nice and clean. However, all this comes at a price: your ranking strength is diluted. They’re diluted by one simple thing: comments.

4.1 Pages instead of posts

You’ve probably noticed by now, or you’re seeing now, that this WordPress SEO post is actually… not a post. It’s a page. Why? Well for several reasons. First of all, this article needed to be a “daughter”-page of our WordPress page, to be in the correct place on this blog. Secondly, to rank for the term [WordPress SEO], this article has to have the right keyword density. And that’s where things go wrong. Comments destroy your carefully constructed keyword density.
That’s why we decided to make our most important articles into pages. That way, you can easily update them and do a new post about what you’ve changed.

4.2 New wine in an old bottle

If a post on your blog becomes incredibly popular and starts to rank for a nice keyword, like this one did for WordPress SEO, you could do the following:

• create a new page with updated and improved content
• change the slug of the old post to post-name-original
• publish the new page under the old post’s URL, or redirect the old post’s URL to the new URL
• send an e-mail to everyone who linked to your old post that you’ve updated and improved on your old post
• wait for the links to come in, again;
• rank even higher for your desired term as you’ve now got:
  • more control over the keyword density
  • even more links pointing at the article
  • the ability to keep updating the article as you see fit to improve on it’s content and ranking

Some among you will say: I could have 301 redirected the old post to the new one with the same effect. True. Except: you’d lose the comments on the old post, which is in our opinion a sign of disrespect to people who took the time to comment, and 301 redirects take quite a bit of time sometimes. Of course you should treat this technique with care, and not abuse it to rank other products, but we think it can be done in everyone’s benefit. For instance this article: if you came here through a social media site like Facebook, expecting an article about WordPress SEO, that’s exactly what you got!

4.3 Linking to related posts

One way of getting search engines to get to your older content a bit easier, thus increasing your WordPress SEO capabilites a LOT, is by using a related posts plugin. These plugins search through your posts database to find posts with the same subject, and add links to these posts.
There are quite a few related posts plugins but we tend to stick with custom code in our theme. A good alternative is a plugin which lets you manually pick related posts, like this one. This might cost a bit more time before you hit publish but might very well be worth your while.
There are also a lot of plugins that will automatically link certain keywords to certain posts. We do not like this at all as we find it to look very spammy.

4.4 Go easy on the tags

One of the most common issues we encounter on sites in our website reviews is the overuse of tags. Note that a tag in and of itself does not improve your SEO. The only way it improves your SEO is by relating one piece of content to another, and more specifically a group of posts to each other.

For good SEO, you need a good user experience. Learn about UX & Conversion! »
$ 19 - Buy now » Info

5 Conversion optimization

Get those readers to subscribe!

A lot of bloggers still think that because their blog is a blog, they don’t have to optimize anything. Wrong. To get people to link to you, they have to read your blog. And what do you think is easier: getting someone who is already visiting your blog to visit regularly and then link to your blog, or getting someone who visits your blog for the first time to link to your blog immediately? Right.
One of the things we’ve found to be very important, and more bloggers seem to have found this, is that an RSS subscribe button is very important, as is offering a way to subscribe by e-mail. We offer a weekly e-mail subscribe options, using MailChimp, and have found that people tend to click through on those the most.
Another thing to be very aware of is when people might want to subscribe to your blog. If they’ve just finished reading an article of yours, and really liked it, that would be the ideal time to reach them, right? That’s why more and more people are adding lines like this to the end of their posts: “Liked this post? Subscribe to our newsletter and get loads more!”
Another great time to get people to subscribe is when people have just commented on your blog for the first time, for which purpose we use our own comment redirect plugin. Which leads us to the next major aspect of WordPress SEO:

6 Comment optimization

Get those readers involved

Comments are one of the most important aspects of blogs. As Wikipedia states:

The ability for readers to leave comments in an interactive format is an important part of many blogs.

Comments are not only nice because people tell you how special you are, or that you made a mistake, or whatever else they have to tell you. Most of all they’re nice, because they show engagement. And engagement is one of the most important factors of getting people to link to you: they show you they care, and they open the conversation, now all you have to do is respond, and you’re building a relationship!

6.1 How you get people to comment

The easiest way of getting people to do anything is: ask them to do it. Write in an engaging style, and then ask your blog’s readers for an opinion, their take on the story etc.
Another important things is your comment links. Is your comment link “No comments »”? Or is it “No Comments yet, your thoughts are welcome »”? Feel the difference? You can change this by opening your index.php template, search for comments_popup_link() and changing the texts within that function.

6.2 Bond with your commenters

Another thing to do is thank people when they’ve commented on your weblog. Not every time, because that get’s annoying, but doing it the first time is a very good idea.
Justin Shattuck thought the same, and created the Comment Relish plugin which sends an email after someone has made his first comment, unfortunately, this plugin is no longer maintained. Another option, which is maintained and is also a bit less obtrusive / spammy, is to install our comment redirect plugin. This plugin allows you to redirect people who have made their first comment to a specific “thank you” page.

6.3 Keeping people in the conversation

Now that people have joined the conversation on your blog, you should make sure they stay in the conversation. That’s why you should install the subscribe to comments plugin, that allows people to subscribe to a comment thread just like they would in a forum, and sends them an e-mail on each new comment. This way, you can keep the conversation going, and maybe your readers will be giving you new angles for new posts.

Our SEO for WordPress eBook guides you through every aspect of Search Engine Optimization »
$ 25 - Buy now » Info

7 Off site blog SEO

If you’ve followed all of the above WordPress SEO advice, you’ve got a big chance of becoming successfull, both as a blogger and in the search engines. Now the last step sounds easy, but isn’t. Go out there, and talk to people online.

7.1 Follow your commenters

There’s been a movement on the web for a while now that’s called the “You comment – I follow“. They want you to remove the nofollow tag off of your comments to “reward” your visitors. Now we do agree, but… That get’s you a whole lot of spam once your WordPress blog turns into a well ranked blog… What we do advocate though, is that you actually follow your visitors! Go to their websites, and leave a comment on one of their articles, a good, insightful comment, so they respect you even more.
If you think that’s a lot of work, do realize that, on average, about 1% of your visitors will actually leave a comment. That’s a group of people you have to take care of!

7.2 Use Twitter

Twitter is a cool form of micro-blogging / chatting / whatever you want to call it. Almost all the “cool” people are on there, and they read their tweets more often than they read their e-mail, if you even knew how to reach them through e-mail.
To boot, if you use WordTwit or Twitter Tools, all of your posts can be announced on Twitter, which will usually get you quite a few early readers! People will feel even more happy to comment on Twitter, which might get you into an extra conversation or two.

7.3 Find related blogs, and work them

If you want to rank for certain keywords, go to Google, and see which blogs rank in the top 10 for those keywords. Read those blogs, start posting insightful comments, follow up on their posts by doing a post on your own blog and link back to them: communicate! The only way to get the links you’ll need to rank is to be a part of the community.

8 Measuring results

A good SEO campaign relies on not only implementing changes but also measuring the impact of those changes, seeing what works and doing more of that. Two great Analytics packages to measure results are Google Analytics and getClicky. Useful plugins for these analytical packages are MonsterInsights and our Clicky plugin.
You can also measure results by tracking rankings, the problem with rank tracking though is that it’s hard to determine “real” rankings because of personalized and localized search results. Really the best outcome of being great at WordPress SEO is to get more traffic.
Another great source of data is Google Search Console. One of the relatively simple tricks we always give people is the following:

• go into Search Console;
• go to “Your site on the web”, then “Search queries”.
• Click on “Download this table”.
• Open the CSV file you get in Excel.
• Replace all the instances of “<10” in the Clicks column with 9.
• Select the entire first row and click the filter button, usually the icon is a funnel:
  
• For the average position column, choose “greater than 5”, sort Ascending.
• Then for the “Clicks” column, sort Descending.

You now have the keywords people are finding you for in the results pages where you rank below #6 The fact that they clicked on your result proves that they found your result interesting: see if you can optimize any of those terms so you’ll rank higher than a #6 average rank: use the Page Analysis in our SEO plugin to improve the page, improve the copy, ask others to link to you, etc. Be sure to read our article about cornerstone content as well.

9 Conclusions on WordPress SEO

This guide gives you a lot of stuff you can do on your WordPress site. It goes from technical tips, to conversion tips, to content tips, to conversation tips, and a whole lot in between. There’s a catch though: if you want to rank for highly competitive terms, you’ll have to actually do most of it and create great and compelling content in the process.
If you want to keep updated on the latest news about WordPress, SEO and our plugins, then subscribe to our newsletter right now. You’ll get a free eBook!

The Basics of WordPress SEO for Designers: How to Improve Your Portfolio

This is a guest post by Pirate. 
Website optimization is not only a merely technical thing. You can do all the tagging, do your meta descriptions, keyword research and other handy things that we are going to touch a bit deeper in the article, but it would mean so much more if it’s supported by content.Your website is not supposed to be read by machines. They are here only to assist the transfer of information and knowledge between your WordPress blog or portfolio to your visitors. Following all the SEO guidelines for optimizing your portfolio must be accompanied with content. Visually appealing, informative, coherent and semantically correct content.

Focus for maximum effect

Even before you start creating the content for your website, the main thing you should keep thinking about is your target reader:

Who wants to know about what you are going to write?

If you plan on launching your idea, you must think that you have something to share with the world. The content needs to be aiming at a pretty narrow and particular sample of people.
You should picture a stage and you as the only performer on it. And down there, sitting in the hall is one single spectator. The material you are going to perform must be completely centered on that person. The same concept is valid for a website. Creating too diverse and heterogeneous content on your site will have poor conversion rate and not so great effect on your business.

Visual appeal to make it real

Design of your web content should be visualized as an enticing wrapping that will lure visitors’ attention to your content. However, this is a very tricky moment, because the wrapping needs to contain a tasty and easily digestible core.
Wasting time on high-class design will take you nowhere if the content itself is not relevant. On the border between your world of design and the realm of SEO lie your:

• projects,
• images,
• video content,
• templates,
• case studies.

And among the must-have content, you definitely need text, images, inspiring videos and tutorials.

Eye-engaging done right

When it comes to visual appearance of your portfolio, it is important to be moderate and witty with images. The best and only option here is posting your own photos. Generic photos or the ones you buy on stock sites seem as if you’re cheating.
Original photos related to your field of interest would show the visitors that your content comes from your internal motivation. Although being a part of the technology niche, the matter of visual attractiveness of a website can be partially looked at through artistic glasses.
Inviting textual content and eye-engaging visual genuineness make a perfect match in creating a captivating website visual identity.
Now that you know what people are attracted to, you should optimize those same visual and text elements for search engines.

Images and SEO

Web pages are often shared through social sites. Images are often used in Twitter Cards and in Facebook Open Graph and using WordPress SEO plugin to set these parameters for your website will ensure better click-through rates.
In order for your photos and images to speak clearly to search engines, you need to use:

• descriptive file names,
• descriptive alt tags,
• descriptive title tags,
• descriptive captions.

The magic word here is “descriptive“. It’s the only way for search engines to know what they’re looking at.
I’ve never found it too difficult to spend an extra couple of minutes on doing this right, as I’ve noticed the websites that get my attention, get it from Google, too.
File names and alt tags will certainly be noticed by the robots and title tags and captions will, well… capture your visitors’ attention. You’ll see results, believe me.

Technicalities

Yes, you’ll find that file size matters and that it directly influences your website speed. But, having “overoptimized” images won’t look nice from your visitors’ perspective, so for designers dealing with WordPress, I suggest you turn off that automatic image compression.
When it comes to alignment, I don’t need to tell you about this one. Every designer and usability geek knows that images shouldn’t break text alignment.
Your portfolio will be image heavy, then you can and should include your media in your XML sitemap. Yoast’s WordPress SEO plugin does this nicely. Even for images that reside in your custom post types and portfolios.

Projects, Portfolios and SEO

Search engines are getting better at figuring out what you’re on about, but they still get lost in translation. The universal translator called Schema is the one all search engines understand.
CreativeWork by Schema is a nice thing to add to your portfolios and aid search engines in understanding what benefits you can provide to people. They’ll thank you for helping them. You’ll get some nice traffic boost and better click-through rates once you implement it.
Schema and RDF breadcrumbs will show up in the search engine result pages and ensure better visibility and user experience of your WordPress website.
You can also try using ProfessionalService by Schema, which is a subset of Local Business vocabulary, in case you’d like to optimize your website locally, as well.

Content, keywords and SEO

Search engines will not be thrilled to notice an often recurring appearance of your keywords throughout the page, but this is sometimes unavoidable and you shouldn’t think too much about it. Just as you shouldn’t think too much about keywords when producing content for your designer’s portfolio or case studies.
The most moderate way of using them is in a few chosen sentences and in headlines. Also, every wise designer should know that the homepage is the SEO hub of their work, so make sure you’ve got enough text there explaining everyone what your services are.
This page has to give a concise but striking introduction to your site and the services you provide. Giving a title to every single page, as well as a short description will make the whole site more competitive and prominent. Your branding, which can be your name or your agency’s name, comes at the end of your title tags.
What users will see when a search engine points to your website is the description tag. That description should be the textual cherry on the top of your website. It will win over the internet users who see it when they come to your website and witness your unique and mind-opening content.

Recap

WordPress SEO for designers and creative agencies can be somewhat different, since you need to focus on visual content more than you do on your text. On-page SEO for these web elements will definitely help your portfolio get publicity via search engines. So get them right:

• Always use descriptive Alt tags and File names to make your photos search engine friendly.
• Always use descriptive Titles and Descriptions to make your photos user friendly.
• Use relevant images and videos to match your project descriptions.
• Use the best possible image quality.
• Implement Open Graph and Twitter Cards using WordPress SEO plugin.
• Use Image sitemaps (an XML sitemap generated by WordPress SEO plugin).
• Use RDF breadcrumbs and Schema.org vocabulary for your articles, portfolios and other creative work.

Caring about these details is guaranteed to set some distance between you and your fellow WordPress designers, but remember that the visual flair of your site and the quality of the content is what will make people actually hire you.

About the author: Dragan Nikolic is a WordPress copywriter and blogger for hire passionate about startups and minimalism.

Does WordPress Site Speed Really Matter for SEO?

Staying current with some SEO vs. WordPress site speed concerns can be a burden. After all, keeping on top of the various moving parts of a successful site is tricky enough, without worrying about which one of over 200 ranking signals is currently making a difference in the SERPs.
One SEO signal that’s gotten a lot of attention over the last few years is site speed. We all know we should be making our sites faster, but how much difference does it really make in terms of SEO? (more…)

Data Says: Is Building a Community Around Your WordPress Site Worth the Effort?

February 8th, 2016 • in WordPress SEO • by Bill Belew - 4 Comments

This is PART 3 of our short series titled “How Building a Community Around Your WordPress Site Can Improve SEO.”

• Can a Community Built Around Your WordPress Site Improve SEO? (Part 1)
• Step by Step: How to Build a Community Around Your WordPress Site (Part 2)
• Data Says: Is Building a Community Around Your WordPress Site Worth the Effort? (Part 3)

In this part, I want to return to the main question I started off with at the very beginning when I approached CodeinWP about writing this series of reports: (more…)

Step by Step: How to Build a Community Around Your WordPress Site

December 14th, 2015 • in WordPress SEO • by Bill Belew - 5 Comments

This is PART 2 of our short series titled “How Building a Community Around Your WordPress Site Can Improve SEO.”

• Can a Community Built Around Your WordPress Site Improve SEO? (Part 1)
• Step by Step: How to Build a Community Around Your WordPress Site (Part 2)
• Data Says: Is Building a Community Around Your WordPress Site Worth the Effort? (Part 3)

In the spirit of the many transparency reports we read here at CodeinWP, in this part, I want to share the step-by-step process I am using to build my community over at forum.billbelew.com (around my WordPress site at BillBelew.com). (more…)

Can a Community Built Around Your WordPress Site Improve SEO?

October 23rd, 2015 • in WordPress SEO • by Bill Belew - 11 Comments

This is PART 1 of our short series titled “How Building a Community Around Your WordPress Site Can Improve SEO.”

• Can a Community Built Around Your WordPress Site Improve SEO? (Part 1)
• Step by Step: How to Build a Community Around Your WordPress Site (Part 2)
• Data Says: Is Building a Community Around Your WordPress Site Worth the Effort? (Part 3)

Active communities – like online forums – are perhaps not the sexiest thing to talk about these days in terms of SEO. After all, Google wants us to believe that whatever content we create needs to come from us, needs to be unique, and the longer it is the better.But is it really the case? Is SEO a one blogger’s game? Or maybe we can do something to make our work easier, and give our WordPress sites a boost in an old-school way. Are forums and active user communities back?
Bill’s experience says they are. He has some really cool data to share, along with tutorials on how you can replicate his results and improve your SEO.Karol

Enter Bill Belew

Have you ever asked yourself, “How hard is it to get an army of people to create good content for me at my WordPress site?”
And, “If I could get my followers to do that, would it help me long term with SEO?”
Most importantly: (more…)

How to Boost Your Ecommerce SEO With a Few WordPress Tweaks

March 31st, 2015 • in Essential Tips and Tutorials for WordPress Beginners, WordPress SEO • by Karol K - No Comments

 This is a guest post by Catalin Zorzini.  Oh SEO, the dreaded three letters that make just about every ecommerce webmaster cringe. You look at Google and search for your keywords and realize that all of your sales depend on how well your site ranks on the first page, especially since 70 percent of users never scroll past the first page.You can grab one of the top notch ecommerce platforms for some nice SEO features, but this usually doesn’t solve all your problems. The key is making those little tweaks, the things that not everyone does to push you slightly above your competitors and improve your sales dramatically.
Everyone tries to optimize their sites, but it seems to be the simple things that help you improve overall and get over those one or two search engine spot hurdles you are yearning for.
Let’s take a look at a few WordPress tweaks to help boost your ecommerce SEO within a few minutes. (more…)

The Basics of WordPress SEO for Designers: How to Improve Your Portfolio

March 17th, 2015 • in Essential Tips and Tutorials for WordPress Beginners, WordPress SEO • by Karol K - One Comment

 This is a guest post by Dragan Nikolic.  Website optimization is not only a merely technical thing. You can do all the tagging, do your meta descriptions, keyword research and other handy things that we are going to touch a bit deeper in the article, but it would mean so much more if it’s supported by content.Your website is not supposed to be read by machines. They are here only to assist the transfer of information and knowledge between your WordPress blog or portfolio to your visitors. Following all the SEO guidelines for optimizing your portfolio must be accompanied with content. Visually appealing, informative, coherent and semantically correct content. (more…)

Squirrly SEO Plugin – What it Does and Does it Work

December 2nd, 2013 • in Best WordPress Plugins, Essential Tips and Tutorials for WordPress Beginners, WordPress SEO • by Tzvi Joffre - No Comments

SEO is the name of the game in online writing. SEO stands for Search Engine Optimization. Basically, it’s the idea of optimizing your site for visibility on search engines.

Usually to have good SEO, you have to check yourself constantly to make sure you’re putting keywords in all available places and optimizing their placement and usage. This takes constant concentration and a lot of time and effort. That’s where the Squirrly SEO plugin comes in. (more…)

Using Copy and Paste for SEO Purposes with WordPress

August 13th, 2013 • in Best WordPress Plugins, Essential Tips and Tutorials for WordPress Beginners, WordPress SEO • by Tzvi Joffre - One Comment

        As you’re browsing the web, what’s one of the main things that you’re always doing? You’re always copy and pasting. Links, pictures, emails; you name it, you’ve copy and pasted it. Being an owner or employee of a WordPress site, you’d like that when people copy and paste content from your site, you get some credit for your work and maybe even a little bit of automatic advertising. You’ve seen it done. You sometimes copy and paste something and something else shows up with it; a little tidbit of text with words like “Read more at:” and then a link back to where you got the content. Well now you too can use this incredibly useful function with WordPress.

function add_copyright_text() {
 if (is_single()) { ?>

<script type='text/javascript'>
function addLink() {
 if (
window.getSelection().containsNode(
document.getElementsByClassName('entry-content')[0], true)) {
 var body_element = document.getElementsByTagName('body')[0];
 var selection;
 selection = window.getSelection();
 var oldselection = selection
 var pagelink = "<br /><br /> Read more: <?php the_title(); ?> <a href='<?php echo get_permalink(get_the_ID()); ?>'><?php echo get_permalink(get_the_ID()); ?></a>"; //Change this if you like
 var copy_text = selection + pagelink;
 var new_div = document.createElement('div');
 new_div.style.left='-99999px';
 new_div.style.position='absolute';

body_element.appendChild(new_div );
 new_div.innerHTML = copy_text ;
 selection.selectAllChildren(new_div );
 window.setTimeout(function() {
 body_element.removeChild(new_div );
 },0);
}
}

document.oncopy = addLink;
</script>

<?php
}
}

add_action( 'wp_head', 'add_copyright_text');

Editorial Staff, wpbeginner
For PasteBin version of code above, see http://pastebin.com/HSr4tYJ4.

        All you have to do is take that code and paste it into Appearance > Editor > Theme Functions – functions.php in WordPress, and it’s up and running on your site. If you’re using a link shortening service such as tinyurl.com, change get_permalink to wp_get_shortlink.

        Well it’s all nice and everything that you can do that, but now you want to make another website and you really want to use this awesome tool. You go to your old site and begin the tedious job of searching through your functions.php file for the right bit of code. Why go through all that stress and time when you can just make a plugin in the first place that can be used with any theme or site?

Starting

        The first thing to do is fire up a text editor. Notepad or TextEdit will be fine. Open up with a PHP tag,

/*
Plugin Name: Copy and Paste Add-on
Plugin URI: N/A
Description: Adds on text to any copy and paste which backlinks to the specified site.
Original Code for Plugin Template: http://wpmu.org/how-to-create-your-own-super-simple-wordpress-plugins/
Original Code for Copy and Paste: http://www.wpbeginner.com/wp-tutorials/how-to-add-a-read-more-link-to-copied-text-in-wordpress/ 
Version: 1.0
Author: Tzvi Joffre
Author URI: N/A
License: GPL2
*/

Joe Foley, WPMU.org

For PasteBin version of code above, see http://pastebin.com/g6Tuv9RP.

The Main Part

        Just take the code and paste it right below the header. You don’t need to worry about the PHP closing tag. In this case, it should look something like this:

<!--?php
/*
Plugin Name: Copy and Paste Add-on
Plugin URI: N/A
Description: Adds on text to any copy and paste which backlinks to the specified site.
Original Code for Plugin Template: http://wpmu.org/how-to-create-your-own-super-simple-wordpress-plugins/
Original Code for Copy and Paste: http://www.wpbeginner.com/wp-tutorials/how-to-add-a-read-more-link-to-copied-text-in-wordpress/ 
Version: 1.0
Author: Tzvi Joffre
Author URI: N/A
License: GPL2
*/
if (is_single()) { ?>// <![CDATA[
function addLink() {
if (
window.getSelection().containsNode(
document.getElementsByClassName('entry-content')[0], true)) {
var body_element = document.getElementsByTagName('body')[0];
var selection;
selection = window.getSelection();
var oldselection = selection
var pagelink = "

 Read more:  <a href=''>"; //Change this if you like
var copy_text = selection + pagelink;
var new_div = document.createElement('div');
new_div.style.left='-99999px';
new_div.style.position='absolute';
body_element.appendChild(new_div );
new_div.innerHTML = copy_text ;
selection.selectAllChildren(new_div );
window.setTimeout(function() {
body_element.removeChild(new_div );
},0);
}
document.oncopy = addLink;
// ]]>

For PasteBin version of code above, see http://pastebin.com/kQcFmS9f.

Saving your File

        Make sure when you’re saving your file to put in the .php extension. If you name it copypasteadd, you need to save it as copypasteadd.php. If your text editor gets fussy, write it in parentheses “copypasteaddd.php.”

Finishing Up

        You’re going to want to use your plugin, so now let’s go over how to install it. You’re going to need an FTP program such as FileZilla and know how to use it. All you have to do is upload the plugin file to wp-content/plugins in your WordPress directory. Then go to Plugins screen and find the plugin in the list and click Activate Plugin. Once you’ve done that, you’re finished. Congratulations, you’ve now gone a step further in spreading the word about your site.

20 Super Tricks to Secure Your WordPress Website in 2017

This is a contribution by Ahmad Awais. 
I’ve seen many website owners nagging about the security of WordPress.The opinion is that an open source script is vulnerable to all sorts of attacks. But that is mostly not true – sometimes it’s the other way around. Or, okay, let’s say that it’s partially true, but even then you shouldn’t blame WordPress.
Why? Because it’s usually your fault that your site got hacked. There are some responsibilities that you have to take care of as a website owner. So the key question is always, what are *you* doing to save your site from being hacked?
Today, I plan to discuss quite a few simple tricks that can help you secure your WordPress website:

Part (a): Secure the login page and prevent brute force attacks

Everyone knows the standard WordPress login page URL. The backend of the website is accessed from there, and that is the reason why people try to brute force their way in. Just add /wp-login.php or /wp-admin/ at the end of your domain name and there you go.
What I recommend is to customize the login page URL and even the page’s interaction. That’s the first thing I do when I start securing my website.
Here are some suggestions for securing your login page:

1. Set up website lockdown and ban users

A lockdown feature for failed login attempts can solve a huge problem, i.e. no more continuous brute force attempts. Whenever there is a hacking attempt with repetitive wrong passwords, the site gets locked, and you get notified of this unauthorized activity.
I found out that the iThemes Security plugin is one of the best such plugins out there, and I’ve been using it for quite some time. The plugin has a lot to offer in this respect. You can specify a certain number of failed login attempts after which the plugin bans the attacker’s IP address.

(Alternatively, you can also use the Login LockDown plugin that was built to help you with this problem only.)

2. Use 2-factor authentication

Introducing the 2-factor authentication (2FA) at the login page is another good security measure. In this case, the user provides login details for two different components. The website owner decides what those two are. It can be a regular password followed by a secret question, a secret code, a set of characters, etc.
I prefer using a secret code while deploying 2FA on any of my websites. The WP Google Authenticator plugin helps me with that in just a few clicks.

3. Use email as login

By default, you have to input your username to log in. Using an email ID instead of a username is a more secure approach. The reasons are quite obvious. Usernames are easy to predict, while email IDs are not. Also, any WordPress user account is always created with a unique email address, making it a valid identifier for logging in.
The WP Email Login plugin works out of the box for this purpose. It starts working right after the activation and it requires no configuration at all.
To test it, just log out of your website and then log back in, but this time use the email address that you created the account with.

4. Rename your login URL

To change the login URL is an easy thing to do. By default, the WordPress login page can be accessed easily via wp-login.php or wp-admin added to the site’s main URL.
When hackers know the direct URL of your login page, they can try to brute force their way in. They try to log in with their GWDb (Guess Work Database, i.e. a database of guessed usernames and passwords; e.g. username: admin and password: p@ssword … with millions of such combinations).
So, at this point – if you’ve been following along – we have already restricted the user login attempts and swapped usernames for email IDs. Now we can replace the login URL and get rid of 99% of direct brute force attacks.
This little trick restricts an unauthorized entity from accessing the login page. Only someone with the exact URL can do it. Again, the iThemes Security plugin can help you change your login URLs. Like so:

• Change wp-login.php to something unique; e.g. my_new_login
• Change /wp-admin/ to something unique; e.g. my_new_admin
• Change /wp-login.php?action=register to something unique; e.g. my_new_registeration

5. Adjust your passwords

Play around with the website’s passwords and change them regularly. Improve their strength by adding uppercase and lowercase letters, numbers, and special characters. This password generator is a useful resource.

Part (b): Secure your admin dashboard

For a hacker, the most engaging part of a website is the admin dashboard, which is indeed the most protected section of all. So, attacking the strongest part is the real challenge and, if accomplished, it gives the hacker a moral victory and the access to do a lot of damage.
Here’s what you can do:

6. Protect the wp-admin directory

The wp-admin directory is the heart of any WordPress website. Therefore, if this part of your site gets breached then the entire site can get damaged.
One possible way to prevent this is to password-protect the wp-admin directory. With such security measure, the website owner may access the dashboard by submitting two passwords. One protects the login page, and the other the WordPress admin area. If the website users are required to get access to some particular parts of the wp-admin, you may unblock those parts while locking the rest.
You can use the AskApache Password Protect plugin for securing the admin area. It automatically generates a .htpasswd file, encrypts the password and configures the correct security-enhanced file permissions.

7. Use SSL to encrypt data

Implementing an SSL (Secure Socket Layer) certificate is one smart move to secure the admin panel. SSL ensures secure data transfer between user browsers and the server, making it difficult for hackers to breach the connection or spoof your info.
Getting an SSL certificate for your WordPress website is not an issue. You can purchase one from some dedicated companies or alternatively ask your hosting firm to hook you up with one (it’s often an option with their hosting packages).
I use the Let’s Encrypt free open source SSL certificate on most of my sites. Any good hosting company like SiteGround offers free Let’s Encrypt with their hosting packages.
The SSL certificate also affects your website’s rankings at Google. Google ranks sites with SSL higher than those without it. That means more traffic. Now who doesn’t want that?

8. Add user accounts with care

If you run a WordPress blog, or rather a multi-author blog, then you need to deal with multiple people accessing your admin panel. This could make your website more vulnerable to security threats.
You can use a plugin like Force Strong Passwords for your users if you want to make sure that whatever passwords they use are secure. This is just a precautionary measure.

9. Change the admin username

During WordPress installation, you should never choose “admin” as the username for your main administrator account. Such an easy-to-guess username is approachable for hackers. All they need to know is the password, and your entire site gets into the wrong hands.
I can’t tell you how many times I have scrolled through my website logs, and found login attempts with username “admin”.
The iThemes Security plugin can stop such attempts cleverly by immediately banning any IP address that attempts to log in with that username.

10. Monitor your files

If you want some extra added security, you can monitor the changes to the website’s files via plugins like Acunetix WP Security, Wordfence, or again, iThemes Security.

Part (c): Secure the database

All of your site’s data and information is stored in the database. Taking care of it is just crucial. Here are a few things you can do to make it more secure:

11. Change the WordPress database table prefix

If you have ever installed WordPress then you are familiar with the wp- table prefix that is used by the WordPress database. I recommend you change it to something unique.
Using the default prefix makes your site database prone to SQL injection attacks. Such attack can be prevented by changing wp- to some other term, e.g. you can make it mywp-, wpnew-, etc.
If you have already installed your WordPress website with the default prefix, then you can use a few plugins to change it. Plugins like WP-DBManager or iThemes Security can help you do the job with just a click of a button. (Make sure you back up your site before doing anything to the database).

12. Back up your site regularly

No matter how secure your website is, there is always room for improvements. But at the end of the day, keeping an off-site backup somewhere is perhaps the best antidote no matter what happens.
If you have a backup, you can always restore your WordPress website to a working state any time you want. There are some plugins that can help you in this respect. For instance, there are all of these.

If you are looking for a premium solution then I recommend VaultPress by Automattic, which is great. I have it set up so it creates backups every 30 minutes. And should anything bad ever happen, I can easily restore the site with just one click. On top of that, it also checks my site for malware, and alerts me if anything shady is going on.

13. Set strong passwords for your database

A strong password for the main database user is a must – the one WordPress uses to access the database.
As always, use uppercase, lowercase, numbers, and special characters for the password. I once again recommend password generator as a useful resource.

Part (d): Secure your hosting setup

Almost all hosting companies claim to provide an optimized environment for WordPress, but we can still go a step further:

14. Protect the wp-config.php file

The wp-config.php file holds crucial information about your WordPress installation, and it’s in fact the most important file in your site’s root directory. Protecting it means protecting the core of your WordPress blog.
It gets difficult for hackers to breach the security of your site if the wp-config.php file becomes inaccessible to them.
The good news is that making this happen is really easy. Just take your wp-config.php file and move it to a higher level than your root directory.
Now the question is, if you store it elsewhere, how does the server access it? In the current WordPress architecture, the configuration file settings are set the highest on the priority list. So, even if it is stored one fold above the root directory, WordPress can still see it.

15. Disallow file editing

If a user has admin access to your WordPress dashboard then they can edit any files that are part of your WordPress installation. This includes all plugins and themes.
However, if you disallow file editing, even if a hacker obtains admin access to your WordPress dashboard, they still won’t be able to modify any file.
Add the following to the wp-config.php file (at the very end):

define('DISALLOW_FILE_EDIT', true);

16. Connect the server correctly

When setting up your site, connect the server only through SFTP or SSH. SFTP is always preferred over the traditional FTP because of its security features that are, of course, not attributed with FTP.
Connecting the server this way ensures secure transfers of all files. Many hosting providers offer this service as part of their package. If not – you can do it manually (just google for tutorials; there’s a lot of stuff out there).

17. Set directory permissions carefully

Wrong directory permissions can be fatal, especially if you’re working in a shared hosting environment.
In such a case, changing files and directory permissions is a good move to secure the website at the hosting level. Setting the directory permissions to “755” and files to “644” protects the whole filesystem – directories, subdirectories, and individual files.
This can be done either manually via the File Manager inside your hosting control panel, or through the terminal (connected with SSH) – use the “chmod” command.
For more, you can read about correct permission scheme of WordPress or install the iThemes Security plugin to check your current permission settings.

18. Disable directory listing with .htaccess

If you create a new directory as part of your website and do not put an index.html file in it, you may be surprised to find that your visitors can get a full directory listing of everything that’s in that directory.
For example, if you create a directory called “data”, you can see everything in that directory simply by typing http://www.example.com/data/ in your browser. No password or anything is needed.
You can prevent this by adding the following line of code in your .htaccess file:

Options All -Indexes

Part (e): Secure your WordPress themes and plugins

Themes and plugins are essential ingredients of any WordPress website. Unfortunately, they can also pose serious security threats. Let’s find out how we can secure WordPress themes and plugins the right way:

19. Update regularly

Every good software product is supported by its developers and gets updated now and then, but WordPress is updated very frequently. These updates are meant to fix bugs and sometimes have vital security patches.
Not updating your themes and plugins can mean serious trouble. Many hackers rely on the mere fact that people can’t be bothered to update their plugins and themes. More often than not, those hackers exploit bugs that have already been fixed.
So, if you’re using WordPress products then update them regularly. Plugins, themes, everything.

20. Remove your WordPress version number

Your current WordPress version number can be found very easily. It’s basically sitting right there in your site’s source view.
Here’s the thing, if the hackers know which version of WordPress you use, it’s easier for them to tailor-build the perfect attack.
You can hide your version number with almost every security plugin that I mentioned above.

Final words

If you are a beginner then that was a lot to take in. Everything that I mentioned in this article is a step in the right direction. The more you care about your WordPress site security, the harder it gets for a hacker to break in.
As usual, don’t hesitate to leave any questions or comments below, and I’ll try to respond to each of them.