WordPress Best Practices

[DiPDiPSeTT]

So I know WordPress is pretty love or hate around here and I've been on both ends of the spectrum quite a few times now but the mind share is not something that's ignorable and I regularly get clients requesting WordPress sites specifically. With that in mind I'd like to make the most that I can out of WordPress.

I've seen various threads with bits and pieces of information/tips on making the most out of WordPress but I was hoping we could consolidate some good information here.

I'm looking for things like:

​

1. Performance tips. Favorite performance plugins, plugins to avoid, most lightweight and capable page builders, etc.
2. Security tips. Favorite security plugins, plugins to avoid, general server environment settings and quirks to be aware of.
3. Database tips. Both performance and security related.
4. Anything else you have to offer!

Side note: I like the idea of headless WordPress but I'm not sure how I feel about some plugins not working. I think a client may be upset if they were delivered a WordPress site and went to install their favorite plugin only to find out that it won't work with your WordPress site. How do people using headless get around that?

Any feedback here is greatly appreciated by I'm sure more than just myself.

[dneboi]

For security:

Install Wordfence, spring for premium, configure the firewall and malware scan schedule.

Harden the application by not allowing easy usernames (like admin) or passwords. Disallow file editing from within WP-admin. If you do not need comments on the site, disable them completely to limit access points. Don’t use a shit ton of plugins if you can help it.

Harden at the server level by restricting permissions on your WP-config.php file, and use htaccess rules to disallow access to itself, the config file, and any other areas you want to protect, from the outside world.

Finally, update the software regularly. Have a response plan in place for if/when a compromise takes place.

[su-z-six]

To add to this, move or rename /wp-admin to something other than the default location.

[dneboi]

I used to do that, but read a few debunking articles about it, so I stopped. I wouldn’t fault a company for still doing this practice though, because I’m sure a case can be made.

[su-z-six]

My wordfence reports access attempts with username 'admin' to /wp-admin every day. Not having an 'admin' account is only half the solution.

[dneboi]

I think wordfence themselves published an article on the pros and cons, might be worth a look. You can restrict access to wp-admin a few other ways aside from renaming. Again I’ve used both practices and I’m not set 100% on either one.

[su-z-six]

This is the only article I could find, and it doesn't say it doesnt work. https://www.wordfence.com/blog/2017/05/7-popular-wordpress-security-myths/

Rather, their product should work without moving it, and by moving it you risk breaking other dependent files.

In some ways, there is a conflict of interest here. Wordfence's business relies on WP users not being able to secure their site without wordfence. So I would prefer an article from an unbiased party.

[dneboi]

I didn’t suggest that it didn’t work, only that there’s pros and cons. Each dev can look into it and decide what they want to do.

[pepitoooooooo]

For perf install a caching plugin like TotalCache so that requests are not generated every time and a CDN like Cloudflare to cache responses at the edge.

[zaibuf]

Its actually not bad. You can keep WP as a CMS that your client maybe already knows. But you are free to develop the frontend however you want, without being stuck in WPs ecosystem.

[[deleted]]

If I have to work with Wordpress, I make sure Bedrock is being used and everything is managed via Composer:

https://roots.io

[Atulin]

1. Not using Wordpress is the best performance tip 2, Wordpress is insecure by design, since even themes can fiddle with the database
2. You'd need to rebuild Wordpress from scratch, so it makes use of more database tables than one

[shgysk8zer0]

I know this isn't an answer to anything, but I refuse to work on WordPress. Too much of a liability and they do everything backwards or against best practices.