Before doing any of the following it’ll be a good idea to back up your database. You can do this via phpMyAdmin (if you know what your’re doing) or there’s a handy little plugin called WP-DBManager which will do it for you and lots lots more. Whilst we’re on that note, please remember to back up your database every now and again, just in case!

1. Remove any plugins that you simply don’t use

Visit your Wordpress Admin site and click on Plugins > Inactive to find out which will be safe to remove. You should also take a look at your Active plugins as there might be some in there to delete as well (be careful though as they may be used somewhere on your site.

2. Update Wordpress to the latest version

You should see a warning at the top of Wordpress Admin page if you need to upgrade to the latest version. It’s a wise idea for security reasons to keep up to date. Here’s a handy guide to upgrading Wordpress.

3. Upgrade any out of date plugins

If there’re are newer versions of plugins available then you will see a little number next to “Plugins” in your Wordpress Admin page.

4. Find orphan options in your database

Luckily there’s a plugin for this, as hunting through a MySQL database – if you don’t know what you’re doing – can be a daunting task. So install Clean Options and select “Find Orphaned Options”. You’ll more than likely be presented with a huge list. Now, take your time and look at these carefully. If there’s any that are obvious then select them and delete. There’s also a useful search option where you can search for that option in Google – there you might be able to find out what it is and whether it’s safe to delete. Just because it’s an orphan file it doesn’t mean that it’s not being used by one of your plugins. So, really, just take your time with this.

5. Optimize your database

Download WP-Optimize and  remove all post revisions, clean marked spam comments, clean unapproved comments and optimize database tables. A great tool that can save a lot of space in your database. I got one site down from 16mb to 10mb.

6. Cache your pages and posts

Every time somebody views a post on your blog there are numerous scripts that have to be run each and every time. This can be very processor intensive and your web hosts won’t like you for it. So download WP Super Cache and use it. It will then only have to run a load of scripts once – then everybody else will see the cached version of the page. Don’t worry if you update it or somebody adds a new comment – it’s clever enough to then generate a new page.

7. Cache your Wordpress Widgets

Widgets work in a different way and so you’ll need another plugin for this called WP Widget Cache.  Now, I was a bit confused as to where the options were for this plugin but they are actually on the Widgets Admin page, above your widget.

8. Reduce the amount of Tags you use

Now, I think and I’m in the process of testing this but, I think that tags are a major problem with CPU usage and so I think you really need to reduce the amount you use. Don’t 20 or 30 tags for every article you publish – stick to a handful.

9. There isn’t really a ninth or tenth tip but 10 Top Tips sounds better than 8!

10. Keep your Wordpress site up to date

Upgade plugins when required, backup your database, backup your files every now and again, clean and optimize your database. If you do these things then everything should run smoothly.

I hope you’ve found this useful if so, then remember to retweet it or share it below. Also, be sure to check out another useful Wordpress post: How to Secure your Wordpress Blog

Related posts:

1. Redirect your site the Search Engine Friendly way
2. Remove the Wordpress Meta Tag from your Blog
3. Secure your Wordpress Blog

If you’re unsure about anything or you’re a little scared to do it yourself then please get in touch where I’ll be more than happy to help or provide a quote for securing your Wordpress Blog. If you know of any other ways to increase the security on your Wordpress Blog then please leave a comment below for others to see.

Remove the ability to browse directories

For example enter www.yourblog.com/wp-content/plugins/ into your browser. If you’ve not yet removed this access then you’ll see a list of all your Wordpress Plugins. This isn’t good as hackers can locate plugins that have security issues and target them in their next attack.

Add the following text to your .htaccess file (usually located in your blog or site’s root directory):

Options All -Indexes

Remove the Wordpress Version Meta Tag

Add the following text to your Wordpress Theme’s “function.php” file. Or use this remove wordpress generator meta tag plugin:

<?php remove_action(‘wp_head’, ‘wp_generator’); ?>

Remove or disguise your “mailto” links

This doesn’t really affect the security of your site but merely helps to combat the ever increasing amount of SPAM you receive. A useful plugin for this is Spamshiv which masks any mailto links it finds on your site, automatically.

Set the minimum file and directory permissions

Your files will need a certain amount of permission rights for your blog to write files to your server. This can sometime leave them vulnerable especially with 777 set to your files and folders. Download the install the very useful WP Security Scan plugin which will tell you what your folders are currently set to and what they need to be set at to function correctly but also securing them at the same time.

Change or remove your “admin” username

Again, another one where hackers use the admin username and attempt a brute force password guessing attack. If you have a really secure password (minimum 12 characters using upper and lower case letters, numbers and symbols) then there’s no need to worry but it might be worth changing the username to something less generic. Go into the Wordpress Users panel and see if there’s any posts attributed to the admin user. You can then delete that user but remember even if it says zero posts you may have created pages with that user so make sure you select “Attribute all posts and links to” and then select another user. Make sure you have another user on the list with administrator privileges. If there are then you’ll need to go into phpMyAdmin (accessible via your website’s cPanel) and locate your Wordpress Database (from those listed in the left column). Locate the and click users (from the left column – should be something_users). Tick the user_login checkbox and select the Browse tab. Click Edit (Pencil icon) and change the user_login text to something else. This will change the username and also replicate those changes to your Wordpress Admin.

Keep Wordpress and your Plugins up to date

This can help with security vulnerabilities that may occur in an older version. You will be notified that an update to Wordpress is available when you login to your Admin Site. Likewise, if there are Plugin updates available these will be shown in the Plugins Panel.

Change your Wordpress Database Prefix

Firstly before doing this make sure you backup both your site and your SQL database – at least then if anything goes wrong you can revert back. By default Wordpress adds a wp_ prefix to it’s database tables (if you haven’t installed Wordpress yet then this can be prevented by searching for “wp_” in the wp_config.php file to something less obvious such as “pju12tr_” or whatever you like – you can then continue with your installation) this needs to be changed to something less Wordpress orientated. Do this using the WP Security Scan plugin (mentioned above) or via phpMyAdmin in your website’s cPanel.

Deny access to you wp-admin directory

If you’re the only person that needs to access the Wordpress Admin Panel and you do so from one location, then it might be worth denying access to all other IP addresses. Your IP address can be found at What is My IP then add the following to your .htaccess file, located in the wp-admin directory (If no file exists then create a plain text file, name it .htaccess and upload it to that directory). The xx below need to be replaced with your IP address.

allow from xx.xx.xx.xx
deny from all

Remove the readme.html folder from your Wordpress root directory

There’s no need to have this on your server and it can contain version numbers and other useful info for hackers. Best to simply delete it.

Related posts:

1. 10 Tips to Clean, Optimize and Speed up your Wordpress Site
2. Backing up your Website using cPanel
3. iPhone to Mac Wireless Networking

Wordpress Cheat sheets

Not so much cheating as great reference guides. There are lots and lots of useful Wordpress tags that you can add to pages and templates. Here are a couple of great Wordpress Cheat Sheets:

WordPress Visual Cheat Sheet

Free Complete Wordpress Cheat Sheet

Body Class

Replace the <body> tag with

<body <?php body_class(); ?>>

This will allow you to change elements on the page on a page-by-page basis simply by referencing the body in your CSS. For example you may see this, when you view the source code of your live page:

<body class=”page page-id-2 page-template page-template-default logged-in”>

which would then allow you to target elements on that specific page in your CSS.

For more information visit the Official Wordpress page.

Custom field in Wordpress template

Adds a field within your template that will show custom bits of text, images etc that you add from within the post/page admin. Add the code to your template e.g.

<?php echo get_post_meta($post->ID, 'custom-field-name', true); ?>

Then add a new custom field to your page/post and add the name e.g. custom-field-name.

Custom field in Wordpress template with if else statement

There are situations where you need to see whether the custom field has content of a certain criteria and then display something else.

In this example the “custom-field-name” is the name of the custom field you are calling. If the content of that custom field contains “London” then the outputted text will show as “capital of England”. If “Edinburgh” then the content will be “capital of Scotland”. If no content exists in that custom field then the text “No capitals” will be displayed.

<?php
$key = 'custom-field-name';
$themeta = get_post_meta($post-&gt;ID, $key, TRUE);
if ($themeta == 'London'){
echo 'capital of England';
} else if ($themeta == 'Edinburgh') {
echo 'capital of Scotland';
} else {
echo 'No capitals';
}
?>

If Else Wordpress

The following code will add tags to the post, if there are any, if there’s not then it will add a bit of text. This function can be used in lots of different ways and is incredibly useful.

<?php if (has_tag()) : ?>
<div><?php the_tags('Tagged with: ',' / ','<br />'); ?></div>
<?php else : ?>
<div>Sorry, no tags here!</div>
<?php endif; ?>

Another example is that if you want to continually add elseif statements:

<?php
if (is_page('about')) {
get_sidebar('about');
} elseif (is_page('what-we-do')) {
get_sidebar('blog');
} else {
get_sidebar('page');
}
?>

Wrap your Custom Field in DIV tags

It’s straight forward to show your custom field using the code mentioned above but what it would like to wrap that custom field in DIV tags or Paragraph tags or whatever else you fancy. Here’s a few options:

Display and wrap the custom field named “custom-field-name” in the div class “my-class”. If there’s no Custom Field by that name or nothing is entered in that field then display the text “No Custom Field here”.

<?php $customfield = get_post_meta($post->ID, 'custom-field-name', true);
if ($customfield) {
?>
<?php echo '<div class="my-class">'.$customfield.'</div>'; ?>
<?php } else { ?>
<div class="my-class">No Custom Field here</div>
<?php } ?>

The following will only show the Custom field if it exists. It will also be wrapped in list tags. If not then nothing will be shown:

<?php $customfield = get_post_meta($post->ID, 'custom-field-name', true);
if ($customfield) {
?>
<?php echo '<li>'.$customfield.'</li>';
}?>

Conditional tags

Useful tags for use in your Wordpress templates: http://codex.wordpress.org/Conditional_Tags

Control the amount of posts per page/category/search or archive

Open the Wordpress template file and locate the following:

<?php if (have_posts()) : while (have_posts()) : the_post(); ?>

and add the following code directly above:

<?php $posts=query_posts($query_string . '&posts_per_page=-1'); ?>

The -1 indicates an infinite amount of posts – you can change this to whatever amount you’d like to appear. Bear in mind the page load time and file size if using an infinite amount.

Get all Sticky Posts

Insert this code into your template file to display all of your Sticky Posts

<?php query_posts(array('post__in'=>get_option('sticky_posts'))); ?>

Execute shortcode inside custom field

Allows shortcode to be used inside a custom field

<?php echo apply_filters('the_content', get_post_meta($post->ID, 'custom-field-name', true)); ?>

Related posts:

1. 10 Tips to Clean, Optimize and Speed up your Wordpress Site
2. Remove the Wordpress Meta Tag from your Blog
3. Secure your Wordpress Blog